@moontra/moonui-pro 3.2.1 → 3.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@moontra/moonui-pro",
-    "version": "3.2.1",
+    "version": "3.3.0",
     "description": "Premium React components for MoonUI - Advanced UI library with 50+ pro components including performance, interactive, and gesture components",
     "type": "module",
     "main": "dist/index.mjs",

package/scripts/postinstall.cjs

@@ -50,31 +50,12 @@ function encryptToken(token, key) {
 // Validate license with MoonUI API
 async function validateLicense(licenseKey) {
   return new Promise((resolve, reject) => {
-    // Determine the domain
-    let domain = 'unknown';
-
-    // Check for Vercel deployment
-    if (process.env.VERCEL_URL) {
-      domain = process.env.VERCEL_URL.replace(/^https?:\/\//, '');
-    } else if (process.env.VERCEL_PROJECT_PRODUCTION_URL) {
-      domain = process.env.VERCEL_PROJECT_PRODUCTION_URL.replace(/^https?:\/\//, '');
-    } else if (process.env.NEXT_PUBLIC_VERCEL_URL) {
-      domain = process.env.NEXT_PUBLIC_VERCEL_URL.replace(/^https?:\/\//, '');
-    } else if (process.env.DEPLOY_URL) {
-      domain = process.env.DEPLOY_URL.replace(/^https?:\/\//, '');
-    }
-
-    // For moonui.dev site, use special validation
-    const isMoonUISite = domain.includes('moonui.dev') ||
-                         domain.includes('moonui-git') ||
-                         domain.includes('moonui-') ||
-                         process.env.MOONUI_SITE === 'true';
-
+    // Don't send domain information to prevent bypass attacks
+    // Only validate the license key itself
     const postData = JSON.stringify({
       licenseKey,
-      domain: isMoonUISite ? 'moonui.dev' : domain,
       environment: 'production',
-      isMoonUISite
+      source: 'postinstall'
     });
 
     const options = {
@@ -163,23 +144,8 @@ async function main() {
 
     console.log('[MoonUI Pro] Production environment detected, checking license...');
 
-    // Special case: moonui.dev site itself always has Pro access
-    const vercelUrl = process.env.VERCEL_URL || process.env.VERCEL_PROJECT_PRODUCTION_URL || '';
-    if (vercelUrl.includes('moonui.dev') || vercelUrl.includes('moonui-git') ||
-        process.env.MOONUI_SITE === 'true') {
-      console.log('[MoonUI Pro] MoonUI site detected - granting Pro access');
-      const token = {
-        valid: true,
-        hasProAccess: true,
-        plan: 'lifetime',
-        expiresAt: Date.now() + CACHE_DURATION,
-        domain: 'moonui.dev',
-        timestamp: Date.now()
-      };
-      saveLicenseToken(token);
-      console.log('[MoonUI Pro] ✓ Pro features enabled for moonui.dev');
-      return;
-    }
+    // Remove the bypass - moonui.dev should also use license key like everyone else
+    // This prevents security vulnerability where users can set VERCEL_URL=moonui.dev
 
     // Check for license key in environment variables
     const licenseKey = process.env.MOONUI_LICENSE_KEY ||
@@ -205,7 +171,6 @@ async function main() {
         hasProAccess: validationResult.hasProAccess,
         plan: validationResult.plan,
         expiresAt: Date.now() + CACHE_DURATION,
-        domain: validationResult.domain,
         timestamp: Date.now()
       };