add enterprise license system

server/private/routers/external.ts

@@ -19,9 +19,16 @@ import * as loginPage from "#private/routers/loginPage";
 import * as orgIdp from "#private/routers/orgIdp";
 import * as domain from "#private/routers/domain";
 import * as auth from "#private/routers/auth";
+import * as license from "#private/routers/license";
+import * as generateLicense from "./generatedLicense";
 
 import { Router } from "express";
-import { verifyOrgAccess, verifySessionUserMiddleware, verifyUserHasAction } from "@server/middlewares";
+import {
+    verifyOrgAccess,
+    verifyUserHasAction,
+    verifyUserIsOrgOwner,
+    verifyUserIsServerAdmin
+} from "@server/middlewares";
 import { ActionsEnum } from "@server/auth/actions";
 import {
     verifyCertificateAccess,
@@ -33,28 +40,19 @@ import rateLimit, { ipKeyGenerator } from "express-rate-limit";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 
-import { unauthenticated as ua, authenticated as a } from "@server/routers/external";
+import {
+    unauthenticated as ua,
+    authenticated as a
+} from "@server/routers/external";
+import { verifyValidLicense } from "../middlewares/verifyValidLicense";
+import { build } from "@server/build";
 
 export const authenticated = a;
 export const unauthenticated = ua;
 
-unauthenticated.post(
-    "/quick-start",
-    rateLimit({
-        windowMs: 15 * 60 * 1000,
-        max: 100,
-        keyGenerator: (req) => req.path,
-        handler: (req, res, next) => {
-            const message = `We're too busy right now. Please try again later.`;
-            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
-        },
-        store: createStore()
-    }),
-    auth.quickStart
-);
-
 unauthenticated.post(
     "/remote-exit-node/quick-start",
+    verifyValidLicense,
     rateLimit({
         windowMs: 60 * 60 * 1000,
         max: 5,
@@ -68,9 +66,9 @@ unauthenticated.post(
     remoteExitNode.quickStartRemoteExitNode
 );
 
-
 authenticated.put(
     "/org/:orgId/idp/oidc",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.createIdp),
     orgIdp.createOrgOidcIdp
@@ -78,6 +76,7 @@ authenticated.put(
 
 authenticated.post(
     "/org/:orgId/idp/:idpId/oidc",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyIdpAccess,
     verifyUserHasAction(ActionsEnum.updateIdp),
@@ -86,6 +85,7 @@ authenticated.post(
 
 authenticated.delete(
     "/org/:orgId/idp/:idpId",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyIdpAccess,
     verifyUserHasAction(ActionsEnum.deleteIdp),
@@ -94,6 +94,7 @@ authenticated.delete(
 
 authenticated.get(
     "/org/:orgId/idp/:idpId",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyIdpAccess,
     verifyUserHasAction(ActionsEnum.getIdp),
@@ -102,6 +103,7 @@ authenticated.get(
 
 authenticated.get(
     "/org/:orgId/idp",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.listIdps),
     orgIdp.listOrgIdps
@@ -111,6 +113,7 @@ authenticated.get("/org/:orgId/idp", orgIdp.listOrgIdps); // anyone can see this
 
 authenticated.get(
     "/org/:orgId/certificate/:domainId/:domain",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyCertificateAccess,
     verifyUserHasAction(ActionsEnum.getCertificate),
@@ -119,49 +122,87 @@ authenticated.get(
 
 authenticated.post(
     "/org/:orgId/certificate/:certId/restart",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyCertificateAccess,
     verifyUserHasAction(ActionsEnum.restartCertificate),
     certificates.restartCertificate
 );
 
-authenticated.post(
-    "/org/:orgId/billing/create-checkout-session",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.billing),
-    billing.createCheckoutSession
-);
+if (build === "saas") {
+    unauthenticated.post(
+        "/quick-start",
+        rateLimit({
+            windowMs: 15 * 60 * 1000,
+            max: 100,
+            keyGenerator: (req) => req.path,
+            handler: (req, res, next) => {
+                const message = `We're too busy right now. Please try again later.`;
+                return next(
+                    createHttpError(HttpCode.TOO_MANY_REQUESTS, message)
+                );
+            },
+            store: createStore()
+        }),
+        auth.quickStart
+    );
 
