@endo-ui/license 1.0.2 → 1.1.0

package/README.md

@@ -32,6 +32,18 @@ private `@endo-ui/core` package.
 Local activation fails before validation or project mutation when `@endo-ui/license` is not
 already installed in the project. CI uses the generated isolated exact-version bootstrap instead.
 
+## Automatic developer lease refresh
+
+Developer leases are verified locally during `ng serve` and `ng build`. When five days or less
+remain, the licensed builder attempts a five-second online refresh through ECAP. A successful
+response is signature-verified and atomically replaces the existing lease.
+
+Temporary network or ECAP service failures do not stop a build while the existing signed lease is
+valid. Refresh retries use a six-hour backoff and report the remaining authorization period.
+Definitive authorization failures, such as suspension, removed Seat assignment, or missing major
+entitlement, stop the build immediately. CI leases are freshly issued by the generated bootstrap
+script and are not automatically refreshed.
+
 ## CI activation
 
 Commit the generated `scripts/endoui-license-ci.sh` and `scripts/endoui-license-ci.ps1` files.

package/bin/api.js

@@ -1,14 +1,32 @@
 const DEFAULT_SERVICE_URL = "https://license.ecapsoftware.com";
+export class EndoUiApiError extends Error {
+    status;
+    constructor(message, status, options) {
+        super(message, options);
+        this.status = status;
+        this.name = "EndoUiApiError";
+    }
+    get isDefinitiveAuthorizationFailure() {
+        return this.status !== undefined && this.status >= 400 && this.status < 500;
+    }
+}
 async function requestLease(pathname, body) {
     const baseUrl = process.env['ENDOUI_LICENSE_URL'] ?? DEFAULT_SERVICE_URL;
-    const response = await fetch(new URL(pathname, baseUrl), {
-        method: "POST",
-        headers: {
-            Accept: "application/json",
-            "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-    });
+    let response;
+    try {
+        response = await fetch(new URL(pathname, baseUrl), {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(5_000)
+        });
+    }
+    catch (error) {
+        throw new EndoUiApiError("EndoUI licensing service could not be reached.", undefined, { cause: error });
+    }
     let value;
     try {
         value = await response.json();
@@ -18,7 +36,7 @@ async function requestLease(pathname, body) {
     }
     if (!response.ok || typeof value?.lease !== "string") {
         const detail = typeof value?.error === "string" ? ` ${value.error}` : "";
-        throw new Error(`EndoUI activation failed.${detail}`);
+        throw new EndoUiApiError(`EndoUI activation failed.${detail}`, response.status);
     }
     return value.lease;
 }

package/bin/builders/verify-authorization.js

@@ -1,8 +1,11 @@
 import { resolveEndoUiVersion } from "../package-version.js";
 import { verifyLease } from "../lease.js";
 import { readLease } from "../storage.js";
+import { refreshDeveloperLeaseIfNeeded } from "../refresh.js";
 export async function verifyAuthorization(overrides = {}) {
     const version = (overrides.resolveVersion ?? resolveEndoUiVersion)();
     const major = Number(version.split(".", 1)[0]);
-    (overrides.verify ?? verifyLease)(await (overrides.read ?? readLease)(major), version);
+    const signedLease = await (overrides.read ?? readLease)(major);
+    const lease = (overrides.verify ?? verifyLease)(signedLease, version);
+    await (overrides.refresh ?? refreshDeveloperLeaseIfNeeded)(lease, version);
 }

