touchlab-license-server 1.0.0__py3-none-any.whl

touchlab_license_server/cli.py

@@ -0,0 +1,185 @@
+"""`touchlab-license-server` entrypoint: start / stop / status / list.
+
+Also serves as the reference client for the socket protocol — anything
+that wants to talk to the daemon (touchlab-slip-detect, this CLI)
+sends the same REGISTER/CHECK/LIST/PING frames defined in protocol.py.
+"""
+
+import argparse
+import importlib.resources
+import logging
+import os
+import signal
+import socket
+import sys
+import time
+
+from . import client, paths, protocol, server, transport
+
+
+def _connect(timeout=2.0) -> socket.socket:
+    return transport.connect(timeout)
+
+
+def _detach_kwargs() -> dict:
+    """Popen arguments that let the daemon outlive the command that started it."""
+    if paths.WINDOWS:
+        import subprocess
+        return {"creationflags": subprocess.DETACHED_PROCESS | subprocess.CREATE_NEW_PROCESS_GROUP}
+    return {"start_new_session": True}
+
+
+def _is_running() -> bool:
+    try:
+        with _connect(timeout=1.0) as sock:
+            resp = protocol.request(sock, protocol.PING)
+            return bool(resp.get("ok"))
+    except (OSError, protocol.ProtocolError):
+        return False
+
+
+def cmd_start(args):
+    if _is_running():
+        print(f"already running ({transport.describe()})")
+        return 0
+
+    if args.foreground:
+        logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
+        server.main_async()
+        return 0
+
+    # Detach: re-exec ourselves with --foreground, logs to a file, pid tracked for `stop`.
+    log_file = open(paths.log_path(), "a")
+    proc = __import__("subprocess").Popen(
+        [sys.executable, "-m", "touchlab_license_server.cli", "start", "--foreground"],
+        stdout=log_file,
+        stderr=log_file,
+        **_detach_kwargs(),
+    )
+    paths.pid_path().write_text(str(proc.pid))
+
+    deadline = time.monotonic() + client.START_TIMEOUT_SEC
+    while time.monotonic() < deadline:
+        if _is_running():
+            print(f"started (pid {proc.pid}, {transport.describe()})")
+            return 0
+        if proc.poll() is not None:  # the server exited: it won't come up
+            break
+        time.sleep(0.1)
+
+    print(f"started process (pid {proc.pid}) but it isn't answering. {client.startup_failure()}")
+    return 1
+
+
+def cmd_stop(args):
+    if not paths.pid_path().exists():
+        print("not running (no pidfile)")
+        return 0
+    pid = int(paths.pid_path().read_text().strip())
+    try:
+        os.kill(pid, signal.SIGTERM)  # on Windows this terminates the process
+        print(f"stopped (pid {pid})")
+    except OSError:
+        print(f"pid {pid} not found (stale pidfile)")
+    paths.pid_path().unlink(missing_ok=True)
+    return 0
+
+
+def cmd_status(args):
+    if _is_running():
+        print(f"running ({transport.describe()})")
+        return 0
+    print("not running")
+    return 1
+
+
+def _connect_starting_server() -> socket.socket:
+    """Connect, starting the server first if it isn't running (e.g. after a
+    reboot, before touchlab-slip-detect has run)."""
+    if not client.ensure_server_running():
+        print(f"error: {client.startup_failure()}", file=sys.stderr)
+        sys.exit(1)
+    return _connect()
+
+
+def cmd_list(args):
+    with _connect_starting_server() as sock:
+        protocol.request(sock, protocol.SYNC)  # include a license activated moments ago
+        resp = protocol.request(sock, protocol.LIST)
+    if not resp.get("ok"):
+        print(f"error: {resp.get('error')}")
+        return 1
+    licenses = resp["licenses"]
+    if not licenses:
+        print("no licenses registered")
+        return 0
+    for lic in licenses:
+        if lic["licensed"]:
+            days = lic.get("days_remaining")
+            left = "perpetual" if days is None else f"{days} day(s) left"
+            print(f"{lic['sn']}  licensed=True  expires_at={lic['expires_at']}  ({left})")
+        else:
+            print(f"{lic['sn']}  licensed=False  expires_at={lic['expires_at']}  ({lic['reason']})")
+    return 0
+
+
+def cmd_sync(args):
+    """Re-scan ~/.config/touchlab/licenses now instead of waiting for the
+    background sync — handy right after running touchlab-activate."""
+    with _connect_starting_server() as sock:
+        resp = protocol.request(sock, protocol.SYNC)
+    if not resp.get("ok"):
+        print(f"error: {resp.get('error')}")
+        return 1
+    imported = resp["imported"]
+    print(f"synced {len(imported)} license(s): {', '.join(imported) if imported else '(none)'}")
+    return 0
+
+
+def cmd_install_service(args):
+    """Install the systemd --user unit so the daemon starts automatically at login."""
+    if paths.WINDOWS:
+        print("Not needed on Windows: the license server starts on its own whenever "
+              "touchlab-slip-detect or touchlab-license-server needs it.")
+        return 0
+    unit_src = importlib.resources.files("touchlab_license_server").joinpath(
+        "resources", "touchlab-license-server.service"
+    )
+    unit_dir = os.path.expanduser("~/.config/systemd/user")
+    os.makedirs(unit_dir, exist_ok=True)
+    unit_dest = os.path.join(unit_dir, "touchlab-license-server.service")
+
+    with importlib.resources.as_file(unit_src) as unit_path:
+        contents = unit_path.read_text()
+    with open(unit_dest, "w") as f:
+        f.write(contents)
+
+    print(f"wrote {unit_dest}")
+    print("Enable it with:")
+    print("  systemctl --user daemon-reload")
+    print("  systemctl --user enable --now touchlab-license-server")
+    return 0
+
+
+def main():
+    parser = argparse.ArgumentParser(prog="touchlab-license-server")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p_start = sub.add_parser("start", help="start the daemon")
+    p_start.add_argument("--foreground", action="store_true", help="run in this process instead of detaching")
+    p_start.set_defaults(func=cmd_start)
+
+    sub.add_parser("stop", help="stop the daemon").set_defaults(func=cmd_stop)
+    sub.add_parser("status", help="check whether the daemon is running").set_defaults(func=cmd_status)
+    sub.add_parser("list", help="list registered licenses").set_defaults(func=cmd_list)
+    sub.add_parser("sync", help="re-scan ~/.config/touchlab/licenses now").set_defaults(func=cmd_sync)
+    sub.add_parser(
+        "install-service", help="install the systemd --user unit for autostart at login"
+    ).set_defaults(func=cmd_install_service)
+
+    args = parser.parse_args()
+    sys.exit(args.func(args))
+
+
+if __name__ == "__main__":
+    main()

