filemayor 3.6.0 → 4.0.5

package/core/license.js

@@ -1,339 +1,403 @@
-#!/usr/bin/env node
-
-/**
- * ═══════════════════════════════════════════════════════════════════
- * FILEMAYOR CORE — LICENSE
- * Offline license key validation, tier management, and feature gating.
- * Created by Lehlohonolo Goodwill Nchefu (Chevza)
- * ═══════════════════════════════════════════════════════════════════
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const crypto = require('crypto');
-
-// ─── Constants ────────────────────────────────────────────────────
-
-const LICENSE_FILE = path.join(os.homedir(), '.filemayor-license.json');
-const KEY_PREFIX = 'FM';
-const CHECKSUM_SECRET = process.env.FM_CHECKSUM_SECRET || 'filemayor-chevza-2026';
-
-/**
- * License tiers with capabilities
- */
-const TIERS = {
-    free: {
-        name: 'Free',
-        features: ['scan', 'organize', 'clean', 'undo', 'init', 'info'],
-        limits: { bulkOrganize: 50 },
-    },
-    pro: {
-        name: 'Pro',
-        features: ['scan', 'organize', 'clean', 'undo', 'init', 'info',
-            'watch', 'sop-ai', 'bulk-organize', 'csv-export'],
-        limits: { bulkOrganize: Infinity },
-    },
-    enterprise: {
-        name: 'Enterprise',
-        features: ['scan', 'organize', 'clean', 'undo', 'init', 'info',
-            'watch', 'sop-ai', 'bulk-organize', 'csv-export',
-            'api-access', 'custom-categories', 'team-sharing'],
-        limits: { bulkOrganize: Infinity },
-    },
-    owner: {
-        name: 'Owner',
-        features: ['*'],
-        limits: { bulkOrganize: Infinity },
-    },
-};
-
-/**
- * Built-in keys (hardcoded, never expire)
- */
-const BUILTIN_KEYS = {
-    'FM-OWN-CHEV-2026-PRMNT': { tier: 'owner', name: 'Owner — Chevza', expires: null },
-    'FM-TST-DEV0-TEST-00000': { tier: 'pro', name: 'Test — Development', expires: null },
-};
-
-// ─── Key Generation & Validation ──────────────────────────────────
-
-/**
- * Generate a checksum for a key body
- * @param {string} body - Key body without checksum segment
- * @returns {string} 5-char checksum
- */
-function generateChecksum(body) {
-    // Ported from Admin Dashboard simpleHash for cross-platform compatibility
-    let hash = 0;
-    for (let i = 0; i < body.length; i++) {
-        hash = ((hash << 5) - hash + body.charCodeAt(i)) | 0;
-    }
-    return Math.abs(hash).toString(36).toUpperCase().padEnd(5, '0').substring(0, 5);
-}
-
-/**
- * Validate key format: FM-XXX-XXXX-XXXX-XXXXX
- * Last 5 chars are HMAC checksum of the rest
- * @param {string} key - License key
- * @returns {{ valid: boolean, tier: string|null, reason: string }}
- */
-function validateKeyFormat(key) {
-    if (!key || typeof key !== 'string') {
-        return { valid: false, tier: null, reason: 'No key provided' };
-    }
-
-    const k = key.trim().toUpperCase();
-
-    // Check built-in keys first
-    if (BUILTIN_KEYS[k]) {
-        return { valid: true, tier: BUILTIN_KEYS[k].tier, reason: 'Built-in key' };
-    }
-
-    // Format: FM-XXX-XXXX-XXXX-XXXXX
-    const pattern = /^FM-(PRO|ENT|OWN|TST)-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{5}$/;
-    if (!pattern.test(k)) {
-        return { valid: false, tier: null, reason: 'Invalid key format' };
-    }
-
-    // Extract parts
-    const parts = k.split('-');
-    const tierCode = parts[1];
-    const body = parts.slice(0, 4).join('-'); // FM-XXX-XXXX-XXXX
-    const checksum = parts[4];                // XXXXX
-
-    // Verify checksum
-    const expectedChecksum = generateChecksum(body);
-    if (checksum !== expectedChecksum) {
-        return { valid: false, tier: null, reason: 'Invalid key (checksum failed)' };
-    }
-
-    // Map tier code
