init

pkg/licenseclient/client.go

@@ -0,0 +1,391 @@
+package licenseclient
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/b1tsblog/ai-disclosure-standard/pkg/licensekit"
+)
+
+type Status struct {
+	Edition      string           `json:"edition"`
+	Licensed     bool             `json:"licensed"`
+	LicenseID    string           `json:"licenseId,omitempty"`
+	Customer     string           `json:"customer,omitempty"`
+	Product      string           `json:"product,omitempty"`
+	Features     []string         `json:"features"`
+	Limits       map[string]int64 `json:"limits,omitempty"`
+	ExpiresAt    string           `json:"expiresAt,omitempty"`
+	Mode         string           `json:"mode,omitempty"`
+	Source       string           `json:"source,omitempty"`
+	LastChecked  string           `json:"lastChecked,omitempty"`
+	LeaseExpires string           `json:"leaseExpiresAt,omitempty"`
+	Reason       string           `json:"reason,omitempty"`
+}
+
+type Config struct {
+	Product        string
+	Token          string
+	TrustStore     licensekit.TrustStore
+	BaseURL        string
+	InstanceID     string
+	Mode           licensekit.VerificationMode
+	ServerURL      string
+	CacheFile      string
+	RefreshEvery   time.Duration
+	RequestTimeout time.Duration
+	ClientVersion  string
+	HTTPClient     *http.Client
+}
+
+type Client struct {
+	cfg      Config
+	mu       sync.RWMutex
+	status   Status
+	claims   licensekit.Claims
+	features map[string]bool
+	stopOnce sync.Once
+	stop     chan struct{}
+}
+
+type introspectRequest struct {
+	Token         string `json:"token"`
+	Product       string `json:"product"`
+	BaseURL       string `json:"baseUrl"`
+	Host          string `json:"host"`
+	InstanceID    string `json:"instanceId,omitempty"`
+	ClientVersion string `json:"clientVersion,omitempty"`
+}
+
+type introspectResponse struct {
+	Valid      bool   `json:"valid"`
+	LeaseToken string `json:"leaseToken,omitempty"`
+	Reason     string `json:"reason,omitempty"`
+}
+
+type cacheDocument struct {
+	LicenseID string `json:"licenseId"`
+	Lease     string `json:"lease"`
+	SavedAt   int64  `json:"savedAt"`
+}
+
+func New(ctx context.Context, cfg Config) *Client {
+	if cfg.RefreshEvery <= 0 {
+		cfg.RefreshEvery = 15 * time.Minute
+	}
+	if cfg.RequestTimeout <= 0 {
+		cfg.RequestTimeout = 5 * time.Second
+	}
+	if cfg.HTTPClient == nil {
+		cfg.HTTPClient = &http.Client{Timeout: cfg.RequestTimeout}
+	}
+	c := &Client{cfg: cfg, stop: make(chan struct{}), status: communityStatus(), features: map[string]bool{}}
+	c.refresh(ctx)
+	return c
+}
+
+func (c *Client) Start(ctx context.Context) {
+	c.mu.RLock()
+	mode := c.status.Mode
+	c.mu.RUnlock()
+	if mode == string(licensekit.ModeOffline) || strings.TrimSpace(c.cfg.Token) == "" {
+		return
+	}
+	go func() {
+		ticker := time.NewTicker(c.cfg.RefreshEvery)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-c.stop:
+				return
+			case <-ticker.C:
+				refreshCtx, cancel := context.WithTimeout(context.Background(), c.cfg.RequestTimeout)
+				c.refresh(refreshCtx)
+				cancel()
+			}
+		}
+	}()
+}
+
+func (c *Client) Close() { c.stopOnce.Do(func() { close(c.stop) }) }
+
+func (c *Client) Refresh(ctx context.Context) Status {
+	c.refresh(ctx)
+	return c.Status()
+}
+
+func (c *Client) Has(feature string) bool {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.isCurrentlyLicensedLocked(time.Now().UTC()) && c.features[feature]
+}
+
+func (c *Client) Limit(name string) (int64, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	if !c.isCurrentlyLicensedLocked(time.Now().UTC()) {
+		return 0, false
+	}
+	value, ok := c.status.Limits[name]
+	return value, ok
+}
+
+func (c *Client) Status() Status {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	out := c.status
+	if out.Licensed && !c.isCurrentlyLicensedLocked(time.Now().UTC()) {
+		out.Licensed = false
+		out.Edition = "community"
+		if out.Reason == "" {
+			out.Reason = "license or online lease is no longer valid"
+		}
+	}
+	out.Features = append([]string{}, c.status.Features...)
+	if c.status.Limits != nil {
+		out.Limits = make(map[string]int64, len(c.status.Limits))
+		for key, value := range c.status.Limits {
+			out.Limits[key] = value
+		}
+	}
+	return out
+}
+
+func (c *Client) isCurrentlyLicensedLocked(now time.Time) bool {
+	if !c.status.Licensed {
+		return false
+	}
+	if c.claims.ExpiresAt > 0 && now.Unix() >= c.claims.ExpiresAt {
+		return false
+	}
+	mode := licensekit.VerificationMode(c.status.Mode)
+	if mode == licensekit.ModeOffline || c.status.LeaseExpires == "" {
+		return true
+	}
+	leaseExpiry, err := time.Parse(time.RFC3339, c.status.LeaseExpires)
+	if err != nil {
+		return false
+	}
+	if mode == licensekit.ModeHybrid {
+		leaseExpiry = leaseExpiry.Add(time.Duration(c.claims.Verification.OfflineGraceSeconds) * time.Second)
+	}
+	return now.Before(leaseExpiry)
+}
+
+func (c *Client) refresh(ctx context.Context) {
+	now := time.Now().UTC()
+	if strings.TrimSpace(c.cfg.Token) == "" {
+		c.apply(communityStatus(), licensekit.Claims{})
+		return
+	}
+	verified, err := licensekit.VerifyLicense(c.cfg.TrustStore, c.cfg.Token, now)
+	if err != nil {
+		c.apply(failedStatus(err.Error(), now), licensekit.Claims{})
+		return
+	}
+	claims := verified.Claims
+	if err := licensekit.ValidateLicenseContext(claims, c.cfg.Product, c.cfg.BaseURL, c.cfg.InstanceID); err != nil {
+		c.apply(failedStatus(err.Error(), now), claims)
+		return
+	}
+	mode := licensekit.StricterMode(claims.Verification.Mode, c.cfg.Mode)
+	base := statusFromClaims(claims, mode, now)
+	if mode == licensekit.ModeOffline {
+		base.Licensed = true
+		base.Source = "offline"
+		c.apply(base, claims)
+		return
+	}
+	if strings.TrimSpace(c.cfg.ServerURL) == "" {
+		base.Edition = "community"
+		base.Reason = "online verification is required but LICENSE_SERVER_URL is empty"
+		c.apply(base, claims)
+		return
+	}
+	lease, source, err := c.obtainLease(ctx, claims, mode, now)
+	if err != nil {
+		base.Edition = "community"
+		base.Reason = err.Error()
+		c.apply(base, claims)
+		return
+	}
+	base.Licensed = true
+	base.Source = source
+	base.LeaseExpires = time.Unix(lease.ExpiresAt, 0).UTC().Format(time.RFC3339)