touchlab_license_server/client.py

@@ -0,0 +1,94 @@
+"""Public API for other packages: "which of these fingertips are licensed?"
+
+touchlab-slip-detect calls check_fingertips() before it runs, so the
+license server decides which connected fingertips run and reports how long
+each license has left. Model decryption still happens in
+slip_model_deployment.license_validator, which re-verifies the same license
+file on its own -- the server is the pre-run check, not the lock.
+"""
+
+import subprocess
+import sys
+import time
+
+from . import paths, protocol, transport
+
+
+# A fresh Python can take several seconds to start on Windows (e.g. while
+# antivirus scans newly installed files).
+START_TIMEOUT_SEC = 15.0
+
+
+class ServerUnavailable(RuntimeError):
+    """The license server couldn't be started or didn't answer."""
+
+
+def startup_failure(lines: int = 8) -> str:
+    """Why the server didn't start: the end of its log, for error messages."""
+    try:
+        tail = paths.log_path().read_text(errors="replace").strip().splitlines()[-lines:]
+    except OSError:
+        tail = []
+    if not tail:
+        return f"the license server did not start (no log at {paths.log_path()})"
+    return ("the license server did not start. End of " + str(paths.log_path()) + ":\n    "
+            + "\n    ".join(tail))
+
+
+def _is_running() -> bool:
+    try:
+        with transport.connect(timeout=1.0) as sock:
+            return bool(protocol.request(sock, protocol.PING).get("ok"))
+    except (OSError, protocol.ProtocolError):
+        return False
+
+
+def ensure_server_running(timeout_sec: float = START_TIMEOUT_SEC) -> bool:
+    """Start the license server daemon if it isn't already running."""
+    if _is_running():
+        return True
+
+    # Same interpreter as the caller, so this works in a venv whose bin/
+    # isn't on PATH.
+    starter = subprocess.Popen(
+        [sys.executable, "-m", "touchlab_license_server.cli", "start"],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        # No console window flashing up on Windows.
+        creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
+    )
+    deadline = time.monotonic() + timeout_sec
+    while time.monotonic() < deadline:
+        if _is_running():
+            return True
+        # `start` exits 0 once the server answers, 1 if it gave up or the
+        # server died -- no point waiting out the full timeout then.
+        if starter.poll() not in (None, 0):
+            return _is_running()
+        time.sleep(0.2)
+    return False
+
+
+def check_fingertips(serials: list) -> dict:
+    """License status of each fingertip serial, from the license server.
+
+    Starts the server if needed and syncs first, so a license activated
+    moments ago counts straight away. Returns, per serial:
+        {"licensed": bool, "reason": "ok" | "not_registered" | "expired" |
+         "invalid_signature" | "sn_mismatch" | "bad_expiry_format",
+         "expires_at": str | None,
+         "days_remaining": int | None}   # only when licensed; None = perpetual
+
+    Raises ServerUnavailable if the server can't be reached.
+    """
+    if not ensure_server_running():
+        raise ServerUnavailable(startup_failure())
+    try:
+        with transport.connect(timeout=5.0) as sock:
+            protocol.request(sock, protocol.SYNC)
+            resp = protocol.request(sock, protocol.CHECK, serials=list(serials))
+    except (OSError, protocol.ProtocolError) as exc:
+        raise ServerUnavailable(f"license server did not answer: {exc}") from exc
+    if not resp.get("ok"):
+        raise ServerUnavailable(f"license check failed: {resp.get('error')}")
+    return resp["results"]

