dockhand/lib/server/license.ts

import crypto from 'node:crypto';
import os from 'node:os';
import { getSetting, setSetting } from './db';
import { sendEventNotification } from './notifications';

// RSA Public Key for license verification
// This key can only VERIFY signatures, not create them
// The private key is kept secret and used only for license generation
const LICENSE_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoGJOObrKQyOPrDC+xSVh
Cq5WeUQqwvAl2xEoI5iOhJtHIvnlxayc2UKt9D5WVWS0dgzi41L7VD2OjTayrbL8
RxPXYh0EfMtnKoJZyFwN1XdlYk8yUjs2TRXnrw8Y+riuMjFWgUHmWUQTA7yBnJG6
9efCMUDREHwGglPIKhTstQfSqi2fNO1GCgY1W7JCMnE8CCpwLGvLodbWFUe1CwT0
OgRZRNWPljc/cX5DLSaB1RXFUnBM4O9YalNCNOR3HvEV/8HULFtDpZT0ZwRbC3K3
R8GFY97lrqADuWVaEdRRYdr402eAcd4DnRT62OjpEllNbRI3U5Wyj6EmYm3Cmc9Q
GwIDAQAB
-----END PUBLIC KEY-----`;

export type LicenseType = 'enterprise' | 'smb';

export interface LicensePayload {
	name: string;
	host: string;
	issued: string;
	expires: string | null;
	type: LicenseType;
	v?: number; // Version: 2 = RSA signed
}

export interface LicenseStatus {
	valid: boolean;
	active: boolean;
	payload?: LicensePayload;
	error?: string;
}

export interface StoredLicense {
	name: string;
	key: string;
	activated_at: string;
}

/**
 * Validates a license key using RSA-SHA256 signature verification
 */
export function validateLicense(licenseKey: string, currentHost?: string): LicenseStatus {
	try {
		// Clean the license key - remove whitespace, newlines, etc.
		const cleanKey = licenseKey.replace(/\s+/g, '');

		const parts = cleanKey.split('.');
		if (parts.length !== 2) {
			return { valid: false, active: false, error: 'Invalid license format' };
		}

		const [payloadBase64, signature] = parts;

		// Verify RSA-SHA256 signature
		const verify = crypto.createVerify('RSA-SHA256');
		verify.update(payloadBase64);
		const isValid = verify.verify(LICENSE_PUBLIC_KEY, signature, 'base64url');

		if (!isValid) {
			return { valid: false, active: false, error: 'Invalid license signature' };
		}

		// Decode payload
		const payload: LicensePayload = JSON.parse(
			Buffer.from(payloadBase64, 'base64url').toString()
		);

		// Check expiration
		if (payload.expires && new Date(payload.expires) < new Date()) {
			return { valid: false, active: false, error: 'License has expired', payload };
		}

		// Check host (allow wildcard matching)
		const hostToCheck = currentHost || os.hostname();
		if (payload.host !== '*') {
			const hostMatches =
				payload.host === hostToCheck ||
				(payload.host.startsWith('*.') && hostToCheck.endsWith(payload.host.slice(1)));

			if (!hostMatches) {
				return {
					valid: false,
					active: false,
					error: `License is not valid for this host (${hostToCheck})`,
					payload
				};
			}
		}

		return { valid: true, active: true, payload };
	} catch (error) {
		return {
			valid: false,
			active: false,
			error: `License validation failed: ${error instanceof Error ? error.message : 'Unknown error'}`
		};
	}
}

/**
 * Gets the currently stored license
 */
export async function getStoredLicense(): Promise<StoredLicense | null> {
	return getSetting('enterprise_license');
}

/**
 * Stores and activates a license
 */
export async function activateLicense(
	name: string,
	key: string
): Promise<{ success: boolean; error?: string; license?: StoredLicense }> {
	// Clean the key - remove whitespace, newlines, etc.
	const cleanKey = key.replace(/\s+/g, '');

	// Validate the license first (use getHostname() for Docker-aware hostname detection)
	const validation = validateLicense(cleanKey, getHostname());

	if (!validation.valid) {
		return { success: false, error: validation.error };
	}