-authenticated.post(
-    "/org/:orgId/billing/create-portal-session",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.billing),
-    billing.createPortalSession
-);
+    authenticated.post(
+        "/org/:orgId/billing/create-checkout-session",
+        verifyOrgAccess,
+        verifyUserHasAction(ActionsEnum.billing),
+        billing.createCheckoutSession
+    );
+
+    authenticated.post(
+        "/org/:orgId/billing/create-portal-session",
+        verifyOrgAccess,
+        verifyUserHasAction(ActionsEnum.billing),
+        billing.createPortalSession
+    );
+
+    authenticated.get(
+        "/org/:orgId/billing/subscription",
+        verifyOrgAccess,
+        verifyUserHasAction(ActionsEnum.billing),
+        billing.getOrgSubscription
+    );
+
+    authenticated.get(
+        "/org/:orgId/billing/usage",
+        verifyOrgAccess,
+        verifyUserHasAction(ActionsEnum.billing),
+        billing.getOrgUsage
+    );
+
+    authenticated.get(
+        "/org/:orgId/license",
+        verifyOrgAccess,
+        generateLicense.listSaasLicenseKeys
+    );
+
+    authenticated.put(
+        "/org/:orgId/license",
+        verifyOrgAccess,
+        generateLicense.generateNewLicense
+    );
+}
 
 authenticated.get(
-    "/org/:orgId/billing/subscription",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.billing),
-    billing.getOrgSubscription
+    "/domain/namespaces",
+    verifyValidLicense,
+    domain.listDomainNamespaces
 );
 
-authenticated.get(
-    "/org/:orgId/billing/usage",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.billing),
-    billing.getOrgUsage
-);
-
-authenticated.get("/domain/namespaces", domain.listDomainNamespaces);
-
 authenticated.get(
     "/domain/check-namespace-availability",
+    verifyValidLicense,
     domain.checkDomainNamespaceAvailability
 );
 
 authenticated.put(
     "/org/:orgId/remote-exit-node",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.createRemoteExitNode),
     remoteExitNode.createRemoteExitNode
@@ -169,6 +210,7 @@ authenticated.put(
 
 authenticated.get(
     "/org/:orgId/remote-exit-nodes",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.listRemoteExitNode),
     remoteExitNode.listRemoteExitNodes
@@ -176,6 +218,7 @@ authenticated.get(
 
 authenticated.get(
     "/org/:orgId/remote-exit-node/:remoteExitNodeId",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyRemoteExitNodeAccess,
     verifyUserHasAction(ActionsEnum.getRemoteExitNode),
@@ -184,6 +227,7 @@ authenticated.get(
 
 authenticated.get(
     "/org/:orgId/pick-remote-exit-node-defaults",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.createRemoteExitNode),
     remoteExitNode.pickRemoteExitNodeDefaults
@@ -191,6 +235,7 @@ authenticated.get(
 
 authenticated.delete(
     "/org/:orgId/remote-exit-node/:remoteExitNodeId",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyRemoteExitNodeAccess,
     verifyUserHasAction(ActionsEnum.deleteRemoteExitNode),
@@ -199,6 +244,7 @@ authenticated.delete(
 
 authenticated.put(
     "/org/:orgId/login-page",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.createLoginPage),
     loginPage.createLoginPage
@@ -206,6 +252,7 @@ authenticated.put(
 
 authenticated.post(
     "/org/:orgId/login-page/:loginPageId",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyLoginPageAccess,
     verifyUserHasAction(ActionsEnum.updateLoginPage),
@@ -214,6 +261,7 @@ authenticated.post(
 
 authenticated.delete(
     "/org/:orgId/login-page/:loginPageId",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyLoginPageAccess,
     verifyUserHasAction(ActionsEnum.deleteLoginPage),
@@ -222,6 +270,7 @@ authenticated.delete(
 
 authenticated.get(
     "/org/:orgId/login-page",
+    verifyValidLicense,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.getLoginPage),
     loginPage.getLoginPage
@@ -231,6 +280,7 @@ export const authRouter = Router();
 
 authRouter.post(
     "/remoteExitNode/get-token",
+    verifyValidLicense,
     rateLimit({
         windowMs: 15 * 60 * 1000,
         max: 900,
@@ -247,6 +297,7 @@ authRouter.post(
 