+	base.Features = licensekit.UniqueSorted(intersection(claims.Features, lease.Features))
+	c.apply(base, claims)
+}
+
+func (c *Client) obtainLease(ctx context.Context, claims licensekit.Claims, mode licensekit.VerificationMode, now time.Time) (licensekit.LeaseClaims, string, error) {
+	leaseToken, err := c.requestLease(ctx)
+	if err == nil {
+		lease, verifyErr := licensekit.VerifyLease(c.cfg.TrustStore, leaseToken, now, 0)
+		if verifyErr != nil {
+			return licensekit.LeaseClaims{}, "", fmt.Errorf("online lease verification failed: %w", verifyErr)
+		}
+		if verifyErr = licensekit.ValidateLeaseContext(lease.Claims, claims, c.cfg.Product, c.cfg.BaseURL, c.cfg.InstanceID); verifyErr != nil {
+			return licensekit.LeaseClaims{}, "", verifyErr
+		}
+		_ = c.writeCache(claims.LicenseID, leaseToken)
+		return lease.Claims, "online", nil
+	}
+	if mode == licensekit.ModeOnline {
+		return licensekit.LeaseClaims{}, "", fmt.Errorf("online verification failed: %w", err)
+	}
+	cached, cacheErr := c.readCache(claims, now)
+	if cacheErr != nil {
+		return licensekit.LeaseClaims{}, "", fmt.Errorf("online verification failed (%v) and no usable cached lease exists (%v)", err, cacheErr)
+	}
+	return cached, "cached-lease", nil
+}
+
+func (c *Client) requestLease(ctx context.Context) (string, error) {
+	host, err := licensekit.HostFromBaseURL(c.cfg.BaseURL)
+	if err != nil {
+		return "", err
+	}
+	body, err := json.Marshal(introspectRequest{Token: c.cfg.Token, Product: c.cfg.Product, BaseURL: c.cfg.BaseURL, Host: host, InstanceID: c.cfg.InstanceID, ClientVersion: c.cfg.ClientVersion})
+	if err != nil {
+		return "", err
+	}
+	endpoint := strings.TrimRight(c.cfg.ServerURL, "/") + "/v1/introspect"
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json")
+	resp, err := c.cfg.HTTPClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	payload, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if err != nil {
+		return "", err
+	}
+	var result introspectResponse
+	if err := json.Unmarshal(payload, &result); err != nil {
+		return "", fmt.Errorf("decode verification response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK || !result.Valid || result.LeaseToken == "" {
+		if result.Reason == "" {
+			result.Reason = resp.Status
+		}
+		return "", errors.New(result.Reason)
+	}
+	return result.LeaseToken, nil
+}
+
+func (c *Client) readCache(claims licensekit.Claims, now time.Time) (licensekit.LeaseClaims, error) {
+	if strings.TrimSpace(c.cfg.CacheFile) == "" {
+		return licensekit.LeaseClaims{}, errors.New("cache file is not configured")
+	}
+	data, err := os.ReadFile(c.cfg.CacheFile)
+	if err != nil {
+		return licensekit.LeaseClaims{}, err
+	}
+	var doc cacheDocument
+	if err := json.Unmarshal(data, &doc); err != nil {
+		return licensekit.LeaseClaims{}, err
+	}
+	if doc.LicenseID != claims.LicenseID {
+		return licensekit.LeaseClaims{}, errors.New("cached lease belongs to another license")
+	}
+	grace := time.Duration(claims.Verification.OfflineGraceSeconds) * time.Second
+	verified, err := licensekit.VerifyLease(c.cfg.TrustStore, doc.Lease, now, grace)
+	if err != nil {
+		return licensekit.LeaseClaims{}, err
+	}
+	if err := licensekit.ValidateLeaseContext(verified.Claims, claims, c.cfg.Product, c.cfg.BaseURL, c.cfg.InstanceID); err != nil {
+		return licensekit.LeaseClaims{}, err
+	}
+	return verified.Claims, nil
+}
+
+func (c *Client) writeCache(licenseID, lease string) error {
+	if strings.TrimSpace(c.cfg.CacheFile) == "" {
+		return nil
+	}
+	if err := os.MkdirAll(filepath.Dir(c.cfg.CacheFile), 0o700); err != nil && filepath.Dir(c.cfg.CacheFile) != "." {
+		return err
+	}
+	data, err := json.Marshal(cacheDocument{LicenseID: licenseID, Lease: lease, SavedAt: time.Now().UTC().Unix()})
+	if err != nil {
+		return err
+	}
+	temp := c.cfg.CacheFile + ".tmp"
+	if err := os.WriteFile(temp, data, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(temp, c.cfg.CacheFile)
+}
+
+func (c *Client) apply(status Status, claims licensekit.Claims) {
+	status.Features = licensekit.UniqueSorted(status.Features)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.status = status
+	c.claims = claims
+	c.features = make(map[string]bool, len(status.Features))
+	for _, feature := range status.Features {
+		c.features[feature] = true
+	}
+}
+
+func communityStatus() Status {
+	return Status{Edition: "community", Features: []string{}, Limits: map[string]int64{}}
+}
+
+func failedStatus(reason string, now time.Time) Status {
+	return Status{Edition: "community", Features: []string{}, Limits: map[string]int64{}, Reason: reason, LastChecked: now.Format(time.RFC3339)}
+}
+
+func statusFromClaims(claims licensekit.Claims, mode licensekit.VerificationMode, now time.Time) Status {
+	limits := map[string]int64{}
+	for key, value := range claims.Limits {
+		limits[key] = value
+	}
+	return Status{
+		Edition: claims.Edition, LicenseID: claims.LicenseID, Customer: claims.Customer, Product: claims.Product,
+		Features: append([]string(nil), claims.Features...), Limits: limits,
+		ExpiresAt: time.Unix(claims.ExpiresAt, 0).UTC().Format(time.RFC3339), Mode: string(mode), LastChecked: now.Format(time.RFC3339),
+	}
+}
+
+func intersection(a, b []string) []string {
+	allowed := make(map[string]bool, len(b))
+	for _, value := range b {
+		allowed[value] = true
+	}
+	out := make([]string, 0, len(a))
+	for _, value := range a {
+		if allowed[value] {
+			out = append(out, value)
+		}
+	}
+	return out
+}
+
+// NewDevelopment returns an in-memory licensed client for local development.
+// Production applications should not expose this path without an explicit development switch.
+func NewDevelopment(product, edition string, features []string) *Client {
+	status := Status{Edition: edition, Licensed: true, Customer: "development", Product: product, Features: licensekit.UniqueSorted(features), Limits: map[string]int64{}, Mode: string(licensekit.ModeOffline), Source: "development", Reason: "insecure development override"}
+	c := &Client{status: status, features: map[string]bool{}, stop: make(chan struct{})}
+	for _, feature := range status.Features {
+		c.features[feature] = true
+	}
+	return c
+}