touchlab_license_server/crypto.py

@@ -0,0 +1,72 @@
+"""Signature verification for Touchlab license files.
+
+Matches slip_model_deployment.license_validator._verify_license exactly —
+same Ed25519 public key, same signed message layout — so this server can
+verify the real license files touchlab-activate writes to
+~/.config/touchlab/licenses/<sn>.json without needing any change to that
+(locked/compiled) module.
+
+License dict shape:
+    {
+        "sn": ..., "customer_id": ..., "product_id": ...,
+        "license_salt": "<base64>", "encrypted_model_key": "<base64>",
+        "expires_at": "<iso8601 or empty for perpetual>",
+        "signature": "<base64 ed25519 sig>",
+    }
+The signature covers sn + customer_id + product_id + license_salt +
+encrypted_model_key + expires_at, concatenated as UTF-8 — no separators,
+no re-ordering. This module does not try to be a better/newer scheme;
+it is a read-only, independent re-implementation of the existing check.
+"""
+
+import base64
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+TOUCHLAB_PUBLIC_KEY_B64 = "IIAxzS/3IjVnC3bMUcSmeaQNrd8Q1w3QH7TdBJ7vso8="
+
+_REQUIRED_FIELDS = (
+    "sn",
+    "customer_id",
+    "product_id",
+    "license_salt",
+    "encrypted_model_key",
+)
+
+
+class InvalidLicense(Exception):
+    pass
+
+
+def _load_public_key() -> Ed25519PublicKey:
+    return Ed25519PublicKey.from_public_bytes(base64.b64decode(TOUCHLAB_PUBLIC_KEY_B64))
+
+
+def signed_message(license: dict) -> bytes:
+    expires_at = license.get("expires_at", "")
+    return (
+        license["sn"]
+        + license["customer_id"]
+        + license["product_id"]
+        + license["license_salt"]
+        + license["encrypted_model_key"]
+        + expires_at
+    ).encode("utf-8")
+
+
+def verify_license(license: dict) -> None:
+    """Raise InvalidLicense if the signature doesn't check out. Does not check expiry —
+    that's a runtime concern (store.py), not a signature concern."""
+    for field in _REQUIRED_FIELDS:
+        if field not in license:
+            raise InvalidLicense(f"missing field: {field}")
+    try:
+        signature = base64.b64decode(license["signature"])
+    except (KeyError, TypeError, ValueError) as exc:
+        raise InvalidLicense(f"malformed signature: {exc}") from exc
+
+    try:
+        _load_public_key().verify(signature, signed_message(license))
+    except InvalidSignature as exc:
+        raise InvalidLicense("signature verification failed") from exc

touchlab_license_server/importer.py

@@ -0,0 +1,48 @@
+"""Ingests license files written by `touchlab-activate` into the server's DB.
+
+touchlab-activate (slip_model_deployment.activation_client) is a locked,
+compiled console script — this project doesn't change what it does. It
+still writes ~/.config/touchlab/licenses/<sn>.json exactly as before. This
+module just also reads that directory and keeps the server's DB in sync,
+so the license server becomes an additional, centralized view of the same
+licenses rather than a replacement activation path.
+
+Each file is independently signature-verified before being trusted — the
+importer does not assume the filesystem contents are honest.
+"""
+
+import json
+import logging
+from pathlib import Path
+
+from . import crypto, store
+
+log = logging.getLogger("touchlab_license_server")
+
+# Same constant as slip_model_deployment.license_validator._LICENSE_DIR /
+# activation_client._LICENSE_DIR — this is where touchlab-activate writes.
+LICENSE_DIR = Path.home() / ".config" / "touchlab" / "licenses"
+
+
+def scan_and_import(conn) -> list:
+    """Verify and register every *.json file in LICENSE_DIR. Returns list of sns imported."""
+    if not LICENSE_DIR.is_dir():
+        return []
+
+    imported = []
+    for path in sorted(LICENSE_DIR.glob("*.json")):
+        try:
+            license = json.loads(path.read_text())
+        except (OSError, json.JSONDecodeError) as exc:
+            log.warning("skipping %s: %s", path, exc)
+            continue
+
+        try:
+            result = store.register(conn, license)
+        except crypto.InvalidLicense as exc:
+            log.warning("skipping %s: %s", path, exc)
+            continue
+
+        imported.append(result["sn"])
+
+    return imported