-    const tierMap = { PRO: 'pro', ENT: 'enterprise', OWN: 'owner', TST: 'pro' };
-    const tier = tierMap[tierCode] || 'free';
-
-    return { valid: true, tier, reason: 'Valid' };
-}
-
-/**
- * Generate a new license key
- * @param {'pro'|'enterprise'|'owner'} tier 
- * @returns {string} Generated key
- */
-function generateKey(tier = 'pro') {
-    const tierMap = { pro: 'PRO', enterprise: 'ENT', owner: 'OWN' };
-    const code = tierMap[tier] || 'PRO';
-
-    const seg1 = crypto.randomBytes(2).toString('hex').toUpperCase().substring(0, 4);
-    const seg2 = crypto.randomBytes(2).toString('hex').toUpperCase().substring(0, 4);
-    const body = `FM-${code}-${seg1}-${seg2}`;
-    const checksum = generateChecksum(body);
-
-    return `${body}-${checksum}`;
-}
-
-// ─── License Storage ──────────────────────────────────────────────
-
-/**
- * Read stored license from disk
- * @returns {{ key: string, tier: string, activatedAt: string, name: string }|null}
- */
-function readLicense() {
-    try {
-        if (!fs.existsSync(LICENSE_FILE)) return null;
-        const data = JSON.parse(fs.readFileSync(LICENSE_FILE, 'utf8'));
-        return data;
-    } catch {
-        return null;
-    }
-}
-
-/**
- * Write license to disk
- * @param {Object} licenseData 
- */
-function writeLicense(licenseData) {
-    fs.writeFileSync(LICENSE_FILE, JSON.stringify(licenseData, null, 2), 'utf8');
-}
-
-/**
- * Remove stored license
- */
-function removeLicense() {
-    if (fs.existsSync(LICENSE_FILE)) {
-        fs.unlinkSync(LICENSE_FILE);
-    }
-}
-
-// ─── License Management ──────────────────────────────────────────
-
-/**
- * Activate a license key
- * @param {string} key - License key to activate
- * @returns {{ success: boolean, message: string, tier: string|null }}
- */
-function activateLicense(key) {
-    const validation = validateKeyFormat(key);
-
-    if (!validation.valid) {
-        return { success: false, message: validation.reason, tier: null };
-    }
-
-    const k = key.trim().toUpperCase();
-    const builtin = BUILTIN_KEYS[k];
-
-    const licenseData = {
-        key: k,
-        tier: validation.tier,
-        name: builtin ? builtin.name : `${TIERS[validation.tier].name} License`,
-        activatedAt: new Date().toISOString(),
-        expires: builtin ? null : null, // LemonSqueezy keys can add expiry later
-    };
-
-    writeLicense(licenseData);
-
-    return {
-        success: true,
-        message: `${TIERS[validation.tier].name} license activated successfully`,
-        tier: validation.tier,
-    };
-}
-
-/**
- * Deactivate the current license
- * @returns {{ success: boolean, message: string }}
- */
-function deactivateLicense() {
-    const current = readLicense();
-    if (!current) {
-        return { success: false, message: 'No active license found' };
-    }
-    removeLicense();
-    return { success: true, message: 'License deactivated. Reverted to Free tier.' };
-}
-
-/**
- * Get current license info
- * @returns {{ tier: string, name: string, features: string[], limits: Object, key: string|null, active: boolean }}
- */
-function getLicenseInfo() {
-    const stored = readLicense();
-
-    if (!stored) {
-        return {
-            tier: 'free',
-            name: 'Free',
-            features: TIERS.free.features,
-            limits: TIERS.free.limits,
-            key: null,
-            active: false,
-        };
-    }
-
-    // Re-validate stored key
-    const validation = validateKeyFormat(stored.key);
-    if (!validation.valid) {
-        removeLicense();
-        return {
-            tier: 'free',
-            name: 'Free (invalid key removed)',
-            features: TIERS.free.features,
-            limits: TIERS.free.limits,
