domma-cms 0.109.3 → 0.109.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.109.3",
+  "version": "0.109.4",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/services/pluginEntitlement.js

@@ -117,7 +117,7 @@ export function classifyEntitlement(slug, entitlement = readEntitlement(slug), n
         return {state: 'unlicensed', reason: `entitlement is for "${entitlement.slug}"`, entitlement};
     }
 
-    const pem = trustedKey(entitlement.keyId);
+    const pem = trustedKey(entitlement.keyId, 'entitlement');
     if (!pem) {
         return {state: 'unlicensed', reason: `unknown signing key "${entitlement.keyId}"`, entitlement};
     }

package/server/services/pluginInstaller.js

@@ -42,14 +42,32 @@ const AUDIT_LOG   = path.join(ROOT, 'content', 'instances_log.json');
 // every CMS accepts as ours, permanently. Nothing had ever been signed with it,
 // so there was no artifact to stay compatible with.
 //
-// Private counterpart: generated 2026-09-22, held off-repo. See the marketplace
-// design's Signing keys section for custody.
+// Each key says what it may sign: `bundle` (plugin code - every CMS installs
+// what it signs) and/or `entitlement` (a licence for a plugin a site already
+// has). A key a manager must hold online, to mint licences as it grants them,
+// is trusted for entitlements ONLY: if it leaks, the damage is forged
+// licences, never code every CMS would run.
+//
+// marketplace-1: generated 2026-09-22, held off-repo; signs the catalogue and
+// bundles, and svr-1's licences. See the marketplace design's Signing keys
+// section for custody.
+// svr-2-1: generated 2026-10-01 on svr-2 (aurelius), where it stays; svr-2's
+// licences only.
 // ---------------------------------------------------------------------------
 
 const TRUSTED_KEYS = {
-    'marketplace-1': `-----BEGIN PUBLIC KEY-----
+    'marketplace-1': {
+        uses: ['bundle', 'entitlement'],
+        pem: `-----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEAkgYWv0IckLy2lCeNoaNot++KMJLpJa6FTd6RW0sH2zg=
 -----END PUBLIC KEY-----`
+    },
+    'svr-2-1': {
+        uses: ['entitlement'],
+        pem: `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAqAlx1lfHeCaNiwJmoXZMDY56yafU2GlpNG3VInw9Q14=
+-----END PUBLIC KEY-----`
+    }
 };
 
 /**
@@ -71,16 +89,20 @@ function requireSignedPlugins() {
 }
 
 /**
- * One trusted public key by id, or null.
+ * One trusted public key by id, for one use, or null.
  *
- * Entitlement verification needs the same keys bundle installation does, and a
- * second copy of them would be a second thing to rotate.
+ * Bundles and entitlements share this one list, so there is one place to
+ * rotate - but not every key may sign both. A key not trusted for `use` is
+ * answered exactly like an unknown one. The default is `bundle`, the stricter
+ * of the two, so a caller that forgets to say gets the safe answer.
  *
  * @param   {string} keyId
+ * @param   {'bundle'|'entitlement'} [use]
  * @returns {string|null} PEM
  */
-export function trustedKey(keyId) {
-    return TRUSTED_KEYS[keyId] ?? null;
+export function trustedKey(keyId, use = 'bundle') {
+    const key = Object.hasOwn(TRUSTED_KEYS, keyId) ? TRUSTED_KEYS[keyId] : null;
+    return key && key.uses.includes(use) ? key.pem : null;
 }
 
 /**
@@ -90,10 +112,11 @@ export function trustedKey(keyId) {
  * trusting a key it should not, or having lost the one it should, is the kind of
  * mistake that is invisible until a bundle is refused in the field.
  *
+ * @param   {'bundle'|'entitlement'} [use] - only the keys trusted for this; all when omitted
  * @returns {string[]}
  */
-export function trustedKeyIds() {
-    return Object.keys(TRUSTED_KEYS);
+export function trustedKeyIds(use) {
+    return Object.keys(TRUSTED_KEYS).filter((id) => !use || TRUSTED_KEYS[id].uses.includes(use));
 }
 
 // ---------------------------------------------------------------------------
@@ -333,7 +356,7 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId, all
         }
     }
 
-    const pubKeyPem = unsigned ? null : TRUSTED_KEYS[publicKeyId];
+    const pubKeyPem = unsigned ? null : trustedKey(publicKeyId, 'bundle');
     if (!unsigned && !pubKeyPem) {
         throw new Error(`Unknown public key: ${publicKeyId}`);
     }