bonaminandClaude Opus 5.5
96a014ecbe
Sites now enforce their license offline (client-services KI-006): the
cloud is needed to renew a license, not to run it. Each heartbeat carries
license_token = base64url(payload).base64url(signature), payload
{v:1, site_id, active, locked, lock_reason, expires_at, issued_at}, signed
with LICENSE_SIGNING_KEY (base64 raw Ed25519 private key, cloud .env). The
matching public key is built into the site code, so a stored token can't be
edited and a clock can't be set before issued_at unnoticed.
Additive field only (old sites ignore it). Without the key the field is
null and a warning is logged. Pins cryptography==46.0.4 (was transitive).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
12 lines
232 B
Plaintext
12 lines
232 B
Plaintext
fastapi==0.115.0
|
|
uvicorn[standard]==0.30.6
|
|
sqlalchemy==2.0.35
|
|
pydantic==2.9.2
|
|
pydantic-settings==2.5.2
|
|
python-jose[cryptography]==3.3.0
|
|
passlib[bcrypt]==1.7.4
|
|
bcrypt==4.0.1
|
|
python-multipart==0.0.9
|
|
httpx==0.27.2
|
|
cryptography==46.0.4
|