-            key: null,
-            active: false,
-        };
-    }
-
-    const tier = TIERS[stored.tier] || TIERS.free;
-
-    return {
-        tier: stored.tier,
-        name: stored.name,
-        features: tier.features,
-        limits: tier.limits,
-        key: stored.key,
-        active: true,
-        activatedAt: stored.activatedAt,
-    };
-}
-
-// ─── Feature Gating ──────────────────────────────────────────────
-
-/**
- * Check if a feature is available in the current license
- * @param {string} feature - Feature identifier
- * @returns {boolean}
- */
-function hasFeature(feature) {
-    const info = getLicenseInfo();
-    if (info.features.includes('*')) return true; // Owner has everything
-    return info.features.includes(feature);
-}
-
-/**
- * Check if a Pro feature is gated and return appropriate message
- * @param {string} feature - Feature identifier
- * @param {string} featureLabel - Human-readable feature name
- * @returns {{ allowed: boolean, message: string|null }}
- */
-function checkProFeature(feature, featureLabel) {
-    if (hasFeature(feature)) {
-        return { allowed: true, message: null };
-    }
-
-    return {
-        allowed: false,
-        message: [
-            c('yellow', `⚡ ${featureLabel} is a Pro Feature`),
-            '',
-            `  FileMayor Core is free. ${featureLabel} requires a Pro License.`,
-            '  Unlocks: Real-time Watch, AI SOP Engine, and Unlimited Bulk processing.',
-            '',
-            '  Get Key: https://filemayor.com/pro',
-            '  Activate: filemayor license activate YOUR-KEY',
-            '',
-        ].join('\n'),
-    };
-}
-
-/**
- * Check bulk organize limit
- * @param {number} fileCount - Number of files to organize
- * @returns {{ allowed: boolean, message: string|null }}
- */
-function checkBulkLimit(fileCount) {
-    const info = getLicenseInfo();
-    if (info.limits.bulkOrganize >= fileCount) {
-        return { allowed: true, message: null };
-    }
-
-    return {
-        allowed: false,
-        message: [
-            `⚡ Bulk organize (${fileCount} files) requires a Pro license`,
-            `   Free tier is limited to ${info.limits.bulkOrganize} files per operation.`,
-            '',
-            '  Upgrade: https://filemayor.lemonsqueezy.com/checkout/buy/7fdcc87f-0660-4c1c-b3db-99f94773b71a',
-            '  Then run: filemayor license activate YOUR-KEY',
-        ].join('\n'),
-    };
-}
-
-// ─── Exports ─────────────────────────────────────────────────────
-
-module.exports = {
-    TIERS,
-    BUILTIN_KEYS,
-    validateKeyFormat,
-    generateKey,
-    readLicense,
-    activateLicense,
-    deactivateLicense,
-    getLicenseInfo,
-    hasFeature,
-    checkProFeature,
-    checkBulkLimit,
-    LICENSE_FILE,
-};
+#!/usr/bin/env node
+
+/**
+ * ═══════════════════════════════════════════════════════════════════
+ * FILEMAYOR CORE — LICENSE
+ * Offline license key validation, tier management, and feature gating.
+ * Created by Lehlohonolo Goodwill Nchefu (Chevza)
+ * ═══════════════════════════════════════════════════════════════════
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const crypto = require('crypto');
+
+// ─── Constants ────────────────────────────────────────────────────
+
+const LICENSE_FILE = path.join(os.homedir(), '.filemayor-license.json');
+const KEY_PREFIX = 'FM';
+const CHECKSUM_SECRET = process.env.FM_CHECKSUM_SECRET || 'filemayor-chevza-2026';
+
+/**
+ * License tiers with capabilities
+ */
+const TIERS = {
+    // Free until 100k users: every feature is open. The tier system and
+    // Ed25519 license verification stay in place so paid tiers can be
+    // reintroduced later without re-architecting.