package/bin/refresh.js

@@ -0,0 +1,72 @@
+import { activateDeveloper, EndoUiApiError } from "./api.js";
+import { verifyLease } from "./lease.js";
+import { clearRefreshState, readRefreshState, writeLease, writeRefreshState } from "./storage.js";
+export const LEASE_REFRESH_WINDOW_SECONDS = 5 * 24 * 60 * 60;
+export const LEASE_REFRESH_RETRY_SECONDS = 6 * 60 * 60;
+const defaults = {
+    request: activateDeveloper,
+    verify: verifyLease,
+    writeLease,
+    readState: readRefreshState,
+    writeState: writeRefreshState,
+    clearState: clearRefreshState,
+    warn: message => console.warn(message),
+    info: message => console.info(message),
+    now: () => Math.floor(Date.now() / 1000)
+};
+function remainingMessage(expiration, now) {
+    const seconds = Math.max(0, expiration - now);
+    if (seconds < 24 * 60 * 60)
+        return "Existing authorization remains valid for less than 1 day.";
+    const days = Math.ceil(seconds / (24 * 60 * 60));
+    return `Existing authorization remains valid for ${days} days.`;
+}
+function warnTemporary(expiration, now, warn) {
+    warn("EndoUI license refresh could not be completed.\n" +
+        remainingMessage(expiration, now));
+}
+function assertRefreshMatches(current, refreshed) {
+    if (refreshed.kind !== "developer" ||
+        refreshed.licenseId !== current.licenseId ||
+        refreshed.user !== current.user ||
+        refreshed.majorVersion !== current.majorVersion ||
+        refreshed.exp <= current.exp) {
+        throw new Error("The refreshed EndoUI authorization does not match the existing developer lease.");
+    }
+}
+export async function refreshDeveloperLeaseIfNeeded(lease, version, overrides = {}) {
+    if (lease.kind !== "developer")
+        return lease;
+    if (!lease.user)
+        throw new Error("The developer authorization is missing its named Seat identity.");
+    const dependencies = { ...defaults, ...overrides };
+    const now = dependencies.now();
+    if (lease.exp - now > LEASE_REFRESH_WINDOW_SECONDS)
+        return lease;
+    const state = await dependencies.readState(lease.majorVersion);
+    if (state?.failed &&
+        now - state.lastAttempt >= 0 &&
+        now - state.lastAttempt < LEASE_REFRESH_RETRY_SECONDS) {
+        warnTemporary(lease.exp, now, dependencies.warn);
+        return lease;
+    }
+    let refreshedToken;
+    try {
+        refreshedToken = await dependencies.request(lease.licenseId, lease.user, version);
+    }
+    catch (error) {
+        if (error instanceof EndoUiApiError && error.isDefinitiveAuthorizationFailure) {
+            throw new Error(`EndoUI authorization refresh was rejected. ${error.message}\nBuild stopped.`, { cause: error });
+        }
+        await dependencies.writeState(lease.majorVersion, { lastAttempt: now, failed: true }).catch(() => undefined);
+        warnTemporary(lease.exp, now, dependencies.warn);
+        return lease;
+    }
+    const refreshed = dependencies.verify(refreshedToken, version, now * 1000);
+    assertRefreshMatches(lease, refreshed);
+    await dependencies.writeLease(lease.majorVersion, refreshedToken);
+    await dependencies.clearState(lease.majorVersion).catch(() => undefined);
+    const validityDays = Math.ceil((refreshed.exp - now) / (24 * 60 * 60));
+    dependencies.info(`EndoUI authorization refreshed; valid for ${validityDays} days.`);
+    return refreshed;
+}

package/bin/storage.js

@@ -1,4 +1,5 @@
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 export function leasePath(major, environment = process.env, homeDirectory = os.homedir()) {
@@ -21,7 +22,49 @@ export async function readLease(major) {
 export async function writeLease(major, lease, environment = process.env, homeDirectory = os.homedir()) {
     const file = leasePath(major, environment, homeDirectory);
     await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-    await writeFile(file, `${lease}\n`, { encoding: "utf8", mode: 0o600 });
+    const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, `${lease}\n`, { encoding: "utf8", mode: 0o600 });
+        if (process.platform !== "win32")
+            await chmod(temporary, 0o600);
+        await rename(temporary, file);
+    }
+    catch (error) {
+        await rm(temporary, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
+export function refreshStatePath(major, environment = process.env, homeDirectory = os.homedir()) {
+    return `${leasePath(major, environment, homeDirectory)}.refresh.json`;
+}
+export async function readRefreshState(major, environment = process.env, homeDirectory = os.homedir()) {
+    try {
+        const value = JSON.parse(await readFile(refreshStatePath(major, environment, homeDirectory), "utf8"));
+        return Number.isSafeInteger(value.lastAttempt) && typeof value.failed === "boolean"
+            ? { lastAttempt: value.lastAttempt, failed: value.failed }
+            : undefined;
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            return undefined;
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+export async function writeRefreshState(major, state, environment = process.env, homeDirectory = os.homedir()) {
+    const file = refreshStatePath(major, environment, homeDirectory);
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    await writeFile(file, `${JSON.stringify(state)}\n`, { encoding: "utf8", mode: 0o600 });
     if (process.platform !== "win32")
         await chmod(file, 0o600);
 }
+export async function clearRefreshState(major, environment = process.env, homeDirectory = os.homedir()) {
+    try {
+        await unlink(refreshStatePath(major, environment, homeDirectory));
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@endo-ui/license",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Developer and CI license activation for EndoUI.",
   "license": "SEE LICENSE IN LICENSE.md",
   "publishConfig": {
@@ -10,7 +10,7 @@
   "builders": "./builders.json",
   "schematics": "./collection.json",
   "bin": {
-    "endoui-license": "./bin/cli.js"
+    "endoui-license": "bin/cli.js"
   },
   "files": [
     "bin",