bonaminandClaude Opus 5.5
96a014ecbe
Sites now enforce their license offline (client-services KI-006): the
cloud is needed to renew a license, not to run it. Each heartbeat carries
license_token = base64url(payload).base64url(signature), payload
{v:1, site_id, active, locked, lock_reason, expires_at, issued_at}, signed
with LICENSE_SIGNING_KEY (base64 raw Ed25519 private key, cloud .env). The
matching public key is built into the site code, so a stored token can't be
edited and a clock can't be set before issued_at unnoticed.
Additive field only (old sites ignore it). Without the key the field is
null and a warning is logged. Pins cryptography==46.0.4 (was transitive).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
46 lines
1.6 KiB
Python
46 lines
1.6 KiB
Python
from datetime import datetime, timezone
|
|
from fastapi import APIRouter, Depends, HTTPException, Header, Request, status
|
|
from passlib.context import CryptContext
|
|
from sqlalchemy.orm import Session
|
|
|
|
from config import settings
|
|
from database import get_db
|
|
from models.site import Site
|
|
from schemas.site import HeartbeatRequest, HeartbeatResponse
|
|
from services.license_token import issue_license_token
|
|
|
|
router = APIRouter()
|
|
_pwd = CryptContext(schemes=["bcrypt"], deprecated="auto")
|
|
|
|
|
|
@router.post("/", response_model=HeartbeatResponse)
|
|
def heartbeat(
|
|
body: HeartbeatRequest,
|
|
request: Request,
|
|
x_site_id: str = Header(..., alias="X-Site-ID"),
|
|
x_site_key: str = Header(..., alias="X-Site-Key"),
|
|
db: Session = Depends(get_db),
|
|
):
|
|
site = db.query(Site).filter(Site.site_id == x_site_id).first()
|
|
if not site or not _pwd.verify(x_site_key, site.secret_key_hash):
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid site credentials")
|
|
|
|
now = datetime.now(timezone.utc)
|
|
site.last_seen_at = now
|
|
site.last_seen_ip = request.client.host if request.client else None
|
|
if body.local_ip:
|
|
site.last_seen_local_ip = body.local_ip
|
|
db.commit()
|
|
|
|
licensed = site.is_active and (site.license_expires_at.replace(tzinfo=timezone.utc) > now)
|
|
return HeartbeatResponse(
|
|
licensed=licensed,
|
|
locked=site.is_locked,
|
|
lock_reason=site.lock_reason,
|
|
expires_at=site.license_expires_at,
|
|
latest_version=settings.LATEST_VERSION,
|
|
waiter_domain=site.waiter_domain,
|
|
site_numeric_id=site.id,
|
|
license_token=issue_license_token(site, now),
|
|
)
|