pkg/licenseclient/client_test.go

@@ -0,0 +1,81 @@
+package licenseclient
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/b1tsblog/ai-disclosure-standard/pkg/licensekit"
+)
+
+func keys(t *testing.T) (ed25519.PublicKey, ed25519.PrivateKey) {
+	t.Helper()
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return pub, priv
+}
+
+func licenseToken(t *testing.T, mode licensekit.VerificationMode, store *licensekit.TrustStore) (string, licensekit.Claims) {
+	t.Helper()
+	pub, priv := keys(t)
+	store.LicenseKeys["issuer"] = licensekit.EncodeKey(pub)
+	now := time.Now().UTC()
+	claims := licensekit.Claims{Version: 1, LicenseID: "lic_1", Issuer: "vendor", Customer: "customer", Product: "product", Edition: "pro", Features: []string{"feature_a", "feature_b"}, Domains: []string{"*"}, IssuedAt: now.Unix(), ExpiresAt: now.Add(time.Hour).Unix(), Verification: licensekit.VerificationPolicy{Mode: mode, LeaseTTLSeconds: 600, OfflineGraceSeconds: 3600}}
+	token, err := licensekit.SignLicense(priv, "issuer", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return token, claims
+}
+
+func TestOfflineClient(t *testing.T) {
+	store := licensekit.NewTrustStore()
+	token, _ := licenseToken(t, licensekit.ModeOffline, &store)
+	c := New(context.Background(), Config{Product: "product", Token: token, TrustStore: store, BaseURL: "https://example.org"})
+	if !c.Status().Licensed || !c.Has("feature_a") {
+		t.Fatalf("unexpected status %#v", c.Status())
+	}
+}
+
+func TestHybridClientUsesOnlineLeaseAndCache(t *testing.T) {
+	store := licensekit.NewTrustStore()
+	token, claims := licenseToken(t, licensekit.ModeHybrid, &store)
+	leasePub, leasePriv := keys(t)
+	store.LeaseKeys["lease"] = licensekit.EncodeKey(leasePub)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		now := time.Now().UTC()
+		lease := licensekit.LeaseClaims{Version: 1, LeaseID: "lease_1", LicenseID: claims.LicenseID, Product: claims.Product, Customer: claims.Customer, Edition: claims.Edition, Features: claims.Features, Host: "example.org", IssuedAt: now.Unix(), ExpiresAt: now.Add(5 * time.Minute).Unix()}
+		leaseToken, err := licensekit.SignLease(leasePriv, "lease", lease)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"valid": true, "leaseToken": leaseToken})
+	}))
+	cache := filepath.Join(t.TempDir(), "lease.json")
+	c := New(context.Background(), Config{Product: "product", Token: token, TrustStore: store, BaseURL: "https://example.org", Mode: licensekit.ModeHybrid, ServerURL: server.URL, CacheFile: cache})
+	if !c.Status().Licensed || c.Status().Source != "online" {
+		t.Fatalf("unexpected online status %#v", c.Status())
+	}
+	server.Close()
+	c.Refresh(context.Background())
+	if !c.Status().Licensed || c.Status().Source != "cached-lease" {
+		t.Fatalf("unexpected cached status %#v", c.Status())
+	}
+}
+
+func TestOnlineModeFailsWithoutServer(t *testing.T) {
+	store := licensekit.NewTrustStore()
+	token, _ := licenseToken(t, licensekit.ModeOnline, &store)
+	c := New(context.Background(), Config{Product: "product", Token: token, TrustStore: store, BaseURL: "https://example.org", Mode: licensekit.ModeOnline})
+	if c.Status().Licensed {
+		t.Fatalf("online license unexpectedly active %#v", c.Status())
+	}
+}

pkg/licenseclient/doc.go

@@ -0,0 +1,4 @@
+// Package licenseclient implements the runtime side of product licensing. It
+// supports offline verification, hybrid signed-lease caching and mandatory
+// online introspection without allowing customers to replace trusted keys.
+package licenseclient

pkg/licensekit/doc.go

@@ -0,0 +1,3 @@
+// Package licensekit implements product-neutral Ed25519 licence and lease
+// tokens, embedded trust stores, context validation and key rotation by key ID.
+package licensekit