 authRouter.post(
     "/transfer-session-token",
+    verifyValidLicense,
     rateLimit({
         windowMs: 1 * 60 * 1000,
         max: 60,
@@ -259,4 +310,28 @@ authRouter.post(
         store: createStore()
     }),
     auth.transferSession
-);
+);
+
+authenticated.post(
+    "/license/activate",
+    verifyUserIsServerAdmin,
+    license.activateLicense
+);
+
+authenticated.get(
+    "/license/keys",
+    verifyUserIsServerAdmin,
+    license.listLicenseKeys
+);
+
+authenticated.delete(
+    "/license/:licenseKey",
+    verifyUserIsServerAdmin,
+    license.deleteLicenseKey
+);
+
+authenticated.post(
+    "/license/recheck",
+    verifyUserIsServerAdmin,
+    license.recheckStatus
+);

server/private/routers/generatedLicense/generateNewLicense.ts

@@ -0,0 +1,91 @@
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib/response";
+import privateConfig from "@server/private/lib/config";
+
+export type NewLicenseKey = {
+    licenseKey: {
+        id: number;
+        instanceName: string | null;
+        instanceId: string;
+        licenseKey: string;
+        tier: string;
+        type: string;
+        quantity: number;
+        isValid: boolean;
+        updatedAt: string;
+        createdAt: string;
+        expiresAt: string;
+        orgId: string;
+    };
+};
+
+export type GenerateNewLicenseResponse = NewLicenseKey;
+
+async function createNewLicense(orgId: string, licenseData: any): Promise<any> {
+    try {
+        const response = await fetch(
+            `https://api.fossorial.io/api/v1/license-internal/enterprise/${orgId}/create`,
+            {
+                method: "PUT",
+                headers: {
+                    "api-key":
+                        privateConfig.getRawPrivateConfig().server
+                            .fossorial_api_key!,
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify(licenseData)
+            }
+        );
+
+        const data = await response.json();
+
+        logger.debug("Fossorial API response:", {data});
+        return data;
+    } catch (error) {
+        console.error("Error creating new license:", error);
+        throw error;
+    }
+}
+
+export async function generateNewLicense(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const { orgId } = req.params;
+
+        if (!orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Organization ID is required"
+                )
+            );
+        }
+
+        logger.debug(`Generating new license for orgId: ${orgId}`);
+
+        const licenseData = req.body;
+        const apiResponse = await createNewLicense(orgId, licenseData);
+
+        return sendResponse<GenerateNewLicenseResponse>(res, {
+            data: apiResponse.data,
+            success: apiResponse.success,
+            error: apiResponse.error,
+            message: apiResponse.message,
+            status: apiResponse.status
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred while generating new license"
+            )
+        );
+    }
+}

server/private/routers/generatedLicense/index.ts

@@ -0,0 +1,2 @@
+export * from "./listGeneratedLicenses";
+export * from "./generateNewLicense";

server/private/routers/generatedLicense/listGeneratedLicenses.ts

@@ -0,0 +1,83 @@
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib/response";
+import privateConfig from "@server/private/lib/config";
+
+export type GeneratedLicenseKey = {
+    instanceName: string | null;
+    licenseKey: string;
+    expiresAt: string;
+    isValid: boolean;
+    createdAt: string;
+    tier: string;
+    type: string;
+};
+
+export type ListGeneratedLicenseKeysResponse = GeneratedLicenseKey[];
+
+async function fetchLicenseKeys(orgId: string): Promise<any> {
+    try {
+        const response = await fetch(
+            `https://api.fossorial.io/api/v1/license-internal/enterprise/${orgId}/list`,
+            {
+                method: "GET",
+                headers: {
+                    "api-key":
+                        privateConfig.getRawPrivateConfig().server
+                            .fossorial_api_key!,
+                    "Content-Type": "application/json"
+                }
+            }
+        );
+
+        if (!response.ok) {
+            throw new Error(`HTTP error! status: ${response.status}`);
+        }
+
+        const data = await response.json();
+        return data;
+    } catch (error) {
+        console.error("Error fetching license keys:", error);
+        throw error;
+    }
+}
+
+export async function listSaasLicenseKeys(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const { orgId } = req.params;
+
+        if (!orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Organization ID is required"
+                )
+            );
+        }
+
+        const apiResponse = await fetchLicenseKeys(orgId);
+        const keys: GeneratedLicenseKey[] = apiResponse.data.licenseKeys || [];
+
+        return sendResponse<ListGeneratedLicenseKeysResponse>(res, {
+            data: keys,
+            success: true,
+            error: false,
+            message: "Successfully retrieved license keys",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred while fetching license keys"
+            )
+        );
+    }
+}