touchlab_license_server/paths.py

@@ -0,0 +1,56 @@
+"""Filesystem locations for the license server: socket/port, database, pidfile.
+
+Everything is scoped to the invoking user -- this is a per-user daemon, not a
+system service. Linux uses the XDG dirs; Windows uses %LOCALAPPDATA%.
+"""
+
+import os
+from pathlib import Path
+
+WINDOWS = os.name == "nt"
+
+
+def _local_appdata() -> Path:
+    return Path(os.environ.get("LOCALAPPDATA") or Path.home() / "AppData" / "Local") / "touchlab"
+
+
+def runtime_dir() -> Path:
+    if WINDOWS:
+        d = _local_appdata() / "run"
+    else:
+        base = os.environ.get("XDG_RUNTIME_DIR") or f"/tmp/touchlab-{os.getuid()}"
+        d = Path(base) / "touchlab"
+    d.mkdir(parents=True, exist_ok=True, mode=0o700)
+    return d
+
+
+def data_dir() -> Path:
+    if WINDOWS:
+        d = _local_appdata() / "license_server"
+    else:
+        base = os.environ.get("XDG_DATA_HOME") or str(Path.home() / ".local" / "share")
+        d = Path(base) / "touchlab" / "license_server"
+    d.mkdir(parents=True, exist_ok=True, mode=0o700)
+    return d
+
+
+def socket_path() -> Path:
+    """Unix socket the server listens on (Linux)."""
+    return runtime_dir() / "license.sock"
+
+
+def port_path() -> Path:
+    """File holding the 127.0.0.1 TCP port the server listens on (Windows)."""
+    return runtime_dir() / "license.port"
+
+
+def db_path() -> Path:
+    return data_dir() / "licenses.db"
+
+
+def pid_path() -> Path:
+    return runtime_dir() / "server.pid"
+
+
+def log_path() -> Path:
+    return data_dir() / "server.log"

touchlab_license_server/protocol.py

@@ -0,0 +1,72 @@
+"""Wire format for the license server IPC channel.
+
+Plain length-prefixed JSON over a Unix domain socket — no HTTP stack needed
+for a link that never leaves the local machine. One frame = 4-byte
+big-endian length prefix + UTF-8 JSON body.
+"""
+
+import json
+import socket
+import struct
+from typing import Optional
+
+MAX_FRAME_BYTES = 1 * 1024 * 1024  # signed bundles are small; guards against a wedged peer
+
+REGISTER = "REGISTER"  # {license} -> {ok, sn, expires_at} | {ok: false, error}
+CHECK = "CHECK"  # {serials: [sn, ...]} -> {sn: {licensed, expires_at, days_remaining?, reason}, ...}
+LIST = "LIST"  # {} -> {licenses: [{sn, expires_at}, ...]}
+PING = "PING"  # {} -> {ok: true}
+SYNC = "SYNC"  # {} -> {ok: true, imported: [sn, ...]} — re-scan LICENSE_DIR now
+
+
+class ProtocolError(Exception):
+    pass
+
+
+def pack(obj: dict) -> bytes:
+    body = json.dumps(obj).encode("utf-8")
+    if len(body) > MAX_FRAME_BYTES:
+        raise ProtocolError(f"frame too large: {len(body)} bytes")
+    return struct.pack(">I", len(body)) + body
+
+
+def _recv_exact(sock: socket.socket, n: int) -> Optional[bytes]:
+    buf = bytearray()
+    while len(buf) < n:
+        chunk = sock.recv(n - len(buf))
+        if not chunk:
+            return None
+        buf.extend(chunk)
+    return bytes(buf)
+
+
+def recv(sock: socket.socket) -> Optional[dict]:
+    """Blocking read of one frame from a plain socket. None on clean EOF."""
+    header = _recv_exact(sock, 4)
+    if header is None:
+        return None
+    (length,) = struct.unpack(">I", header)
+    if length > MAX_FRAME_BYTES:
+        raise ProtocolError(f"frame too large: {length} bytes")
+    body = _recv_exact(sock, length)
+    if body is None:
+        raise ProtocolError("connection closed mid-frame")
+    return json.loads(body.decode("utf-8"))
+
+
+def request(sock: socket.socket, action: str, **fields) -> dict:
+    sock.sendall(pack({"action": action, **fields}))
+    resp = recv(sock)
+    if resp is None:
+        raise ProtocolError("server closed connection without responding")
+    return resp
+
+
+async def recv_async(reader) -> Optional[dict]:
+    """Same framing, for asyncio.StreamReader on the server side."""
+    header = await reader.readexactly(4)
+    (length,) = struct.unpack(">I", header)
+    if length > MAX_FRAME_BYTES:
+        raise ProtocolError(f"frame too large: {length} bytes")
+    body = await reader.readexactly(length)
+    return json.loads(body.decode("utf-8"))

touchlab_license_server/resources/touchlab-license-server.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Touchlab local license server
+After=default.target
+
+[Service]
+Type=simple
+ExecStart=touchlab-license-server start --foreground
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=default.target