pkg/licensekit/licensekit.go

@@ -0,0 +1,472 @@
+package licensekit
+
+import (
+	"crypto/ed25519"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+)
+
+const (
+	TokenTypeLicense = "LICENSE"
+	TokenTypeLease   = "LEASE"
+	AlgorithmEdDSA   = "EdDSA"
+	SchemaVersion    = 1
+)
+
+type VerificationMode string
+
+const (
+	ModeOffline VerificationMode = "offline"
+	ModeHybrid  VerificationMode = "hybrid"
+	ModeOnline  VerificationMode = "online"
+)
+
+type Header struct {
+	Algorithm string `json:"alg"`
+	Type      string `json:"typ"`
+	KeyID     string `json:"kid"`
+	Version   int    `json:"v"`
+}
+
+type VerificationPolicy struct {
+	Mode                VerificationMode `json:"mode"`
+	LeaseTTLSeconds     int64            `json:"leaseTtlSeconds,omitempty"`
+	OfflineGraceSeconds int64            `json:"offlineGraceSeconds,omitempty"`
+}
+
+type Claims struct {
+	Version      int                `json:"version"`
+	LicenseID    string             `json:"licenseId"`
+	Issuer       string             `json:"issuer"`
+	Customer     string             `json:"customer"`
+	Product      string             `json:"product"`
+	Edition      string             `json:"edition"`
+	Features     []string           `json:"features,omitempty"`
+	Limits       map[string]int64   `json:"limits,omitempty"`
+	Domains      []string           `json:"domains,omitempty"`
+	InstanceIDs  []string           `json:"instanceIds,omitempty"`
+	IssuedAt     int64              `json:"issuedAt"`
+	NotBefore    int64              `json:"notBefore,omitempty"`
+	ExpiresAt    int64              `json:"expiresAt"`
+	Verification VerificationPolicy `json:"verification"`
+	Metadata     map[string]string  `json:"metadata,omitempty"`
+}
+
+type LeaseClaims struct {
+	Version    int      `json:"version"`
+	LeaseID    string   `json:"leaseId"`
+	LicenseID  string   `json:"licenseId"`
+	Product    string   `json:"product"`
+	Customer   string   `json:"customer"`
+	Edition    string   `json:"edition"`
+	Features   []string `json:"features,omitempty"`
+	Host       string   `json:"host,omitempty"`
+	InstanceID string   `json:"instanceId,omitempty"`
+	IssuedAt   int64    `json:"issuedAt"`
+	ExpiresAt  int64    `json:"expiresAt"`
+}
+
+type TrustStore struct {
+	LicenseKeys map[string]string `json:"licenseKeys"`
+	LeaseKeys   map[string]string `json:"leaseKeys"`
+}
+
+type VerifiedLicense struct {
+	Header Header
+	Claims Claims
+}
+
+type VerifiedLease struct {
+	Header Header
+	Claims LeaseClaims
+}
+
+func NewTrustStore() TrustStore {
+	return TrustStore{LicenseKeys: map[string]string{}, LeaseKeys: map[string]string{}}
+}
+
+func ParseTrustStore(data []byte) (TrustStore, error) {
+	var store TrustStore
+	dec := json.NewDecoder(strings.NewReader(string(data)))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&store); err != nil {
+		return TrustStore{}, fmt.Errorf("decode trust store: %w", err)
+	}
+	if store.LicenseKeys == nil {
+		store.LicenseKeys = map[string]string{}
+	}
+	if store.LeaseKeys == nil {
+		store.LeaseKeys = map[string]string{}
+	}
+	for kid, encoded := range store.LicenseKeys {
+		if strings.TrimSpace(kid) == "" {
+			return TrustStore{}, errors.New("license trust store contains an empty key id")
+		}
+		if _, err := DecodePublicKey(encoded); err != nil {
+			return TrustStore{}, fmt.Errorf("license key %q: %w", kid, err)
+		}
+	}
+	for kid, encoded := range store.LeaseKeys {
+		if strings.TrimSpace(kid) == "" {
+			return TrustStore{}, errors.New("lease trust store contains an empty key id")
+		}
+		if _, err := DecodePublicKey(encoded); err != nil {
+			return TrustStore{}, fmt.Errorf("lease key %q: %w", kid, err)
+		}
+	}
+	return store, nil
+}
+
+func MarshalTrustStore(store TrustStore) ([]byte, error) {
+	if store.LicenseKeys == nil {
+		store.LicenseKeys = map[string]string{}
+	}
+	if store.LeaseKeys == nil {
+		store.LeaseKeys = map[string]string{}
+	}
+	return json.MarshalIndent(store, "", "  ")
+}
+
+func SignLicense(privateKey ed25519.PrivateKey, keyID string, claims Claims) (string, error) {
+	if err := validateLicenseClaims(claims, time.Unix(claims.IssuedAt, 0), false); err != nil {
+		return "", err
+	}
+	return sign(TokenTypeLicense, keyID, privateKey, claims)
+}
+
+func SignLease(privateKey ed25519.PrivateKey, keyID string, claims LeaseClaims) (string, error) {
+	if err := validateLeaseClaims(claims, time.Unix(claims.IssuedAt, 0), false); err != nil {
+		return "", err
+	}
+	return sign(TokenTypeLease, keyID, privateKey, claims)
+}
+
+func sign(tokenType, keyID string, privateKey ed25519.PrivateKey, claims any) (string, error) {
+	if len(privateKey) != ed25519.PrivateKeySize {
+		return "", errors.New("invalid Ed25519 private key")
+	}
+	keyID = strings.TrimSpace(keyID)
+	if keyID == "" {
+		return "", errors.New("key id is required")
+	}
+	header := Header{Algorithm: AlgorithmEdDSA, Type: tokenType, KeyID: keyID, Version: SchemaVersion}
+	headerJSON, err := json.Marshal(header)
+	if err != nil {
+		return "", fmt.Errorf("marshal token header: %w", err)
+	}
+	payloadJSON, err := json.Marshal(claims)
+	if err != nil {
+		return "", fmt.Errorf("marshal token payload: %w", err)
+	}
+	headerPart := base64.RawURLEncoding.EncodeToString(headerJSON)
+	payloadPart := base64.RawURLEncoding.EncodeToString(payloadJSON)
+	signingInput := headerPart + "." + payloadPart
+	signature := ed25519.Sign(privateKey, []byte(signingInput))
+	return signingInput + "." + base64.RawURLEncoding.EncodeToString(signature), nil
+}
+
+func VerifyLicense(store TrustStore, token string, now time.Time) (VerifiedLicense, error) {
+	header, payload, err := verifyToken(store.LicenseKeys, TokenTypeLicense, token)
+	if err != nil {
+		return VerifiedLicense{}, err
+	}
+	var claims Claims
+	if err := decodeStrict(payload, &claims); err != nil {
+		return VerifiedLicense{}, fmt.Errorf("decode license payload: %w", err)
+	}
+	if err := validateLicenseClaims(claims, now, true); err != nil {
+		return VerifiedLicense{}, err
+	}
+	claims.Features = UniqueSorted(claims.Features)
+	claims.Domains = UniqueSorted(claims.Domains)
+	claims.InstanceIDs = UniqueSorted(claims.InstanceIDs)
+	return VerifiedLicense{Header: header, Claims: claims}, nil
+}
+
+func VerifyLease(store TrustStore, token string, now time.Time, allowGrace time.Duration) (VerifiedLease, error) {
+	header, payload, err := verifyToken(store.LeaseKeys, TokenTypeLease, token)
+	if err != nil {
+		return VerifiedLease{}, err
+	}
+	var claims LeaseClaims
+	if err := decodeStrict(payload, &claims); err != nil {
+		return VerifiedLease{}, fmt.Errorf("decode lease payload: %w", err)
+	}
+	if err := validateLeaseClaims(claims, now, false); err != nil {
+		return VerifiedLease{}, err
+	}
+	if now.Unix() >= claims.ExpiresAt+int64(allowGrace.Seconds()) {
+		return VerifiedLease{}, errors.New("lease has expired")
+	}
+	claims.Features = UniqueSorted(claims.Features)
+	return VerifiedLease{Header: header, Claims: claims}, nil
+}
+
+func verifyToken(keys map[string]string, expectedType, token string) (Header, []byte, error) {
+	parts := strings.Split(strings.TrimSpace(token), ".")
+	if len(parts) != 3 {
+		return Header{}, nil, errors.New("token has invalid format")
+	}
+	headerBytes, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return Header{}, nil, errors.New("token header is not valid base64url")
+	}
+	var header Header
+	if err := decodeStrict(headerBytes, &header); err != nil {
+		return Header{}, nil, fmt.Errorf("decode token header: %w", err)
+	}