+    free: {
+        name: 'Free',
+        features: ['scan', 'organize', 'clean', 'undo', 'init', 'info',
+            'watch', 'sop-ai', 'bulk-organize', 'csv-export'],
+        limits: { bulkOrganize: Infinity },
+    },
+    pro: {
+        name: 'Pro',
+        features: ['scan', 'organize', 'clean', 'undo', 'init', 'info',
+            'watch', 'sop-ai', 'bulk-organize', 'csv-export'],
+        limits: { bulkOrganize: Infinity },
+    },
+    enterprise: {
+        name: 'Enterprise',
+        features: ['scan', 'organize', 'clean', 'undo', 'init', 'info',
+            'watch', 'sop-ai', 'bulk-organize', 'csv-export',
+            'api-access', 'custom-categories', 'team-sharing'],
+        limits: { bulkOrganize: Infinity },
+    },
+    owner: {
+        name: 'Owner',
+        features: ['*'],
+        limits: { bulkOrganize: Infinity },
+    },
+};
+
+// ─── Ed25519 JWT Verification ─────────────────────────────────────
+
+/**
+ * Decode a base64url string to a Buffer
+ */
+function b64urlDecode(str) {
+    const padded = str.replace(/-/g, '+').replace(/_/g, '/');
+    const pad = padded.length % 4;
+    return Buffer.from(pad ? padded + '='.repeat(4 - pad) : padded, 'base64');
+}
+
+/**
+ * Verify an Ed25519 JWT license token.
+ * The matching public key is resolved (in priority order) from:
+ *   1. process.env.FM_LICENSE_PUBLIC_KEY_<kid>
+ *   2. process.env.FM_LICENSE_PUBLIC_KEY
+ * where <kid> comes from the JWT header's kid field.
+ *
+ * Returns the decoded payload object on success, or null on any failure.
+ * Fails secure: an unknown/missing public key always returns null.
+ *
+ * @param {string} token - JWT string (header.payload.signature, all base64url)
+ * @returns {object|null} Decoded payload or null
+ */
+function verifySignedKey(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) return null;
+
+        const [headerB64, payloadB64, sigB64] = parts;
+        const header = JSON.parse(b64urlDecode(headerB64).toString('utf8'));
+        const kid = header.kid || 'v1';
+        const signingInput = `${headerB64}.${payloadB64}`;
+        const signature = b64urlDecode(sigB64);
+
+        // Resolve public key PEM from environment
+        const pubKeyPem = process.env[`FM_LICENSE_PUBLIC_KEY_${kid}`]
+            || process.env.FM_LICENSE_PUBLIC_KEY;
+
+        if (!pubKeyPem) return null; // Fail secure: no public key configured
+
+        const pubKey = crypto.createPublicKey({ key: pubKeyPem.trim(), format: 'pem' });
+        const valid = crypto.verify(null, Buffer.from(signingInput), pubKey, signature);
+        if (!valid) return null;
+
+        const payload = JSON.parse(b64urlDecode(payloadB64).toString('utf8'));
+
+        // Check expiry if present
+        if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) return null;
+
+        return payload;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Built-in keys (hardcoded, never expire)
+ */
+const BUILTIN_KEYS = {
+    'FM-OWN-CHEV-2026-PRMNT': { tier: 'owner', name: 'Owner — Chevza', expires: null },
+};
+
+// ─── Key Generation & Validation ──────────────────────────────────
+
+/**
+ * Generate a checksum for a key body
+ * @param {string} body - Key body without checksum segment
+ * @returns {string} 5-char checksum
+ */
+function generateChecksum(body) {
+    // Ported from Admin Dashboard simpleHash for cross-platform compatibility
+    let hash = 0;
+    for (let i = 0; i < body.length; i++) {
+        hash = ((hash << 5) - hash + body.charCodeAt(i)) | 0;
+    }
+    return Math.abs(hash).toString(36).toUpperCase().padEnd(5, '0').substring(0, 5);
+}
+
+/**
+ * Validate key format: FM-XXX-XXXX-XXXX-XXXXX
+ * Last 5 chars are HMAC checksum of the rest
+ * @param {string} key - License key
+ * @returns {{ valid: boolean, tier: string|null, reason: string }}
+ */
+function validateKeyFormat(key) {
+    if (!key || typeof key !== 'string') {
+        return { valid: false, tier: null, reason: 'No key provided' };
+    }
+
+    const trimmed = key.trim();
+
+    // ─── Path A: signed Ed25519 JWT (LemonSqueezy webhook output) ───
+    if (trimmed.includes('.') && trimmed.split('.').length === 3) {
+        const payload = verifySignedKey(trimmed);
+        if (payload && payload.tier && TIERS[payload.tier]) {
+            return { valid: true, tier: payload.tier, reason: 'Signed license', payload };
+        }
+    }
+
+    const k = trimmed.toUpperCase();
+
+    // ─── Path B: built-in keys (Owner, Test) — never expire ─────────
+    if (BUILTIN_KEYS[k]) {
+        return { valid: true, tier: BUILTIN_KEYS[k].tier, reason: 'Built-in key' };
+    }
+
+    // ─── Path C: legacy FM-XXX-XXXX-XXXX-XXXXX checksum format ─────
+    // INTENTIONALLY DISABLED for external keys. The format's checksum
+    // is publicly derivable from source — anyone could mint Pro keys
+    // offline. We keep the format only for BUILTIN_KEYS (above) where
+    // the keys themselves are hard-coded constants. External callers
+    // sending an FM-XXX-style key get the same "invalid" response as
+    // a malformed key. Paid licenses are Ed25519 JWTs (Path A) only.
