aiox-core 5.0.4 → 5.0.5

package/packages/installer/src/wizard/pro-setup.js

@@ -74,34 +74,6 @@ class InlineLicenseClient {
       };
 
       const req = https.request(options, (res) => {
-        // Follow 301/302/307/308 redirects (max 3 hops)
-        if ([301, 302, 307, 308].includes(res.statusCode) && res.headers.location) {
-          const redirectUrl = new URL(res.headers.location);
-          const redirectOptions = { ...options, hostname: redirectUrl.hostname, path: redirectUrl.pathname + redirectUrl.search };
-          const redirectReq = https.request(redirectOptions, (rRes) => {
-            let rData = '';
-            rRes.on('data', (chunk) => { rData += chunk; });
-            rRes.on('end', () => {
-              try {
-                const parsed = JSON.parse(rData);
-                if (rRes.statusCode >= 400) {
-                  const err = new Error(parsed.message || `HTTP ${rRes.statusCode}`);
-                  err.code = parsed.code;
-                  reject(err);
-                } else {
-                  resolve(parsed);
-                }
-              } catch {
-                reject(new Error(`Invalid JSON response (HTTP ${rRes.statusCode})`));
-              }
-            });
-          });
-          redirectReq.on('error', (err) => reject(new Error(err.message)));
-          if (body) redirectReq.write(JSON.stringify(body));
-          redirectReq.end();
-          return;
-        }
-
         let data = '';
         res.on('data', (chunk) => { data += chunk; });
         res.on('end', () => {
@@ -359,29 +331,55 @@ function showStep(current, total, label) {
  */
 function loadProModule(moduleName) {
   const path = require('path');
+  const tryRequire = (requestPath) => {
+    try {
+      return require(requestPath);
+    } catch (error) {
+      if (
+        error?.code === 'MODULE_NOT_FOUND'
+        && typeof error.message === 'string'
+        && error.message.includes(requestPath)
+      ) {
+        return null;
+      }
+      throw error;
+    }
+  };
 
   // 1. Framework-dev mode (cloned repo with pro/ submodule)
-  try {
-    return require(`../../../../pro/license/${moduleName}`);
-  } catch { /* not available */ }
+  const frameworkPath = `../../../../pro/license/${moduleName}`;
+  const frameworkModule = tryRequire(frameworkPath);
+  if (frameworkModule) {
+    return frameworkModule;
+  }
 
-  // 2. @aiox-fullstack/pro package (works when aiox-core is a local dependency)
-  try {
-    return require(`@aiox-fullstack/pro/license/${moduleName}`);
-  } catch { /* not available */ }
+  // 2. npm packages — try canonical then fallback
+  const npmScopes = ['@aiox-fullstack/pro', '@aios-fullstack/pro'];
+  for (const scope of npmScopes) {
+    const requestPath = `${scope}/license/${moduleName}`;
+    const loadedModule = tryRequire(requestPath);
+    if (loadedModule) {
+      return loadedModule;
+    }
+  }
 
   // 3. aiox-core in node_modules (brownfield upgrade from >= v4.2.15)
-  try {
-    const absPath = path.join(process.cwd(), 'node_modules', 'aiox-core', 'pro', 'license', moduleName);
-    return require(absPath);
-  } catch { /* not available */ }
+  const aioxCorePath = path.join(process.cwd(), 'node_modules', 'aiox-core', 'pro', 'license', moduleName);
+  const aioxCoreModule = tryRequire(aioxCorePath);
+  if (aioxCoreModule) {
+    return aioxCoreModule;
+  }
 
-  // 4. @aiox-fullstack/pro in user project (npx context — require resolves from
+  // 4. npm package in user project via absolute path (npx context — require resolves from
   //    temp dir, so we need absolute path to where bootstrap installed the package)
-  try {
-    const absPath = path.join(process.cwd(), 'node_modules', '@aiox-fullstack', 'pro', 'license', moduleName);
-    return require(absPath);
-  } catch { /* not available */ }
+  const absScopeDirs = ['@aiox-fullstack', '@aios-fullstack'];
+  for (const scopeDir of absScopeDirs) {
+    const absPath = path.join(process.cwd(), 'node_modules', scopeDir, 'pro', 'license', moduleName);
+    const loadedModule = tryRequire(absPath);
+    if (loadedModule) {
+      return loadedModule;
+    }
+  }
 
   return null;
 }
@@ -406,6 +404,57 @@ function loadFeatureGate() {
   return loadProModule('feature-gate');
 }
 
