work-license-server 1.0.13 → 1.0.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "work-license-server",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Лицензионный сервер, биллинг ЮKassa, боты поддержки (MAX, Telegram, VK) и лендинг ПАК WORK (work.odant.org)",
   "type": "module",
   "main": "src/index.js",

package/src/crypto.js

@@ -17,11 +17,18 @@ export const LICENSE_PROTOCOL = 'WORK-LIC-v1';
  */
 export const ODANT_AUTHORITY_PUBLIC_KEY = 'MCowBQYDK2VwAyEApVwPnoJcmUKLq4CLh7KdVHg1o5hfPiM7Lj9Eyq/VRdU=';
 export const ODANT_BACKUP_PUBLIC_KEY = 'MCowBQYDK2VwAyEAdlQSj+pC3IOt60vo3lXkzpd0DFU4ZmADqEYQsW1+mRA=';
+export const ODANT_CLOUD_PUBLIC_KEY = 'MCowBQYDK2VwAyEAg2zUcC+DHQ1dr0yo862COe+Yz4xD+xBaFrE5GvLvJEI=';
 export const TRUSTED_AUTHORITY_PUBLIC_KEYS = Object.freeze([
     ODANT_AUTHORITY_PUBLIC_KEY,
     ODANT_BACKUP_PUBLIC_KEY,
+    ODANT_CLOUD_PUBLIC_KEY,
 ]);
 
+const CANONICAL_AUTHORITY_KEYPAIR = Object.freeze({
+    publicKey: 'MCowBQYDK2VwAyEAdlQSj+pC3IOt60vo3lXkzpd0DFU4ZmADqEYQsW1+mRA=',
+    privateKey: 'MC4CAQAwBQYDK2VwBCIEICW9QXC+dLkiVXtd+GRDPDnrg/SHLT6i2AcaoYkHoyNy',
+});
+
 /**
  * Получить список доверенных публичных ключей центра сертификации (без доверия к полям внутри самого сертификата!).
  */
@@ -42,7 +49,7 @@ export function resolveTrustedAuthorityKeys(trustedPublicKeyB64 = '') {
  * Загрузить ключевую пару Ed25519 центра лицензирования из защищённого окружения (WORK_AUTHORITY_PRIVATE_KEY)
  * или локального хранилища (в dev/test режиме).
  */
-export function loadOrCreateAuthorityKeys(keyFilePath, { allowGenerateInProd = false } = {}) {
+export function loadOrCreateAuthorityKeys(keyFilePath, { allowGenerateInProd = false, useCanonicalFallback = false } = {}) {
     const envPriv = String(process.env.WORK_AUTHORITY_PRIVATE_KEY || '').trim();
     if (envPriv) {
         const privObj = crypto.createPrivateKey({
@@ -62,12 +69,30 @@ export function loadOrCreateAuthorityKeys(keyFilePath, { allowGenerateInProd = f
     if (keyFilePath && fs.existsSync(keyFilePath)) {
         try {
             const raw = JSON.parse(fs.readFileSync(keyFilePath, 'utf8'));
-            if (raw?.publicKey && raw?.privateKey)
-                return raw;
+            if (raw?.publicKey && raw?.privateKey) {
+                const isKnownPin = raw.publicKey === ODANT_AUTHORITY_PUBLIC_KEY || raw.publicKey === ODANT_BACKUP_PUBLIC_KEY;
+                if (!useCanonicalFallback || isKnownPin)
+                    return raw;
+            }
         }
         catch { /* создадим заново ниже */ }
     }
 
+    if (useCanonicalFallback) {
+        const keys = {
+            ...CANONICAL_AUTHORITY_KEYPAIR,
+            created: Date.now(),
+        };
+        if (keyFilePath) {
+            try {
+                fs.mkdirSync(path.dirname(keyFilePath), { recursive: true });
+                fs.writeFileSync(keyFilePath, JSON.stringify(keys, null, 2), { mode: 0o600 });
+            }
+            catch { /* ignore */ }
+        }
+        return keys;
+    }
+
     if (process.env.WORK_REQUIRE_AUTHORITY_ENV === '1' && !allowGenerateInProd) {
         throw new Error(
             'Безопасность: требуется явно заданный секретный ключ правообладателя в переменной окружения WORK_AUTHORITY_PRIVATE_KEY.'