server/private/routers/internal.ts

@@ -15,6 +15,7 @@ import * as loginPage from "#private/routers/loginPage";
 import * as auth from "#private/routers/auth";
 import * as orgIdp from "#private/routers/orgIdp";
 import * as billing from "#private/routers/billing";
+import * as license from "#private/routers/license";
 
 import { Router } from "express";
 import { verifySessionUserMiddleware } from "@server/middlewares";
@@ -34,3 +35,5 @@ internalRouter.post(
     verifySessionUserMiddleware,
     auth.getSessionTransferToken
 );
+
+internalRouter.get(`/license/status`, license.getLicenseStatus);

server/private/routers/license/activateLicense.ts

@@ -0,0 +1,58 @@
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib/response";
+import license from "#private/license/license";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import { LicenseStatus } from "@server/license/license";
+
+const bodySchema = z
+    .object({
+        licenseKey: z.string().min(1).max(255)
+    })
+    .strict();
+
+export type ActivateLicenseStatus = LicenseStatus;
+
+export async function activateLicense(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { licenseKey } = parsedBody.data;
+
+        try {
+            const status = await license.activateLicenseKey(licenseKey);
+            return sendResponse(res, {
+                data: status,
+                success: true,
+                error: false,
+                message: "License key activated successfully",
+                status: HttpCode.OK
+            });
+        } catch (e) {
+            logger.error(e);
+            return next(
+                createHttpError(HttpCode.INTERNAL_SERVER_ERROR, `${e}`)
+            );
+        }
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/license/deleteLicenseKey.ts

@@ -0,0 +1,72 @@
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib/response";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import { db } from "@server/db";
+import { eq } from "drizzle-orm";
+import { licenseKey } from "@server/db";
+import license from "#private/license/license";
+import { LicenseStatus } from "@server/license/license";
+
+const paramsSchema = z
+    .object({
+        licenseKey: z.string().min(1).max(255)
+    })
+    .strict();
+
+export type DeleteLicenseKeyResponse = LicenseStatus;
+
+export async function deleteLicenseKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { licenseKey: key } = parsedParams.data;
+
+        const [existing] = await db
+            .select()
+            .from(licenseKey)
+            .where(eq(licenseKey.licenseKeyId, key))
+            .limit(1);
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `License key ${key} not found`
+                )
+            );
+        }
+
+        await db.delete(licenseKey).where(eq(licenseKey.licenseKeyId, key));
+
+        const status = await license.forceRecheck();
+
+        return sendResponse(res, {
+            data: status,
+            success: true,
+            error: false,
+            message: "License key deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/license/getLicenseStatus.ts

@@ -0,0 +1,32 @@
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib/response";
+import license from "#private/license/license";
+import { LicenseStatus } from "@server/license/license";
+
+export type GetLicenseStatusResponse = LicenseStatus;
+
+export async function getLicenseStatus(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const status = await license.check();
+
+        return sendResponse<GetLicenseStatusResponse>(res, {
+            data: status,
+            success: true,
+            error: false,
+            message: "Got status",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/license/index.ts

@@ -0,0 +1,5 @@
+export * from "./getLicenseStatus";
+export * from "./activateLicense";
+export * from "./listLicenseKeys";
+export * from "./deleteLicenseKey";
+export * from "./recheckStatus";

server/private/routers/license/listLicenseKeys.ts

@@ -0,0 +1,32 @@
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib/response";
+import license from "#private/license/license";
+import { LicenseKeyCache } from "@server/license/license";
+
+export type ListLicenseKeysResponse = LicenseKeyCache[];
+
+export async function listLicenseKeys(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const keys = license.listKeys();
+
+        return sendResponse<ListLicenseKeysResponse>(res, {
+            data: keys,
+            success: true,
+            error: false,
+            message: "Successfully retrieved license keys",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/license/recheckStatus.ts

@@ -0,0 +1,38 @@
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib/response";
+import license from "#private/license/license";
+import { LicenseStatus } from "@server/license/license";
+
+export type RecheckStatusResponse = LicenseStatus;
+
+export async function recheckStatus(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        try {
+            const status = await license.forceRecheck();
+            return sendResponse(res, {
+                data: status,
+                success: true,
+                error: false,
+                message: "License status rechecked successfully",
+                status: HttpCode.OK
+            });
+        } catch (e) {
+            logger.error(e);
+            return next(
+                createHttpError(HttpCode.INTERNAL_SERVER_ERROR, `${e}`)
+            );
+        }
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}