touchlab_license_server/server.py

@@ -0,0 +1,95 @@
+"""Unix-socket daemon: verifies and stores signed licenses, answers CHECK
+queries for connected fingertip serials.
+
+Also periodically re-scans importer.LICENSE_DIR so licenses written by the
+locked `touchlab-activate` console script get picked up automatically —
+this server never needs to be in the activation path to stay in sync.
+
+One process per user, listening locally only (see transport.py). No network exposure.
+"""
+
+import asyncio
+import logging
+
+from . import crypto, importer, paths, protocol, store, transport
+
+log = logging.getLogger("touchlab_license_server")
+
+_IMPORT_INTERVAL_SEC = 5.0
+
+
+class LicenseServer:
+    def __init__(self, db_path=None, socket_path=None):
+        self._db_path = db_path or paths.db_path()
+        self._socket_path = socket_path or paths.socket_path()
+        self._conn = store.open_store(self._db_path)
+
+    def _sync(self) -> list:
+        imported = importer.scan_and_import(self._conn)
+        if imported:
+            log.info("synced from %s: %s", importer.LICENSE_DIR, imported)
+        return imported
+
+    async def _handle_client(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter):
+        try:
+            while True:
+                try:
+                    msg = await protocol.recv_async(reader)
+                except asyncio.IncompleteReadError:
+                    break  # clean disconnect
+                resp = self._dispatch(msg)
+                writer.write(protocol.pack(resp))
+                await writer.drain()
+        except (protocol.ProtocolError, ConnectionResetError) as exc:
+            log.warning("dropping client: %s", exc)
+        finally:
+            writer.close()
+
+    def _dispatch(self, msg: dict) -> dict:
+        action = msg.get("action")
+        try:
+            if action == protocol.PING:
+                return {"ok": True}
+
+            if action == protocol.REGISTER:
+                result = store.register(self._conn, msg["license"])
+                log.info("registered sn=%s expires_at=%s", result["sn"], result["expires_at"])
+                return {"ok": True, **result}
+
+            if action == protocol.CHECK:
+                serials = msg.get("serials", [])
+                return {"ok": True, "results": store.check(self._conn, serials)}
+
+            if action == protocol.LIST:
+                return {"ok": True, "licenses": store.list_all(self._conn)}
+
+            if action == protocol.SYNC:
+                return {"ok": True, "imported": self._sync()}
+
+            return {"ok": False, "error": f"unknown action: {action!r}"}
+        except crypto.InvalidLicense as exc:
+            return {"ok": False, "error": str(exc)}
+        except KeyError as exc:
+            return {"ok": False, "error": f"missing field: {exc}"}
+
+    async def _sync_loop(self):
+        while True:
+            await asyncio.sleep(_IMPORT_INTERVAL_SEC)
+            self._sync()
+
+    async def run(self):
+        self._sync()  # pick up anything already activated before this server started
+
+        server = await transport.start_server(self._handle_client, self._socket_path)
+        log.info("listening on %s (db=%s)", transport.describe(), self._db_path)
+
+        async with server:
+            sync_task = asyncio.create_task(self._sync_loop())
+            try:
+                await server.serve_forever()
+            finally:
+                sync_task.cancel()
+
+
+def main_async(db_path=None, socket_path=None):
+    asyncio.run(LicenseServer(db_path, socket_path).run())