	// Check if the name matches
	if (validation.payload && validation.payload.name !== name.trim()) {
		return {
			success: false,
			error: `License name mismatch. Expected "${validation.payload.name}", got "${name.trim()}"`
		};
	}

	// Store the license (with cleaned key)
	const license: StoredLicense = {
		name: name.trim(),
		key: cleanKey,
		activated_at: new Date().toISOString()
	};

	await setSetting('enterprise_license', license);

	return { success: true, license };
}

/**
 * Removes the current license
 */
export async function deactivateLicense(): Promise<boolean> {
	await setSetting('enterprise_license', null);
	return true;
}

/**
 * Checks if the current installation has an active enterprise license
 */
export async function isEnterprise(): Promise<boolean> {
	const stored = await getStoredLicense();
	if (!stored || !stored.key) {
		return false;
	}

	const validation = validateLicense(stored.key, getHostname());
	// Only true for enterprise licenses (SMB does not unlock enterprise features)
	return validation.valid && validation.active && validation.payload?.type === 'enterprise';
}

/**
 * Gets the license type if a valid license is active
 */
export async function getLicenseType(): Promise<LicenseType | null> {
	const stored = await getStoredLicense();
	if (!stored || !stored.key) {
		return null;
	}

	const validation = validateLicense(stored.key, getHostname());
	if (validation.valid && validation.active && validation.payload) {
		return validation.payload.type;
	}
	return null;
}

/**
 * Gets the full license status including validation
 */
export async function getLicenseStatus(): Promise<LicenseStatus & { stored?: StoredLicense }> {
	const stored = await getStoredLicense();

	if (!stored || !stored.key) {
		return { valid: false, active: false };
	}

	const validation = validateLicense(stored.key, getHostname());
	return { ...validation, stored };
}

/**
 * Gets the current hostname for license validation.
 *
 * In Docker: DOCKHAND_HOSTNAME is set by the entrypoint script from Docker API.
 * Outside Docker: Falls back to os.hostname().
 */
export function getHostname(): string {
	return process.env.DOCKHAND_HOSTNAME || os.hostname();
}

// Track when we last sent a license expiring notification
let lastLicenseExpiryNotification: number | null = null;
const LICENSE_EXPIRY_NOTIFICATION_COOLDOWN = 86400000; // 24 hours between notifications
const LICENSE_EXPIRY_WARNING_DAYS = 30; // Warn when license expires within 30 days

/**
 * Check if the enterprise license is expiring soon and send notification
 * Call this periodically (e.g., on startup and daily)
 */
export async function checkLicenseExpiry(): Promise<void> {
	try {
		const status = await getLicenseStatus();

		// Only check if we have an active license with an expiry date
		if (!status.valid || !status.active || !status.payload?.expires) {
			return;
		}

		const expiryDate = new Date(status.payload.expires);
		const now = new Date();
		const daysUntilExpiry = Math.ceil((expiryDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));

		// Check if expiring within warning threshold
		if (daysUntilExpiry > 0 && daysUntilExpiry <= LICENSE_EXPIRY_WARNING_DAYS) {
			// Check cooldown to avoid spamming
			if (lastLicenseExpiryNotification && Date.now() - lastLicenseExpiryNotification < LICENSE_EXPIRY_NOTIFICATION_COOLDOWN) {
				return;
			}

			const licenseTypeName = status.payload.type === 'enterprise' ? 'Enterprise' : 'SMB';
			console.log(`[License] ${licenseTypeName} license expiring in ${daysUntilExpiry} days`);

			await sendEventNotification('license_expiring', {
				title: 'License expiring soon',
				message: `Your ${licenseTypeName} license expires in ${daysUntilExpiry} day${daysUntilExpiry === 1 ? '' : 's'} (${expiryDate.toLocaleDateString()}). Contact support to renew.`,
				type: 'warning'
			});

			lastLicenseExpiryNotification = Date.now();
		}
	} catch (error) {
		console.error('[License] Failed to check license expiry:', error);
	}
}