+	if header.Algorithm != AlgorithmEdDSA || header.Type != expectedType || header.Version != SchemaVersion {
+		return Header{}, nil, errors.New("unsupported token header")
+	}
+	encodedKey, ok := keys[header.KeyID]
+	if !ok {
+		return Header{}, nil, fmt.Errorf("token is signed by unknown key %q", header.KeyID)
+	}
+	publicKey, err := DecodePublicKey(encodedKey)
+	if err != nil {
+		return Header{}, nil, fmt.Errorf("decode trusted key %q: %w", header.KeyID, err)
+	}
+	signature, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return Header{}, nil, errors.New("token signature is not valid base64url")
+	}
+	signingInput := parts[0] + "." + parts[1]
+	if !ed25519.Verify(publicKey, []byte(signingInput), signature) {
+		return Header{}, nil, errors.New("token signature verification failed")
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return Header{}, nil, errors.New("token payload is not valid base64url")
+	}
+	return header, payload, nil
+}
+
+func ValidateLicenseContext(claims Claims, product, baseURL, instanceID string) error {
+	if strings.TrimSpace(product) == "" {
+		return errors.New("client product id is required")
+	}
+	if claims.Product != product {
+		return fmt.Errorf("license is for product %q, not %q", claims.Product, product)
+	}
+	if err := ValidateDomain(claims.Domains, baseURL); err != nil {
+		return err
+	}
+	if len(claims.InstanceIDs) > 0 {
+		instanceID = strings.TrimSpace(instanceID)
+		if instanceID == "" {
+			return errors.New("license requires an instance id")
+		}
+		allowed := false
+		for _, candidate := range claims.InstanceIDs {
+			if candidate == "*" || candidate == instanceID {
+				allowed = true
+				break
+			}
+		}
+		if !allowed {
+			return fmt.Errorf("instance %q is not covered by the license", instanceID)
+		}
+	}
+	return nil
+}
+
+func ValidateLeaseContext(claims LeaseClaims, license Claims, product, baseURL, instanceID string) error {
+	if claims.LicenseID != license.LicenseID {
+		return errors.New("lease does not belong to the configured license")
+	}
+	if claims.Product != product || claims.Product != license.Product {
+		return errors.New("lease product does not match")
+	}
+	host, err := HostFromBaseURL(baseURL)
+	if err != nil {
+		return err
+	}
+	if claims.Host != "" && !strings.EqualFold(claims.Host, host) {
+		return errors.New("lease host does not match")
+	}
+	if claims.InstanceID != "" && claims.InstanceID != instanceID {
+		return errors.New("lease instance does not match")
+	}
+	return nil
+}
+
+func ValidateDomain(domains []string, baseURL string) error {
+	if len(domains) == 0 {
+		return nil
+	}
+	host, err := HostFromBaseURL(baseURL)
+	if err != nil {
+		return err
+	}
+	for _, allowed := range domains {
+		allowed = strings.ToLower(strings.TrimSpace(allowed))
+		if allowed == "*" || host == allowed {
+			return nil
+		}
+		if strings.HasPrefix(allowed, "*.") {
+			root := strings.TrimPrefix(allowed, "*.")
+			if host != root && strings.HasSuffix(host, "."+root) {
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("host %q is not covered by the license", host)
+}
+
+func HostFromBaseURL(baseURL string) (string, error) {
+	u, err := url.Parse(strings.TrimSpace(baseURL))
+	if err != nil || u.Hostname() == "" {
+		return "", errors.New("base URL has no valid host")
+	}
+	return strings.ToLower(u.Hostname()), nil
+}
+
+func StricterMode(a, b VerificationMode) VerificationMode {
+	rank := map[VerificationMode]int{ModeOffline: 0, ModeHybrid: 1, ModeOnline: 2}
+	if rank[b] > rank[a] {
+		return b
+	}
+	if _, ok := rank[a]; !ok {
+		return ModeOffline
+	}
+	return a
+}
+
+func ParseMode(value string) (VerificationMode, error) {
+	mode := VerificationMode(strings.ToLower(strings.TrimSpace(value)))
+	switch mode {
+	case "", ModeOffline:
+		return ModeOffline, nil
+	case ModeHybrid, ModeOnline:
+		return mode, nil
+	default:
+		return "", fmt.Errorf("unknown verification mode %q", value)
+	}
+}
+
+func TokenHash(token string) string {
+	sum := sha256.Sum256([]byte(strings.TrimSpace(token)))
+	return hex.EncodeToString(sum[:])
+}
+
+func DecodePrivateKey(encoded string) (ed25519.PrivateKey, error) {
+	b, err := decodeKey(encoded)
+	if err != nil {
+		return nil, err
+	}
+	if len(b) == ed25519.SeedSize {
+		return ed25519.NewKeyFromSeed(b), nil
+	}
+	if len(b) != ed25519.PrivateKeySize {
+		return nil, errors.New("private key must contain an Ed25519 seed or private key")
+	}
+	return ed25519.PrivateKey(b), nil
+}
+
+func DecodePublicKey(encoded string) (ed25519.PublicKey, error) {
+	b, err := decodeKey(encoded)
+	if err != nil {
+		return nil, err
+	}
+	if len(b) != ed25519.PublicKeySize {
+		return nil, errors.New("public key must contain an Ed25519 public key")
+	}
+	return ed25519.PublicKey(b), nil
+}
+
+func EncodeKey(key []byte) string { return base64.RawURLEncoding.EncodeToString(key) }
+
+func decodeKey(value string) ([]byte, error) {
+	value = strings.TrimSpace(value)
+	if b, err := base64.RawURLEncoding.DecodeString(value); err == nil {
+		return b, nil
+	}
+	if b, err := base64.StdEncoding.DecodeString(value); err == nil {
+		return b, nil
+	}
+	return nil, errors.New("key is not valid base64")
+}
+
+func UniqueSorted(values []string) []string {
+	seen := map[string]bool{}
+	out := make([]string, 0, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" && !seen[value] {
+			seen[value] = true
+			out = append(out, value)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+func validateLicenseClaims(c Claims, now time.Time, checkTime bool) error {
+	if c.Version != SchemaVersion {
+		return errors.New("unsupported license version")
+	}
+	if strings.TrimSpace(c.LicenseID) == "" || strings.TrimSpace(c.Issuer) == "" {
+		return errors.New("license id and issuer are required")
+	}
+	if strings.TrimSpace(c.Customer) == "" || strings.TrimSpace(c.Product) == "" || strings.TrimSpace(c.Edition) == "" {
+		return errors.New("customer, product and edition are required")
+	}
+	if c.IssuedAt <= 0 || c.ExpiresAt <= c.IssuedAt {
+		return errors.New("license timestamps are invalid")
+	}
+	notBefore := c.NotBefore
+	if notBefore == 0 {
+		notBefore = c.IssuedAt
+	}
+	if checkTime {
+		if now.Unix() < notBefore-300 {
+			return errors.New("license is not active yet")
+		}
+		if now.Unix() >= c.ExpiresAt {
+			return errors.New("license has expired")
+		}
+	}
+	if _, err := ParseMode(string(c.Verification.Mode)); err != nil {
+		return err
+	}
+	if c.Verification.LeaseTTLSeconds < 0 || c.Verification.OfflineGraceSeconds < 0 {
+		return errors.New("verification durations cannot be negative")
+	}
+	return nil
+}
+
+func validateLeaseClaims(c LeaseClaims, now time.Time, checkExpiration bool) error {
+	if c.Version != SchemaVersion {
+		return errors.New("unsupported lease version")
+	}
+	if strings.TrimSpace(c.LeaseID) == "" || strings.TrimSpace(c.LicenseID) == "" || strings.TrimSpace(c.Product) == "" {
+		return errors.New("lease id, license id and product are required")
+	}
+	if c.IssuedAt <= 0 || c.ExpiresAt <= c.IssuedAt {
+		return errors.New("lease timestamps are invalid")
+	}
+	if now.Unix() < c.IssuedAt-300 {
+		return errors.New("lease is not active yet")
+	}
+	if checkExpiration && now.Unix() >= c.ExpiresAt {
+		return errors.New("lease has expired")
+	}
+	return nil
+}
+
+func decodeStrict(data []byte, target any) error {
+	dec := json.NewDecoder(strings.NewReader(string(data)))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(target); err != nil {
+		return err
+	}
+	return nil
+}