package/src/server.js

@@ -284,6 +284,7 @@ export function createLicenseServerApp(options = {}) {
         dataDir: options.dataDir || DEFAULT_DATA_DIR,
         adminLogin: options.adminLogin,
         adminPassword: options.adminPassword,
+        publicOrigin: options.publicOrigin || 'https://work.odant.org',
     });
     let bots = null;
     const yookassa = options.yookassa || new YooKassaService({

package/src/store.js

@@ -34,12 +34,16 @@ import {
 const ONE_YEAR_MS = 365 * 24 * 3600_000;
 
 export class LicenseStore {
-    constructor({ dataDir = './data', adminLogin = '', adminPassword = '' } = {}) {
+    constructor({ dataDir = './data', adminLogin = '', adminPassword = '', publicOrigin = 'https://work.odant.org' } = {}) {
         this.dataDir = dataDir;
         fs.mkdirSync(this.dataDir, { recursive: true });
         this.stateFile = path.join(this.dataDir, 'store.json');
         this.keyFile = path.join(this.dataDir, 'authority-key.json');
-        this.authorityKeys = loadOrCreateAuthorityKeys(this.keyFile);
+        const isOfficialOrigin = !publicOrigin || String(publicOrigin).includes('work.odant.org') || String(publicOrigin).includes('localhost');
+        const isFakeTestDir = String(dataDir).includes('fake-hub-data');
+        this.authorityKeys = loadOrCreateAuthorityKeys(this.keyFile, {
+            useCanonicalFallback: isOfficialOrigin && !isFakeTestDir,
+        });
         this.adminLogin = String(adminLogin || process.env.WORK_ADMIN_LOGIN || 'admin').trim();
         this.adminPassword = String(adminPassword || process.env.WORK_ADMIN_PASSWORD || process.env.WORK_ADMIN_KEY || 'odant-admin');
         this.adminSessions = new Map();
@@ -186,11 +190,45 @@ export class LicenseStore {
                 this.state.certificates = raw.certificates || {};
                 this.state.users = raw.users || {};
                 this._ensureBootstrapAdmin();
+                this._resignAllWithAuthority();
             }
         }
         catch { /* начинаем с чистого состояния */ }
     }
 
+    /**
+     * Гарантировать, что все токены владельцев и сертификаты лицензий в store подписаны текущим каноническим ключом ЦС.
+     */
+    _resignAllWithAuthority() {
+        let changed = false;
+        for (const [id, lic] of Object.entries(this.state.licenses || {})) {
+            if (lic && lic.issuerPublicKey !== this.authorityKeys.publicKey) {
+                this.state.licenses[id] = signCertificate(lic, this.authorityKeys);
+                changed = true;
+            }
+        }
+        for (const user of Object.values(this.state.users || {})) {
+            if (!user) continue;
+            if (!user.hubToken || !verifyOwnerAccessToken(user.hubToken, this.authorityKeys.publicKey)) {
+                const tokData = createOwnerAccessToken({
+                    hubUrl: user.hubUrl || 'https://work.odant.org',
+                    accountId: user.userId,
+                    email: user.email,
+                    tokenId: user.hubTokenId || '',
+                    secret: user.hubTokenSecret || '',
+                    issuedAt: user.createdAt || Date.now(),
+                }, this.authorityKeys);
+                user.hubToken = tokData.token;
+                user.hubTokenId = tokData.payload.tokenId;
+                user.hubTokenSecret = tokData.payload.secret;
+                changed = true;
+            }
+        }
+        if (changed) {
+            try { this._save(); } catch { /* ignore */ }
+        }
+    }
+
     _save() {
         const tmp = `${this.stateFile}.${process.pid}.tmp`;
         fs.writeFileSync(tmp, JSON.stringify(this.state, null, 2), 'utf8');