touchlab_license_server/store.py

@@ -0,0 +1,104 @@
+"""sqlite-backed license storage.
+
+The `expires_at` column exists only for fast lookup and `LIST` output — it
+is never the basis for a licensing decision. Every `CHECK` re-verifies the
+stored license's signature and re-derives expiry from the verified fields,
+so hand-editing a row in the database (e.g. via the sqlite3 CLI) has no
+effect: the edited column is simply not read for the yes/no decision.
+"""
+
+import json
+import math
+import sqlite3
+from datetime import datetime, timezone
+from pathlib import Path
+
+from . import crypto
+
+_SCHEMA = """
+CREATE TABLE IF NOT EXISTS licenses (
+    sn            TEXT PRIMARY KEY,
+    license_json  TEXT NOT NULL,
+    expires_at    TEXT,
+    imported_at   TEXT NOT NULL
+);
+"""
+
+
+def open_store(path: Path) -> sqlite3.Connection:
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    conn = sqlite3.connect(str(path))
+    conn.execute(_SCHEMA)
+    conn.commit()
+    try:
+        path.chmod(0o600)
+    except OSError:
+        pass
+    return conn
+
+
+def _parse_expiry(expires_at: str) -> datetime:
+    return datetime.fromisoformat(expires_at.replace("Z", "+00:00"))
+
+
+def register(conn: sqlite3.Connection, license: dict) -> dict:
+    """Verify a license dict's signature and (re)store it under its serial number.
+
+    Raises crypto.InvalidLicense on a bad/missing signature. Returns {sn, expires_at}.
+    """
+    crypto.verify_license(license)
+    sn = license["sn"]
+    expires_at = license.get("expires_at")
+
+    conn.execute(
+        """
+        INSERT INTO licenses (sn, license_json, expires_at, imported_at)
+        VALUES (?, ?, ?, ?)
+        ON CONFLICT(sn) DO UPDATE SET
+            license_json = excluded.license_json,
+            expires_at   = excluded.expires_at,
+            imported_at  = excluded.imported_at
+        """,
+        (sn, json.dumps(license), expires_at, datetime.now(timezone.utc).isoformat()),
+    )
+    conn.commit()
+    return {"sn": sn, "expires_at": expires_at}
+
+
+def _check_one(conn: sqlite3.Connection, sn: str) -> dict:
+    row = conn.execute("SELECT license_json FROM licenses WHERE sn = ?", (sn,)).fetchone()
+    if row is None:
+        return {"licensed": False, "expires_at": None, "reason": "not_registered"}
+
+    license = json.loads(row[0])
+    try:
+        crypto.verify_license(license)
+    except crypto.InvalidLicense:
+        # Stored license no longer verifies (e.g. the row was hand-edited) — dead entry.
+        return {"licensed": False, "expires_at": None, "reason": "invalid_signature"}
+
+    if license.get("sn") != sn:
+        return {"licensed": False, "expires_at": None, "reason": "sn_mismatch"}
+
+    expires_at = license.get("expires_at")
+    days_remaining = None  # None = perpetual
+    if expires_at:
+        try:
+            remaining = _parse_expiry(expires_at) - datetime.now(timezone.utc)
+        except ValueError:
+            return {"licensed": False, "expires_at": expires_at, "reason": "bad_expiry_format"}
+        if remaining.total_seconds() <= 0:
+            return {"licensed": False, "expires_at": expires_at, "reason": "expired"}
+        # Round up: a 7-day license is "7 days left" right after activation.
+        days_remaining = math.ceil(remaining.total_seconds() / 86400)
+
+    return {"licensed": True, "expires_at": expires_at, "days_remaining": days_remaining, "reason": "ok"}
+
+
+def check(conn: sqlite3.Connection, serials: list) -> dict:
+    return {sn: _check_one(conn, sn) for sn in serials}
+
+
+def list_all(conn: sqlite3.Connection) -> list:
+    rows = conn.execute("SELECT sn FROM licenses ORDER BY sn").fetchall()
+    return [{"sn": sn, **_check_one(conn, sn)} for (sn,) in rows]

touchlab_license_server/transport.py

@@ -0,0 +1,56 @@
+"""How clients reach the license server.
+
+Linux: a Unix socket in the user's runtime dir (mode 0600, so only this user
+can open it). Windows has no Unix sockets in Python, so there the server
+listens on a 127.0.0.1 TCP port -- never reachable from the network -- and
+writes the port number to paths.port_path() for clients to read.
+"""
+
+import asyncio
+import os
+import socket
+
+from . import paths
+
+
+def connect(timeout: float = 2.0) -> socket.socket:
+    """Connected socket to the server. Raises OSError if it isn't running."""
+    if paths.WINDOWS:
+        try:
+            port = int(paths.port_path().read_text().strip())
+        except (OSError, ValueError) as exc:
+            raise ConnectionRefusedError(f"license server port unknown: {exc}") from exc
+        return socket.create_connection(("127.0.0.1", port), timeout=timeout)
+    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    sock.settimeout(timeout)
+    try:
+        sock.connect(str(paths.socket_path()))
+    except OSError:
+        sock.close()
+        raise
+    return sock
+
+
+async def start_server(handler, socket_path=None):
+    """Start listening. Returns the asyncio server."""
+    if paths.WINDOWS:
+        server = await asyncio.start_server(handler, host="127.0.0.1", port=0)
+        port = server.sockets[0].getsockname()[1]
+        paths.port_path().write_text(str(port))
+        return server
+    socket_path = socket_path or paths.socket_path()
+    if socket_path.exists():
+        socket_path.unlink()  # left behind by a server that didn't shut down cleanly
+    server = await asyncio.start_unix_server(handler, path=str(socket_path))
+    os.chmod(socket_path, 0o600)
+    return server
+
+
+def describe() -> str:
+    """Where the server listens, for status messages."""
+    if paths.WINDOWS:
+        try:
+            return f"127.0.0.1:{paths.port_path().read_text().strip()}"
+        except OSError:
+            return "127.0.0.1 (port unknown)"
+    return f"socket: {paths.socket_path()}"