pkg/licensekit/licensekit_test.go

@@ -0,0 +1,84 @@
+package licensekit
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"testing"
+	"time"
+)
+
+func testKeys(t *testing.T) (ed25519.PublicKey, ed25519.PrivateKey) {
+	t.Helper()
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return pub, priv
+}
+
+func TestLicenseRoundTripAndContext(t *testing.T) {
+	pub, priv := testKeys(t)
+	now := time.Now().UTC()
+	claims := Claims{Version: 1, LicenseID: "lic_test", Issuer: "vendor", Customer: "customer", Product: "product-a", Edition: "pro", Features: []string{"b", "a"}, Domains: []string{"*.example.org"}, IssuedAt: now.Unix(), ExpiresAt: now.Add(time.Hour).Unix(), Verification: VerificationPolicy{Mode: ModeOffline}}
+	token, err := SignLicense(priv, "issuer-1", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	store := NewTrustStore()
+	store.LicenseKeys["issuer-1"] = EncodeKey(pub)
+	verified, err := VerifyLicense(store, token, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if verified.Claims.Features[0] != "a" {
+		t.Fatalf("features not sorted: %#v", verified.Claims.Features)
+	}
+	if err := ValidateLicenseContext(verified.Claims, "product-a", "https://app.example.org", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateLicenseContext(verified.Claims, "product-b", "https://app.example.org", ""); err == nil {
+		t.Fatal("expected product mismatch")
+	}
+}
+
+func TestGlobalWildcardAllowsAllHosts(t *testing.T) {
+	if err := ValidateDomain([]string{"*"}, "http://localhost:8080"); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateDomain([]string{"*"}, "https://anything.invalid"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestUnknownKeyIsRejected(t *testing.T) {
+	_, priv := testKeys(t)
+	now := time.Now().UTC()
+	claims := Claims{Version: 1, LicenseID: "lic_test", Issuer: "vendor", Customer: "customer", Product: "product", Edition: "pro", IssuedAt: now.Unix(), ExpiresAt: now.Add(time.Hour).Unix(), Verification: VerificationPolicy{Mode: ModeOffline}}
+	token, err := SignLicense(priv, "self-chosen", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := VerifyLicense(NewTrustStore(), token, now); err == nil {
+		t.Fatal("untrusted user key must not be accepted")
+	}
+}
+
+func TestLeaseRoundTrip(t *testing.T) {
+	pub, priv := testKeys(t)
+	now := time.Now().UTC()
+	claims := LeaseClaims{Version: 1, LeaseID: "lease_1", LicenseID: "lic_1", Product: "product", Customer: "customer", Edition: "pro", Features: []string{"x"}, Host: "example.org", IssuedAt: now.Unix(), ExpiresAt: now.Add(time.Hour).Unix()}
+	token, err := SignLease(priv, "lease-1", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	store := NewTrustStore()
+	store.LeaseKeys["lease-1"] = EncodeKey(pub)
+	verified, err := VerifyLease(store, token, now, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	license := Claims{LicenseID: "lic_1", Product: "product"}
+	if err := ValidateLeaseContext(verified.Claims, license, "product", "https://example.org", ""); err != nil {
+		t.Fatal(err)
+	}
+}

pkg/licenseserver/doc.go

@@ -0,0 +1,4 @@
+// Package licenseserver implements the optional central introspection,
+// registration, revocation and signed short-lived lease service. Its Registry
+// interface can be backed by a transactional shared database for HA use.
+package licenseserver

