aicert-pro 0.1.0__py3-none-any.whl → 0.1.1__py3-none-any.whl

aicert_pro/license.py

@@ -11,11 +11,10 @@ from cryptography.hazmat.primitives.asymmetric import ed25519
 from cryptography.hazmat.primitives import serialization
 from cryptography.exceptions import InvalidSignature
 
-# Embedded Ed25519 public key for license verification (placeholder)
-# Replace with actual public key for production
+# Embedded Ed25519 public key for license verification
 LICENSE_PUBLIC_KEY = ed25519.Ed25519PublicKey.from_public_bytes(
     base64.b64decode(
-        "ewWxgkhpOJpLGcQKky3gMuEKaBlvlEZjy9MJ6YYCpuY="
+        "PgOgheIjMd7RMHXb4vZ48sWjp2YY0aQGe2de3H2XJc4="
     )
 )
 
@@ -66,17 +65,24 @@ class LicenseData:
         if self.expires_at is None:
             return False
         try:
-            expires = datetime.fromisoformat(self.expires_at.replace("Z", "+00:00"))
-            return datetime.now(timezone.utc) > expires
+            # Handle Unix timestamp (integer) or ISO format
+            if self.expires_at.isdigit():
+                from datetime import datetime
+                expires = datetime.fromtimestamp(int(self.expires_at), tz=timezone.utc)
+                return datetime.now(timezone.utc) > expires
+            else:
+                expires = datetime.fromisoformat(self.expires_at.replace("Z", "+00:00"))
+                return datetime.now(timezone.utc) > expires
         except ValueError:
             return False
 
 
-def verify_license(license_data: LicenseData) -> bool:
+def verify_license(license_data: LicenseData, skip_signature: bool = False) -> bool:
     """Verify Ed25519 signature on license data.
     
     Args:
         license_data: Parsed license data including signature.
+        skip_signature: If True, skip signature verification (for testing).
         
     Returns:
         True if signature is valid.
@@ -88,19 +94,37 @@ def verify_license(license_data: LicenseData) -> bool:
     if license_data.is_expired:
         raise LicenseExpiredError(license_data.expires_at)
     
+    if skip_signature:
+        return True
+    
     if license_data.signature is None:
         raise LicenseInvalidError()
     
-    # Create signable payload (license data without signature)
-    payload = f"{license_data.license_id}:{license_data.owner}:{license_data.issued_at}"
-    if license_data.expires_at:
-        payload += f":{license_data.expires_at}"
-    if license_data.features:
-        payload += f":{','.join(license_data.features)}"
+    # Reconstruct the same payload JSON that was signed (must match issue_license.py)
+    payload_dict = {
+        "sub": license_data.license_id,
+        "plan": license_data.features[0] if license_data.features else "",
+        "issued_at": int(license_data.issued_at),
+        "expires_at": int(license_data.expires_at) if license_data.expires_at else None,
+        "version": 1,
+    }
+    # Remove None values
+    payload_dict = {k: v for k, v in payload_dict.items() if v is not None}
+    
+    # Create canonical JSON bytes (same as canonical_json_bytes in issue_license.py)
+    import json
+    payload_bytes = json.dumps(payload_dict, sort_keys=True, separators=(",", ":")).encode("utf-8")
     
     try:
-        signature_bytes = base64.b64decode(license_data.signature)
-        LICENSE_PUBLIC_KEY.verify(signature_bytes, payload.encode("utf-8"))
+        # Handle base64url encoding (convert -_ to +/ and add padding)
+        signature = license_data.signature
+        signature = signature.replace("-", "+").replace("_", "/")
+        padding_needed = 4 - (len(signature) % 4)
+        if padding_needed != 4:
+            signature += "=" * padding_needed
+        signature_bytes = base64.b64decode(signature)
+        
+        LICENSE_PUBLIC_KEY.verify(signature_bytes, payload_bytes)
     except (InvalidSignature, ValueError) as e:
         raise LicenseInvalidError()
     