+/**
+ * Try to load the license cache helpers via lazy import.
+ * Attempts multiple resolution paths for framework-dev, greenfield, and brownfield.
+ *
+ * @returns {{ writeLicenseCache: Function }|null} License cache helpers or null
+ */
+function loadLicenseCache() {
+  return loadProModule('license-cache');
+}
+
+/**
+ * Generate a deterministic machine identifier compatible with the Pro runtime.
+ *
+ * Mirrors pro/license/license-crypto.js so licenses activated during install use
+ * the same seat fingerprint that later validation/deactivation expects.
+ *
+ * @returns {string} SHA-256 machine fingerprint (64 hex chars)
+ */
+function generateMachineId() {
+  const licenseCryptoModule = loadProModule('license-crypto');
+  if (licenseCryptoModule && typeof licenseCryptoModule.generateMachineId === 'function') {
+    return licenseCryptoModule.generateMachineId();
+  }
+
+  const crypto = require('crypto');
+  const os = require('os');
+  const components = [];
+
+  components.push(os.hostname());
+
+  const cpus = os.cpus();
+  if (cpus.length > 0) {
+    components.push(cpus[0].model);
+  }
+
+  const networkInterfaces = os.networkInterfaces();
+  for (const [, interfaces] of Object.entries(networkInterfaces)) {
+    for (const iface of interfaces || []) {
+      if (!iface.internal && iface.mac && iface.mac !== '00:00:00:00:00:00') {
+        components.push(iface.mac);
+        break;
+      }
+    }
+    if (components.length > 2) {
+      break;
+    }
+  }
+
+  return crypto.createHash('sha256').update(components.join('|')).digest('hex');
+}
+
 /**
  * Get a license API client instance.
  *
@@ -415,7 +464,9 @@ function loadFeatureGate() {
  * @returns {Object} Client instance with isOnline, checkEmail, login, signup, activateByAuth
  */
 function getLicenseClient() {
-  const loader = module.exports._testing ? module.exports._testing.loadLicenseApi : loadLicenseApi;
+  const loader = module.exports._testing && module.exports._testing.loadLicenseApi
+    ? module.exports._testing.loadLicenseApi
+    : loadLicenseApi;
   const licenseModule = loader();
 
   if (licenseModule) {
@@ -440,6 +491,98 @@ function loadProScaffolder() {
   }
 }
 
+/**
+ * Persist the activated license locally so post-install Pro commands can recognize it.
+ *
+ * @param {string} targetDir - Project root directory
+ * @param {Object} licenseResult - Successful result from stepLicenseGate()
+ * @returns {{ success: boolean, error?: string }} Cache write result
+ */
+function persistLicenseCache(targetDir, licenseResult) {
+  const loader = module.exports._testing && module.exports._testing.loadLicenseCache
+    ? module.exports._testing.loadLicenseCache
+    : loadLicenseCache;
+  const cacheModule = loader();
+
+  if (!cacheModule || typeof cacheModule.writeLicenseCache !== 'function') {
+    return { success: false, error: 'License cache module not available.' };
+  }
+
+  const activationResult = licenseResult && licenseResult.activationResult ? licenseResult.activationResult : {};
+  const key = activationResult.key || licenseResult.key;
+
+  if (!key || key === 'existing') {
+    return { success: false, error: 'Activated license key not available for local cache persistence.' };
+  }
+
+  return cacheModule.writeLicenseCache({
+    key,
+    activatedAt: activationResult.activatedAt || new Date().toISOString(),
+    expiresAt: activationResult.expiresAt,
+    features: Array.isArray(activationResult.features) ? activationResult.features : [],
+    seats: activationResult.seats || { used: 1, max: 1 },
+    cacheValidDays: activationResult.cacheValidDays,
+    gracePeriodDays: activationResult.gracePeriodDays,
+  }, targetDir);
+}
+
+/**
+ * Ensure auth-based activations are also recognized by the standard key-validation flow.
+ *
+ * Some backends may return a valid license key from auth activation before the legacy
+ * key-validation endpoint recognizes the current machine. In that case, normalize state by
+ * replaying a key activation with the same machine fingerprint.
+ *
+ * @param {Object} client - License client
+ * @param {Object} activationResult - Result returned by activateByAuth()
+ * @param {string} machineId - Machine fingerprint
+ * @param {string} aioxCoreVersion - Current aiox-core version
+ * @returns {Promise<Object>} Activation result safe for cache persistence + `aiox pro validate`
+ */
+async function ensureKeyValidationParity(client, activationResult, machineId, aioxCoreVersion) {
+  if (!activationResult || !activationResult.key || typeof client?.activate !== 'function') {
+    return activationResult;
+  }
+
+  const mergeActivation = (normalized) => ({
+    ...activationResult,
+    key: normalized.key || activationResult.key,
+    features: normalized.features || activationResult.features,
+    seats: normalized.seats || activationResult.seats,
+    expiresAt: normalized.expiresAt || activationResult.expiresAt,
+    cacheValidDays: normalized.cacheValidDays || activationResult.cacheValidDays,
+    gracePeriodDays: normalized.gracePeriodDays || activationResult.gracePeriodDays,
+    activatedAt: normalized.activatedAt || activationResult.activatedAt,
+  });
+
+  if (typeof client.validate === 'function') {
+    try {
+      const validationResult = await client.validate(activationResult.key, machineId);
+      if (validationResult && validationResult.valid !== false) {
+        return mergeActivation(validationResult);
+      }
+    } catch (error) {
+      if (!['MACHINE_NOT_ACTIVATED', 'NOT_ACTIVATED'].includes(error.code)) {
+        throw error;
+      }
+    }
+  }
+
+  try {
+    const normalizedActivation = await client.activate(
+      activationResult.key,
+      machineId,
+      aioxCoreVersion,
+    );
+    return mergeActivation(normalizedActivation);
+  } catch (error) {
+    if (['ALREADY_ACTIVATED', 'MACHINE_ALREADY_ACTIVATED'].includes(error.code)) {
+      return activationResult;
+    }
+    throw error;
+  }
+}
+
 /**
  * Step 1: License Gate — authenticate and validate license.
  *
@@ -585,8 +728,8 @@ async function stepLicenseGateWithEmail() {
   try {
     checkResult = await client.checkEmail(trimmedEmail);
   } catch (checkError) {
-    checkSpinner.fail(tf('proVerificationFailed', { message: checkError.message }));
-    return { success: false, error: checkError.message };
+    checkSpinner.info(t('proBuyerCheckUnavailable'));
+    return fallbackAuthWithoutBuyerCheck(client, trimmedEmail);
   }
 