pkg/licenseserver/server.go

@@ -0,0 +1,271 @@
+package licenseserver
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/b1tsblog/ai-disclosure-standard/pkg/licensekit"
+)
+
+type Config struct {
+	TrustStore      licensekit.TrustStore
+	LeasePrivateKey ed25519.PrivateKey
+	LeaseKeyID      string
+	AdminToken      string
+	DefaultLeaseTTL time.Duration
+	MaxLeaseTTL     time.Duration
+}
+
+type Registry interface {
+	Get(id string) (Record, bool)
+	List() []Record
+	Put(record Record) error
+	SetRevoked(id string, revoked bool, reason string) error
+}
+
+type Server struct {
+	cfg    Config
+	store  Registry
+	logger *slog.Logger
+	mux    *http.ServeMux
+}
+
+type introspectRequest struct {
+	Token         string `json:"token"`
+	Product       string `json:"product"`
+	BaseURL       string `json:"baseUrl"`
+	Host          string `json:"host"`
+	InstanceID    string `json:"instanceId,omitempty"`
+	ClientVersion string `json:"clientVersion,omitempty"`
+}
+
+type introspectResponse struct {
+	Valid      bool   `json:"valid"`
+	LeaseToken string `json:"leaseToken,omitempty"`
+	ExpiresAt  string `json:"expiresAt,omitempty"`
+	Reason     string `json:"reason,omitempty"`
+}
+
+type registerRequest struct {
+	Token string `json:"token"`
+}
+
+type revokeRequest struct {
+	Reason string `json:"reason"`
+}
+
+func New(cfg Config, store Registry, logger *slog.Logger) (*Server, error) {
+	if store == nil {
+		return nil, errors.New("license registry is required")
+	}
+	if len(cfg.LeasePrivateKey) != ed25519.PrivateKeySize {
+		return nil, errors.New("a valid Ed25519 lease signing private key is required")
+	}
+	if strings.TrimSpace(cfg.LeaseKeyID) == "" {
+		return nil, errors.New("lease key id is required")
+	}
+	if _, ok := cfg.TrustStore.LeaseKeys[cfg.LeaseKeyID]; !ok {
+		return nil, fmt.Errorf("lease public key %q is not present in the trust store", cfg.LeaseKeyID)
+	}
+	if cfg.DefaultLeaseTTL <= 0 {
+		cfg.DefaultLeaseTTL = time.Hour
+	}
+	if cfg.MaxLeaseTTL <= 0 {
+		cfg.MaxLeaseTTL = 24 * time.Hour
+	}
+	if logger == nil {
+		logger = slog.Default()
+	}
+	s := &Server{cfg: cfg, store: store, logger: logger, mux: http.NewServeMux()}
+	s.routes()
+	return s, nil
+}
+
+func (s *Server) Handler() http.Handler { return s.securityHeaders(s.mux) }
+
+func (s *Server) routes() {
+	s.mux.HandleFunc("GET /healthz", s.health)
+	s.mux.HandleFunc("POST /v1/introspect", s.introspect)
+	s.mux.HandleFunc("GET /v1/admin/licenses", s.admin(s.list))
+	s.mux.HandleFunc("POST /v1/admin/licenses", s.admin(s.register))
+	s.mux.HandleFunc("POST /v1/admin/licenses/{id}/revoke", s.admin(s.revoke))
+	s.mux.HandleFunc("POST /v1/admin/licenses/{id}/restore", s.admin(s.restore))
+}
+
+func (s *Server) health(w http.ResponseWriter, _ *http.Request) {
+	s.writeJSON(w, http.StatusOK, map[string]any{"status": "ok"})
+}
+
+func (s *Server) introspect(w http.ResponseWriter, r *http.Request) {
+	var request introspectRequest
+	if err := decodeBody(r, &request); err != nil {
+		s.writeJSON(w, http.StatusBadRequest, introspectResponse{Reason: err.Error()})
+		return
+	}
+	now := time.Now().UTC()
+	verified, err := licensekit.VerifyLicense(s.cfg.TrustStore, request.Token, now)
+	if err != nil {
+		s.writeJSON(w, http.StatusForbidden, introspectResponse{Reason: err.Error()})
+		return
+	}
+	claims := verified.Claims
+	if err := licensekit.ValidateLicenseContext(claims, request.Product, request.BaseURL, request.InstanceID); err != nil {
+		s.writeJSON(w, http.StatusForbidden, introspectResponse{Reason: err.Error()})
+		return
+	}
+	record, ok := s.store.Get(claims.LicenseID)
+	if !ok {
+		s.writeJSON(w, http.StatusForbidden, introspectResponse{Reason: "license is not registered"})
+		return
+	}
+	if record.TokenHash != licensekit.TokenHash(request.Token) {
+		s.writeJSON(w, http.StatusForbidden, introspectResponse{Reason: "registered token does not match"})
+		return
+	}
+	if record.Revoked {
+		reason := "license is revoked"
+		if record.Reason != "" {
+			reason += ": " + record.Reason
+		}
+		s.writeJSON(w, http.StatusForbidden, introspectResponse{Reason: reason})
+		return
+	}
+	ttl := s.cfg.DefaultLeaseTTL
+	if claims.Verification.LeaseTTLSeconds > 0 {
+		ttl = time.Duration(claims.Verification.LeaseTTLSeconds) * time.Second
+	}
+	if ttl > s.cfg.MaxLeaseTTL {
+		ttl = s.cfg.MaxLeaseTTL
+	}
+	if remaining := time.Until(time.Unix(claims.ExpiresAt, 0)); ttl > remaining {
+		ttl = remaining
+	}
+	if ttl <= 0 {
+		s.writeJSON(w, http.StatusForbidden, introspectResponse{Reason: "license has expired"})
+		return
+	}
+	host, _ := licensekit.HostFromBaseURL(request.BaseURL)
+	leaseID := randomID("lease")
+	leaseClaims := licensekit.LeaseClaims{
+		Version: 1, LeaseID: leaseID, LicenseID: claims.LicenseID, Product: claims.Product,
+		Customer: claims.Customer, Edition: claims.Edition, Features: claims.Features,
+		Host: host, InstanceID: request.InstanceID, IssuedAt: now.Unix(), ExpiresAt: now.Add(ttl).Unix(),
+	}
+	token, err := licensekit.SignLease(s.cfg.LeasePrivateKey, s.cfg.LeaseKeyID, leaseClaims)
+	if err != nil {
+		s.logger.Error("lease signing failed", "error", err, "license_id", claims.LicenseID)
+		s.writeJSON(w, http.StatusInternalServerError, introspectResponse{Reason: "lease signing failed"})
+		return
+	}
+	s.writeJSON(w, http.StatusOK, introspectResponse{Valid: true, LeaseToken: token, ExpiresAt: time.Unix(leaseClaims.ExpiresAt, 0).UTC().Format(time.RFC3339)})
+}
+
+func (s *Server) list(w http.ResponseWriter, _ *http.Request) {
+	s.writeJSON(w, http.StatusOK, map[string]any{"licenses": s.store.List()})
+}
+
+func (s *Server) register(w http.ResponseWriter, r *http.Request) {
+	var request registerRequest
+	if err := decodeBody(r, &request); err != nil {
+		s.writeJSON(w, http.StatusBadRequest, map[string]any{"error": err.Error()})
+		return
+	}
+	verified, err := licensekit.VerifyLicense(s.cfg.TrustStore, request.Token, time.Now().UTC())
+	if err != nil {
+		s.writeJSON(w, http.StatusBadRequest, map[string]any{"error": err.Error()})
+		return
+	}
+	claims := verified.Claims
+	record := Record{LicenseID: claims.LicenseID, TokenHash: licensekit.TokenHash(request.Token), Product: claims.Product, Customer: claims.Customer, Edition: claims.Edition, ExpiresAt: claims.ExpiresAt}
+	if err := s.store.Put(record); err != nil {
+		s.writeJSON(w, http.StatusInternalServerError, map[string]any{"error": err.Error()})
+		return
+	}
+	s.writeJSON(w, http.StatusCreated, record)
+}
+
+func (s *Server) revoke(w http.ResponseWriter, r *http.Request) {
+	var request revokeRequest
+	_ = decodeBodyAllowEmpty(r, &request)
+	if err := s.store.SetRevoked(r.PathValue("id"), true, strings.TrimSpace(request.Reason)); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			s.writeJSON(w, http.StatusNotFound, map[string]any{"error": "license not found"})
+			return
+		}
+		s.writeJSON(w, http.StatusNotFound, map[string]any{"error": "license not found"})
+		return
+	}
+	s.writeJSON(w, http.StatusOK, map[string]any{"status": "revoked"})
+}
+
+func (s *Server) restore(w http.ResponseWriter, r *http.Request) {
+	if err := s.store.SetRevoked(r.PathValue("id"), false, ""); err != nil {
+		s.writeJSON(w, http.StatusNotFound, map[string]any{"error": "license not found"})
+		return
+	}
+	s.writeJSON(w, http.StatusOK, map[string]any{"status": "active"})
+}
+
+func (s *Server) admin(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		expected := strings.TrimSpace(s.cfg.AdminToken)
+		actual := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if expected == "" || subtle.ConstantTimeCompare([]byte(expected), []byte(actual)) != 1 {
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			s.writeJSON(w, http.StatusUnauthorized, map[string]any{"error": "unauthorized"})
+			return
+		}
+		next(w, r)
+	}
+}
+
+func (s *Server) securityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Referrer-Policy", "no-referrer")
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (s *Server) writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}
+
+func decodeBody(r *http.Request, target any) error {
+	dec := json.NewDecoder(io.LimitReader(r.Body, 1<<20))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(target); err != nil {
+		return err
+	}
+	return nil
+}
+
+func decodeBodyAllowEmpty(r *http.Request, target any) error {
+	err := decodeBody(r, target)
+	if errors.Is(err, io.EOF) {
+		return nil
+	}
+	return err
+}
+
+func randomID(prefix string) string {
+	var raw [16]byte
+	if _, err := rand.Read(raw[:]); err != nil {
+		return prefix + "_" + fmt.Sprint(time.Now().UnixNano())
+	}
+	return prefix + "_" + hex.EncodeToString(raw[:])
+}