+    return { valid: false, tier: null, reason: 'Invalid license' };
+}
+
+/**
+ * @deprecated FM-XXX format is no longer accepted for external (paid) licenses.
+ * The checksum is derivable from public source code. Use the LemonSqueezy
+ * webhook (filemayor-landing/app/api/lemonsqueezy/webhook/route.ts) to mint
+ * Ed25519 JWT licenses instead.
+ *
+ * This function is gated behind FM_ALLOW_LEGACY_GENERATE=true for backward
+ * compatibility with existing tooling (e.g. admin dashboard) that hasn't
+ * been migrated yet. Even when enabled, the resulting keys are NOT accepted
+ * by validateKeyFormat() unless they are also added to BUILTIN_KEYS.
+ *
+ * @param {'pro'|'enterprise'|'owner'} tier
+ * @returns {string} Generated key
+ */
+function generateKey(tier = 'pro') {
+    if (process.env.FM_ALLOW_LEGACY_GENERATE !== 'true') {
+        throw new Error(
+            'FM-XXX key generation is disabled. ' +
+            'Use the LemonSqueezy webhook to issue Ed25519 JWT licenses, ' +
+            'or set FM_ALLOW_LEGACY_GENERATE=true if you understand the risk.',
+        );
+    }
+    const tierMap = { pro: 'PRO', enterprise: 'ENT', owner: 'OWN' };
+    const code = tierMap[tier] || 'PRO';
+    const seg1 = crypto.randomBytes(2).toString('hex').toUpperCase().substring(0, 4);
+    const seg2 = crypto.randomBytes(2).toString('hex').toUpperCase().substring(0, 4);
+    const body = `FM-${code}-${seg1}-${seg2}`;
+    const checksum = generateChecksum(body);
+    return `${body}-${checksum}`;
+}
+
+// ─── License Storage ──────────────────────────────────────────────
+
+/**
+ * Read stored license from disk
+ * @returns {{ key: string, tier: string, activatedAt: string, name: string }|null}
+ */
+function readLicense() {
+    try {
+        if (!fs.existsSync(LICENSE_FILE)) return null;
+        const data = JSON.parse(fs.readFileSync(LICENSE_FILE, 'utf8'));
+        return data;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Write license to disk
+ * @param {Object} licenseData 
+ */
+function writeLicense(licenseData) {
+    fs.writeFileSync(LICENSE_FILE, JSON.stringify(licenseData, null, 2), 'utf8');
+}
+
+/**
+ * Remove stored license
+ */
+function removeLicense() {
+    if (fs.existsSync(LICENSE_FILE)) {
+        fs.unlinkSync(LICENSE_FILE);
+    }
+}
+
+// ─── License Management ──────────────────────────────────────────
+
+/**
+ * Activate a license key
+ * @param {string} key - License key to activate
+ * @returns {{ success: boolean, message: string, tier: string|null }}
+ */
+function activateLicense(key) {
+    const validation = validateKeyFormat(key);
+
+    if (!validation.valid) {
+        return { success: false, message: validation.reason, tier: null };
+    }
+
+    const k = key.trim().toUpperCase();
+    const builtin = BUILTIN_KEYS[k];
+
+    const licenseData = {
+        key: k,
+        tier: validation.tier,
+        name: builtin ? builtin.name : `${TIERS[validation.tier].name} License`,
+        activatedAt: new Date().toISOString(),
+        expires: builtin ? null : null, // LemonSqueezy keys can add expiry later
+    };
+
+    writeLicense(licenseData);
+
+    return {
+        success: true,
+        message: `${TIERS[validation.tier].name} license activated successfully`,
+        tier: validation.tier,
+    };
+}
+
+/**
+ * Deactivate the current license
+ * @returns {{ success: boolean, message: string }}
+ */
+function deactivateLicense() {
+    const current = readLicense();