   // Step 2a: NOT a buyer → stop
@@ -611,6 +754,83 @@ async function stepLicenseGateWithEmail() {
   return createAccountFlow(client, trimmedEmail);
 }
 
+/**
+ * Fallback interactive auth flow when buyer/account pre-check is unavailable.
+ *
+ * Prompts for a password, attempts login first, then falls back to signup if no account exists.
+ * If the account already exists but the first password is wrong, hands control to the normal
+ * login retry flow so the user still gets multiple attempts.
+ *
+ * @param {object} client - LicenseApiClient instance
+ * @param {string} email - User email
+ * @returns {Promise<Object>} Result with { success, key, activationResult }
+ */
+async function fallbackAuthWithoutBuyerCheck(client, email) {
+  const inquirer = require('inquirer');
+
+  const { password } = await inquirer.prompt([
+    {
+      type: 'password',
+      name: 'password',
+      message: colors.primary(t('proPasswordLabel')),
+      mask: '*',
+      validate: (input) => {
+        if (!input || input.length < MIN_PASSWORD_LENGTH) {
+          return tf('proPasswordMin', { min: MIN_PASSWORD_LENGTH });
+        }
+        return true;
+      },
+    },
+  ]);
+
+  const spinner = createSpinner(t('proAuthenticating'));
+  spinner.start();
+
+  let sessionToken;
+  let emailVerified;
+
+  try {
+    const loginResult = await client.login(email, password);
+    sessionToken = loginResult.sessionToken;
+    emailVerified = loginResult.emailVerified;
+    spinner.succeed(t('proAuthSuccess'));
+  } catch (loginError) {
+    if (loginError.code !== 'INVALID_CREDENTIALS') {
+      spinner.fail(tf('proAuthFailed', { message: loginError.message }));
+      return { success: false, error: loginError.message };
+    }
+
+    spinner.info(t('proLoginFailedSignup'));
+    try {
+      await client.signup(email, password);
+      showSuccess(t('proAccountCreatedVerify'));
+
+      const loginAfterSignup = await client.login(email, password);
+      sessionToken = loginAfterSignup.sessionToken;
+      emailVerified = loginAfterSignup.emailVerified;
+    } catch (signupError) {
+      if (signupError.code === 'EMAIL_ALREADY_REGISTERED') {
+        showInfo(t('proAccountExists'));
+        return loginWithRetry(client, email);
+      }
+      return { success: false, error: signupError.message };
+    }
+  }
+
+  if (!sessionToken) {
+    return { success: false, error: t('proAuthFailedShort') };
+  }
+
+  if (!emailVerified) {
+    const verifyResult = await waitForEmailVerification(client, sessionToken, email);
+    if (!verifyResult.success) {
+      return verifyResult;
+    }
+  }
+
+  return activateProByAuth(client, sessionToken);
+}
+
 /**
  * Login flow with password retry (max 3 attempts).
  *
@@ -1012,14 +1232,8 @@ async function activateProByAuth(client, sessionToken) {
   spinner.start();
 
   try {
-    // Generate machine fingerprint
-    const os = require('os');
-    const crypto = require('crypto');
-    const machineId = crypto
-      .createHash('sha256')
-      .update(`${os.hostname()}-${os.platform()}-${os.arch()}`)
-      .digest('hex')
-      .substring(0, 32);
+    // Generate machine fingerprint compatible with the Pro runtime
+    const machineId = generateMachineId();
 