pkg/licenseserver/server_test.go

@@ -0,0 +1,91 @@
+package licenseserver
+
+import (
+	"bytes"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/b1tsblog/ai-disclosure-standard/pkg/licensekit"
+)
+
+func keyPair(t *testing.T) (ed25519.PublicKey, ed25519.PrivateKey) {
+	t.Helper()
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return pub, priv
+}
+
+func TestRegisterIntrospectAndRevoke(t *testing.T) {
+	issuerPub, issuerPriv := keyPair(t)
+	leasePub, leasePriv := keyPair(t)
+	storeKeys := licensekit.NewTrustStore()
+	storeKeys.LicenseKeys["issuer"] = licensekit.EncodeKey(issuerPub)
+	storeKeys.LeaseKeys["lease"] = licensekit.EncodeKey(leasePub)
+	registry, err := OpenStore("")
+	if err != nil {
+		t.Fatal(err)
+	}
+	server, err := New(Config{TrustStore: storeKeys, LeasePrivateKey: leasePriv, LeaseKeyID: "lease", AdminToken: "secret", DefaultLeaseTTL: time.Hour}, registry, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpServer := httptest.NewServer(server.Handler())
+	defer httpServer.Close()
+	now := time.Now().UTC()
+	claims := licensekit.Claims{Version: 1, LicenseID: "lic_1", Issuer: "vendor", Customer: "customer", Product: "product", Edition: "pro", Features: []string{"feature"}, Domains: []string{"*"}, IssuedAt: now.Unix(), ExpiresAt: now.Add(time.Hour).Unix(), Verification: licensekit.VerificationPolicy{Mode: licensekit.ModeHybrid, LeaseTTLSeconds: 300}}
+	token, err := licensekit.SignLicense(issuerPriv, "issuer", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	registerBody, _ := json.Marshal(map[string]string{"token": token})
+	req, _ := http.NewRequest(http.MethodPost, httpServer.URL+"/v1/admin/licenses", bytes.NewReader(registerBody))
+	req.Header.Set("Authorization", "Bearer secret")
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("register status %d", resp.StatusCode)
+	}
+	introBody, _ := json.Marshal(map[string]string{"token": token, "product": "product", "baseUrl": "https://example.org"})
+	resp, err = http.Post(httpServer.URL+"/v1/introspect", "application/json", bytes.NewReader(introBody))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var intro map[string]any
+	_ = json.NewDecoder(resp.Body).Decode(&intro)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK || intro["valid"] != true {
+		t.Fatalf("introspection failed: %d %#v", resp.StatusCode, intro)
+	}
+	req, _ = http.NewRequest(http.MethodPost, httpServer.URL+"/v1/admin/licenses/lic_1/revoke", bytes.NewBufferString(`{"reason":"payment"}`))
+	req.Header.Set("Authorization", "Bearer secret")
+	req.Header.Set("Content-Type", "application/json")
+	resp, err = http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("revoke status %d", resp.StatusCode)
+	}
+	resp, err = http.Post(httpServer.URL+"/v1/introspect", "application/json", bytes.NewReader(introBody))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("expected revoked status, got %d", resp.StatusCode)
+	}
+}

pkg/licenseserver/store.go

@@ -0,0 +1,130 @@
+package licenseserver
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"sort"
+	"sync"
+	"time"
+)
+
+type Record struct {
+	LicenseID string `json:"licenseId"`
+	TokenHash string `json:"tokenHash"`
+	Product   string `json:"product"`
+	Customer  string `json:"customer"`
+	Edition   string `json:"edition"`
+	ExpiresAt int64  `json:"expiresAt"`
+	Revoked   bool   `json:"revoked"`
+	Reason    string `json:"reason,omitempty"`
+	CreatedAt int64  `json:"createdAt"`
+	UpdatedAt int64  `json:"updatedAt"`
+}
+
+type fileDocument struct {
+	Version int      `json:"version"`
+	Records []Record `json:"records"`
+}
+
+type Store struct {
+	mu      sync.RWMutex
+	path    string
+	records map[string]Record
+}
+
+func OpenStore(path string) (*Store, error) {
+	s := &Store{path: path, records: map[string]Record{}}
+	if path == "" {
+		return s, nil
+	}
+	data, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return s, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var doc fileDocument
+	if err := json.Unmarshal(data, &doc); err != nil {
+		return nil, err
+	}
+	if doc.Version != 1 {
+		return nil, errors.New("unsupported license registry version")
+	}
+	for _, record := range doc.Records {
+		s.records[record.LicenseID] = record
+	}
+	return s, nil
+}
+
+func (s *Store) Get(id string) (Record, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	record, ok := s.records[id]
+	return record, ok
+}
+
+func (s *Store) List() []Record {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	out := make([]Record, 0, len(s.records))
+	for _, record := range s.records {
+		out = append(out, record)
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].UpdatedAt > out[j].UpdatedAt })
+	return out
+}
+
+func (s *Store) Put(record Record) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := time.Now().UTC().Unix()
+	if existing, ok := s.records[record.LicenseID]; ok {
+		record.CreatedAt = existing.CreatedAt
+	}
+	if record.CreatedAt == 0 {
+		record.CreatedAt = now
+	}
+	record.UpdatedAt = now
+	s.records[record.LicenseID] = record
+	return s.persistLocked()
+}
+
+func (s *Store) SetRevoked(id string, revoked bool, reason string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	record, ok := s.records[id]
+	if !ok {
+		return os.ErrNotExist
+	}
+	record.Revoked = revoked
+	record.Reason = reason
+	record.UpdatedAt = time.Now().UTC().Unix()
+	s.records[id] = record
+	return s.persistLocked()
+}
+
+func (s *Store) persistLocked() error {
+	if s.path == "" {
+		return nil
+	}
+	if err := os.MkdirAll(filepath.Dir(s.path), 0o700); err != nil && filepath.Dir(s.path) != "." {
+		return err
+	}
+	records := make([]Record, 0, len(s.records))
+	for _, record := range s.records {
+		records = append(records, record)
+	}
+	sort.Slice(records, func(i, j int) bool { return records[i].LicenseID < records[j].LicenseID })
+	data, err := json.MarshalIndent(fileDocument{Version: 1, Records: records}, "", "  ")
+	if err != nil {
+		return err
+	}
+	temp := s.path + ".tmp"
+	if err := os.WriteFile(temp, data, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(temp, s.path)
+}