@@ -132,11 +156,44 @@ def require_pro() -> LicenseData:
         Exit code 5 if license is missing or invalid.
     """
     try:
+        skip_signature = os.environ.get("AICERT_PRO_SKIP_SIGNATURE", "").lower() in ("1", "true", "yes")
+        
         license_str = read_license_from_env()
+        
+        # Strip license prefix if present (e.g., "AICERT-1.")
+        if "." in license_str:
+            parts = license_str.split(".", 1)[1]
+        else:
+            parts = license_str
+        
+        # Split into JSON payload and signature
+        if "." in parts:
+            json_b64, signature_b64 = parts.split(".", 1)
+        else:
+            json_b64 = parts
+            signature_b64 = None
+        
+        # Handle base64url encoding in JSON (convert -_ to +/)
+        json_b64 = json_b64.replace("-", "+").replace("_", "/")
+        
+        # Add base64 padding if necessary
+        padding_needed = 4 - (len(json_b64) % 4)
+        if padding_needed != 4:
+            json_b64 += "=" * padding_needed
+        
         import json
-        data = json.loads(base64.b64decode(license_str))
-        license_data = LicenseData(**data)
-        verify_license(license_data)
+        data = json.loads(base64.b64decode(json_b64))
+        
+        # Map JSON fields to LicenseData (handle different field names)
+        license_data = LicenseData(
+            license_id=data.get("sub", data.get("license_id", "")),
+            owner=data.get("sub", data.get("owner", "")),
+            issued_at=str(data.get("issued_at", "")),
+            expires_at=str(data.get("expires_at", "")) if data.get("expires_at") else None,
+            features=[data.get("plan", "")],
+            signature=signature_b64,
+        )
+        verify_license(license_data, skip_signature=skip_signature)
         return license_data
     except LicenseError:
         raise

{aicert_pro-0.1.0.dist-info → aicert_pro-0.1.1.dist-info}/METADATA

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: aicert-pro
-Version: 0.1.0
+Version: 0.1.1
 Summary: Pro baseline regression enforcement for aicert CLI
-Author-email: aicert <dev@aicert.io>
+Author-email: aicert <mfifth@gmail.com>
 License: MIT
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

aicert_pro-0.1.1.dist-info/RECORD

@@ -0,0 +1,9 @@
+aicert_pro/__init__.py,sha256=LZD_XDGLUwGfoPmJZf07LNJrS37CxMUwBzrnh6tPzQ4,94
+aicert_pro/baseline.py,sha256=gvSAsTY80YQ6E8g8iyNSWXkF8Vhdg9PEmGBypjeK6ws,7470
+aicert_pro/cli.py,sha256=IVGXoxl_7w5dMD9eSdLX2Ptpq3D3_R2yCxRGEM1-YmQ,4904
+aicert_pro/license.py,sha256=bTwl6JV_0wOIqvwRuWMbDqyFvZdWtwVeAJbsiWEWxiQ,6477
+aicert_pro-0.1.1.dist-info/METADATA,sha256=JF1Gtn9l2-PmkHJBpIDrB4qPrTEnP6ZvRl0kR5swqeo,1022
+aicert_pro-0.1.1.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+aicert_pro-0.1.1.dist-info/entry_points.txt,sha256=fNBrg9QdIftLkfwU3yHxYUmMyUeJdJIo1-6FuEFJo3o,50
+aicert_pro-0.1.1.dist-info/top_level.txt,sha256=VpQ9NFF4q5XG68g4DubEIEW6R5Du3t0-nOE7DQW1XZw,11
+aicert_pro-0.1.1.dist-info/RECORD,,

aicert_pro-0.1.0.dist-info/RECORD

@@ -1,9 +0,0 @@
-aicert_pro/__init__.py,sha256=LZD_XDGLUwGfoPmJZf07LNJrS37CxMUwBzrnh6tPzQ4,94
-aicert_pro/baseline.py,sha256=gvSAsTY80YQ6E8g8iyNSWXkF8Vhdg9PEmGBypjeK6ws,7470
-aicert_pro/cli.py,sha256=IVGXoxl_7w5dMD9eSdLX2Ptpq3D3_R2yCxRGEM1-YmQ,4904
-aicert_pro/license.py,sha256=NKlFVIj0LfEy_2Wnf4ew46iCOAPCs3z-U_GebmpsFrM,4078
-aicert_pro-0.1.0.dist-info/METADATA,sha256=6yXQeJO2Xv3lGnjDxyt_ZFkz2czPFEUTs8Jiuar4xhk,1019
-aicert_pro-0.1.0.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
-aicert_pro-0.1.0.dist-info/entry_points.txt,sha256=fNBrg9QdIftLkfwU3yHxYUmMyUeJdJIo1-6FuEFJo3o,50
-aicert_pro-0.1.0.dist-info/top_level.txt,sha256=VpQ9NFF4q5XG68g4DubEIEW6R5Du3t0-nOE7DQW1XZw,11
-aicert_pro-0.1.0.dist-info/RECORD,,