touchlab_license_server-1.0.0.dist-info/METADATA

@@ -0,0 +1,77 @@
+Metadata-Version: 2.4
+Name: touchlab-license-server
+Version: 1.0.0
+Summary: Local license check service for touchlab-slip-model: which fingertips are licensed and how many days are left
+Author-email: Touchlab Limited <abi@touchlab.io>
+License-Expression: LicenseRef-Touchlab-Proprietary
+Project-URL: Homepage, https://touchlab.io
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Science/Research
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=41
+Dynamic: license-file
+
+# touchlab-license-server
+
+The local license check for
+[`touchlab-slip-model`](https://pypi.org/project/touchlab-slip-model/). It
+is installed automatically with that package; you don't need to install it
+yourself.
+
+Before each run, `touchlab-slip-detect` asks it which connected fingertips
+are licensed and how many days each license has left. It runs as a small
+background service for your user, starts on its own when needed, and only
+listens on a local socket, never on the network.
+
+## Commands
+
+```bash
+touchlab-license-server list     # every license, whether it's valid, days left
+touchlab-license-server status   # is the service running?
+touchlab-license-server sync     # re-read the license folder now
+touchlab-license-server stop     # stop the service
+```
+
+`list` output:
+
+```
+TL50140B9E...  licensed=True  expires_at=2026-12-25T10:00:00Z  (88 day(s) left)
+```
+
+Every check re-verifies the license's signature, so editing a license file
+can't make it valid.
+
+On Linux, to start the service at login instead of on first use:
+
+```bash
+touchlab-license-server install-service
+systemctl --user daemon-reload
+systemctl --user enable --now touchlab-license-server
+```
+
+It listens on a Unix socket on Linux, and on a `127.0.0.1` port on Windows.
+
+Logs: `~/.local/share/touchlab/license_server/server.log` on Linux,
+`%LOCALAPPDATA%\touchlab\license_server\server.log` on Windows.
+
+## Support
+
+support@touchlab.io
+
+This software is proprietary; use is governed by the license agreement in
+`LICENSE`.
+
+Copyright (c) 2026 Touchlab Limited. All Rights Reserved.

touchlab_license_server-1.0.0.dist-info/RECORD

@@ -0,0 +1,17 @@
+touchlab_license_server/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+touchlab_license_server/cli.py,sha256=1YRtQ_KkxLLuCTdwnz6dLEchFCPC2kw0ZpPbbWRvfQ4,6418
+touchlab_license_server/client.py,sha256=GUiuGHBvmCdIczNAv7Ldtw5e9SEanIszLS9TuPMzNo0,3584
+touchlab_license_server/crypto.py,sha256=Eu2xMApnuVi_bgmjtjrwk-klrnPSb9yGT5C5AdhVN2c,2456
+touchlab_license_server/importer.py,sha256=5FtNfjoq7rx643bviThyD6zFFoT4pBCDMuq5M2scgMU,1682
+touchlab_license_server/paths.py,sha256=LSzBKQO8b3tLCmTdyESKCV_d2CYT9NOyidYWvGGsC9A,1476
+touchlab_license_server/protocol.py,sha256=yjy8bRM4GW695rMQhOhu4SLd_1N9ilQFeT72UiGDiUg,2431
+touchlab_license_server/server.py,sha256=WMuYAxtj1ElLv9zzhtZy-gU03ZReVRHtOT2jCoZs9mk,3480
+touchlab_license_server/store.py,sha256=Fw5-PJbq8VWL8N41mtPOCFvzumBoh1dn5MUVUvl9SfI,3629
+touchlab_license_server/transport.py,sha256=1ZyeO_0oYGuCpu14Nw8RCY2xninVz0ueo5gvhbCPSlw,1983
+touchlab_license_server/resources/touchlab-license-server.service,sha256=EWzLpw1GiFu2bHzeyFe0Nr0MWfsXOWvU6zdCmY8tYfQ,213
+touchlab_license_server-1.0.0.dist-info/licenses/LICENSE,sha256=fWsf4oEZ7mpBH5vRWHTI11d2Yl6OZtDONV_6XOOJf8w,4630
+touchlab_license_server-1.0.0.dist-info/METADATA,sha256=aROq1UsIb48nIjDd3zijaWIx_f3ZvuSUawRcC4AMfQY,2720
+touchlab_license_server-1.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+touchlab_license_server-1.0.0.dist-info/entry_points.txt,sha256=xIucovAc_ewswhOMfA0Mee9jYPswdlQKjf-ioyFhEe0,77
+touchlab_license_server-1.0.0.dist-info/top_level.txt,sha256=Mho6GSH_i3iqphpDZqs9CIE5XXDh6H3YH79WmFOXmso,24
+touchlab_license_server-1.0.0.dist-info/RECORD,,

touchlab_license_server-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

touchlab_license_server-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+touchlab-license-server = touchlab_license_server.cli:main