+    if (!current) {
+        return { success: false, message: 'No active license found' };
+    }
+    removeLicense();
+    return { success: true, message: 'License deactivated. Reverted to Free tier.' };
+}
+
+/**
+ * Get current license info
+ * @returns {{ tier: string, name: string, features: string[], limits: Object, key: string|null, active: boolean }}
+ */
+function getLicenseInfo() {
+    const stored = readLicense();
+
+    if (!stored) {
+        return {
+            tier: 'free',
+            name: 'Free',
+            features: TIERS.free.features,
+            limits: TIERS.free.limits,
+            key: null,
+            active: false,
+        };
+    }
+
+    // Re-validate stored key
+    const validation = validateKeyFormat(stored.key);
+    if (!validation.valid) {
+        removeLicense();
+        return {
+            tier: 'free',
+            name: 'Free (invalid key removed)',
+            features: TIERS.free.features,
+            limits: TIERS.free.limits,
+            key: null,
+            active: false,
+        };
+    }
+
+    const tier = TIERS[stored.tier] || TIERS.free;
+
+    return {
+        tier: stored.tier,
+        name: stored.name,
+        features: tier.features,
+        limits: tier.limits,
+        key: stored.key,
+        active: true,
+        activatedAt: stored.activatedAt,
+    };
+}
+
+// ─── Feature Gating ──────────────────────────────────────────────
+
+/**
+ * Check if a feature is available in the current license
+ * @param {string} feature - Feature identifier
+ * @returns {boolean}
+ */
+function hasFeature(feature) {
+    const info = getLicenseInfo();
+    if (info.features.includes('*')) return true; // Owner has everything
+    return info.features.includes(feature);
+}
+
+/**
+ * Check if a Pro feature is gated and return appropriate message
+ * @param {string} feature - Feature identifier
+ * @param {string} featureLabel - Human-readable feature name
+ * @returns {{ allowed: boolean, message: string|null }}
+ */
+function checkProFeature(feature, featureLabel) {
+    if (hasFeature(feature)) {
+        return { allowed: true, message: null };
+    }
+
+    return {
+        allowed: false,
+        message: [
+            `⚡ ${featureLabel} requires a license`,
+            '',
+            '  Activate: filemayor license activate YOUR-KEY',
+            '  More info: https://filemayor.com',
+            '',
+        ].join('\n'),
+    };
+}
+
+/**
+ * Check bulk organize limit
+ * @param {number} fileCount - Number of files to organize
+ * @returns {{ allowed: boolean, message: string|null }}
+ */
+function checkBulkLimit(fileCount) {
+    const info = getLicenseInfo();
+    if (info.limits.bulkOrganize >= fileCount) {
+        return { allowed: true, message: null };
+    }
+
+    return {
+        allowed: false,
+        message: [
+            `⚡ Bulk organize (${fileCount} files) exceeds your current limit`,
+            `   This license tier is limited to ${info.limits.bulkOrganize} files per operation.`,
+            '',
+            '  More info: https://filemayor.com',
+        ].join('\n'),
+    };
+}
+
+// ─── Exports ─────────────────────────────────────────────────────
+
+module.exports = {
+    TIERS,
+    BUILTIN_KEYS,
+    validateKeyFormat,
+    generateKey,
+    readLicense,
+    activateLicense,
+    deactivateLicense,
+    getLicenseInfo,
+    hasFeature,
+    checkProFeature,
+    checkBulkLimit,
+    LICENSE_FILE,
+};