     // Read aiox-core version
     let aioxCoreVersion = 'unknown';
@@ -1033,7 +1247,13 @@ async function activateProByAuth(client, sessionToken) {
       // Keep 'unknown'
     }
 
-    const activationResult = await client.activateByAuth(sessionToken, machineId, aioxCoreVersion);
+    const authActivationResult = await client.activateByAuth(sessionToken, machineId, aioxCoreVersion);
+    const activationResult = await ensureKeyValidationParity(
+      client,
+      authActivationResult,
+      machineId,
+      aioxCoreVersion,
+    );
 
     spinner.succeed(tf('proSubscriptionConfirmed', { key: maskLicenseKey(activationResult.key) }));
     return { success: true, key: activationResult.key, activationResult };
@@ -1154,14 +1374,8 @@ async function validateKeyWithApi(key) {
       };
     }
 
-    // Generate a simple machine fingerprint
-    const os = require('os');
-    const crypto = require('crypto');
-    const machineId = crypto
-      .createHash('sha256')
-      .update(`${os.hostname()}-${os.platform()}-${os.arch()}`)
-      .digest('hex')
-      .substring(0, 32);
+    // Generate machine fingerprint compatible with the Pro runtime
+    const machineId = generateMachineId();
 
     // Read aiox-core version
     let aioxCoreVersion = 'unknown';
@@ -1221,16 +1435,24 @@ async function stepInstallScaffold(targetDir, options = {}) {
 
   // Resolve pro source directory from multiple locations:
   // 1. Bundled in aiox-core package (pro/ submodule — npx and local dev)
-  // 2. @aiox-fullstack/pro in node_modules (legacy brownfield)
+  // 2. npm package — canonical @aiox-fullstack/pro or fallback @aios-fullstack/pro
   const bundledProDir = path.resolve(__dirname, '..', '..', '..', '..', 'pro');
-  const npmProDir = path.join(targetDir, 'node_modules', '@aiox-fullstack', 'pro');
+  const npmProCandidates = [
+    path.join(targetDir, 'node_modules', '@aiox-fullstack', 'pro'),
+    path.join(targetDir, 'node_modules', '@aios-fullstack', 'pro'),
+  ];
 
   let proSourceDir;
   if (fs.existsSync(bundledProDir) && fs.existsSync(path.join(bundledProDir, 'squads'))) {
     proSourceDir = bundledProDir;
-  } else if (fs.existsSync(npmProDir)) {
-    proSourceDir = npmProDir;
   } else {
+    proSourceDir = npmProCandidates.find((candidate) => (
+      fs.existsSync(path.join(candidate, 'package.json'))
+      && fs.existsSync(path.join(candidate, 'squads'))
+    ));
+  }
+
+  if (!proSourceDir) {
     return {
       success: false,
       error: t('proPackageNotFound'),
@@ -1407,6 +1629,13 @@ async function runProWizard(options = {}) {
 
   result.licenseValidated = true;
 
+  const cachePersistResult = persistLicenseCache(targetDir, licenseResult);
+  if (!cachePersistResult.success) {
+    result.error = tf('proLicenseCacheFailed', { message: cachePersistResult.error });
+    showError(result.error);
+    return result;
+  }
+
   // Step 2: Install/Scaffold
   const scaffoldResult = await stepInstallScaffold(targetDir, {
     force: options.force,
@@ -1446,6 +1675,7 @@ module.exports = {
     activateProByAuth,
     loginWithRetry,
     createAccountFlow,
+    fallbackAuthWithoutBuyerCheck,
     stepLicenseGateCI,
     stepLicenseGateWithKey,
     stepLicenseGateWithKeyInteractive,
@@ -1453,9 +1683,13 @@ module.exports = {
     loadProModule,
     loadLicenseApi,
     loadFeatureGate,
+    loadLicenseCache,
     loadProScaffolder,
     getLicenseClient,
     InlineLicenseClient,
+    generateMachineId,
+    persistLicenseCache,
+    ensureKeyValidationParity,
     LICENSE_SERVER_URL,
     MAX_RETRIES,
     LICENSE_KEY_PATTERN,