touchlab_license_server-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,76 @@
+PROPRIETARY SOFTWARE LICENSE AGREEMENT: IMPORTANT : READ CAREFULLY
+By downloading, installing or using Touchlab Limited software products
+contained herein, you indicate your acceptance of and agree to be bound by the terms
+
+and conditions of this Proprietary Software License Agreement. These terms and
+conditions are a legal agreement between the Licensee (you) and Licensor (Touchlab Limited).
+
+IF YOU DO NOT AGREE TO THESE TERMS AND CONDITIONS, DO NOT
+INSTALL, COPY OR USE THE SOFTWARE.
+
+LICENSE. Subject to the provisions contained herein, Touchlab Limited grants to you a non-
+
+exclusive, non-transferable license to use the Software contained herein. You are
+authorized to use the SOFTWARE only for your own use.
+
+DISCLAIMER OF WARRANTIES: YOU AGREE THAT TOUCHLAB LIMITED HAS MADE NO
+EXPRESS WARRANTIES TO YOU REGARDING THE SOFTWARE AND THAT
+THE SOFTWARE IS BEING PROVIDED TO YOU "AS IS" WITHOUT WARRANTY
+OF ANY KIND. TOUCHLAB LIMITED DISCLAIMS ALL WARRANTIES WITH REGARD TO
+THE SOFTWARE, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION,
+ANY IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE,
+MERCHANTABILITY, MERCHANTABLE QUALITY OR NONINFRINGEMENT OF
+THIRD PARTY RIGHTS. In the case where a state or jurisdiction does not allow the
+exclusion of implied warranties, the above limitations may not apply.
+
+LIMIT OF LIABILITY: IN NO EVENT WILL TOUCHLAB LIMITED BE LIABLE TO YOU FOR
+ANY LOSS OF USE, INTERRUPTION OF BUSINESS, OR ANY DIRECT,
+INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY
+KIND (INCLUDING LOST PROFITS) REGARDLESS OF THE FORM OF ACTION
+WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT
+PRODUCT LIABILITY OR OTHERWISE, EVEN IF TOUCHLAB LIMITED HAS BEEN ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGES. In the case where a state or jurisdiction
+does not allow the exclusion of incidental or consequential damages, the above
+limitations may not apply.
+
+PROTECTION. NOTWITHSTANDING ANY COPYRIGHT NOTICES, THE
+SOFTWARE CONTAINS TRADE SECRETS AND CONFIDENTIAL INFORMATION
+OF TOUCHLAB LIMITED AND ITS SUPPLIERS. THE LICENSEE AGREES NOT TO REVERSE
+COMPILE, REVERSE ENGINEER, DISASSEMBLE, OR MODIFY THE SOFTWARE.
+THE SOFTWARE MAY NOT BE RENTED OR LEASED. THE SOFTWARE MAY
+NOT BE INCORPORATED INTO OR BUNDLED WITH ANY OTHER PRODUCT
+SUCH THAT THE SOFTWARE CEASES TO BE A STAND-ALONE PRODUCT.
+
+
+EXPORT PROVISION.  Licensee acknowledges that the export of the Software is
+subject to Licensor receiving the necessary licenses or approvals for export from the
+United Kingdom.  Licensee agrees that regardless of any disclosure made by Licensee to
+Licensor of an ultimate destination of the SOFTWARE, Licensee will not re-export
+directly or indirectly the SOFTWARE, without first obtaining a license from the United
+Kingdom Government, as required. Licensee shall provide Touchlab Limited with any information,
+certifications or other documents which Licensor may require in connection with the
+export of the SOFTWARE, or any portions or parts thereof, as amended, and the rules and regulations promulgated
+thereunder.
+
+SUCCESSORS AND ASSIGNS.  The Agreement shall be binding on and inure to the
+benefit of the parties, their successors, permitted assigns and legal representatives.
+Licensee may not assign this Agreement without Licensors prior written consent.
+
+TITLE.  This Agreement grants Licensee no title or rights of or to ownership in the
+SOFTWARE or documentation or any corrections, improvements or revisions furnished.
+THIS AGREEMENT DOES NOT INCLUDE THE RIGHT TO SUBLICENSE.
+
+RELIEF.  Licensee acknowledges that any violation of this Agreement by Licensee will
+cause irreparable injury to Licensor, and Licensor shall be entitled to injunctive relief.
+
+GENERAL.  This Agreement merges all prior written and oral communications and
+defines the entire Agreement of the parties concerning the SOFTWARE. All notices
+required under this Agreement or pertaining to modifications to this Agreement shall be
+in writing, including facsimile copies, however, excluding all variations of Electronic
+Mail, and shall be considered given upon personal delivery of the written notice or within
+five (5) days of mailing, postage prepaid and appropriately addressed. This Agreement
+shall be construed in accordance with laws of the Scotland, United Kingdom
+without regard to its conflicts of laws provisions. The failure by either party
+at any time to enforce its rights under this Agreement will not be construed as a waiver of
+such rights, nor will it in any way affect the validity of this Agreement. No waiver by
+either party will be valid unless given in an appropriate writing signed by both parties.

touchlab_license_server-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+touchlab_license_server