v0.4: licensing — server validation, DPAPI cache, Ed25519 signed responses

UX bonus: clicking "Reprendre" on an interrupted download skips the release-notes confirmation dialog (the user already approved when they first clicked Installer). Server side ----------- - migrations/001_init.sql: licenses, license_machines, rate_limit, audit_log on InnoDB/utf8mb4. Foreign keys, unique on license_key, slot uniqueness per (license_id, machine_id). - api/lib/Db.php: thin PDO singleton (exception mode, prepared, no emul). - api/lib/Crypto.php: Ed25519 sign/verify via libsodium (sodium_crypto_*), HMAC-SHA-256 helper for v0.6, canonicalJson() that strips `signature` before serializing — must match exactly the encoding done client-side before verify. - api/routes/ValidateLicense.php: POST /license/validate. Looks up the key, walks the machine slot logic (insert or update last_seen), enforces max_machines, returns a payload signed Ed25519 + status of valid/expired/revoked/machine_limit_exceeded/invalid. Audit logs every outcome. Rate-limit 10/min/IP via the rate_limit table. - tools/generate-keypair.php: prints a fresh sodium keypair so the operator drops the hex into config.php and the public_key_hex into the launcher resource. - tools/issue-license.php: PRSRV-XXXX-XXXX-XXXX-XXXX generator (32-char unambiguous alphabet), inserts the license, prints the key once. - tools/sign-manifest.php: now also signs the manifest itself with Ed25519 after computing the per-zip sha256s. - config.example.php: schema rewritten with sections db / hmac / ed25519 / jwt / rate-limit. config.php remains gitignored. Client side ----------- - Models/License.cs: LicenseValidationRequest + LicenseValidationResponse with CanDownload(VersionManifest) — entitlement_until vs version's minLicenseDate. The status valid|expired|revoked|machine_limit_exceeded flow is preserved end-to-end. - Core/Licensing/LicenseService.cs: * machineId = SHA-256 of HKLM/Software/Microsoft/Cryptography/MachineGuid + UserName (stable, no PII leak) * online ValidateAsync calls /license/validate with launcher version * embedded server-pubkey.txt drives Ed25519 verification of the response (skipped gracefully if pubkey not yet provisioned) * SaveCached / GetCached use DPAPI CurrentUser scope on the license key; the cleartext key never touches disk * GetCached has a 7-day offline grace window after the last successful validation, so going offline doesn't lock the user out - Core/Resources/server-pubkey.txt: EmbeddedResource. Default content is a comment, which the service treats as "no pubkey configured" and bypasses verification. Operator pastes the real hex post-deploy and rebuilds. - Core/PSLauncher.Core.csproj: Polly, NSec.Cryptography (Ed25519), System.Security.Cryptography.ProtectedData (DPAPI). - App/Views/OnboardingDialog.xaml(.cs): first-launch / "🔑 Activer" modal. Calls LicenseService, displays status messages with red foreground on errors and green-tinted secondary text otherwise. - ViewModels/VersionRowViewModel.cs: new LicenseAllowsDownload property. Install button label switches to "🔒 License insuffisante" when the user's entitlement_until precedes the version's minLicenseDate; CanInstall is false in that case so the click is a no-op too. - ViewModels/MainViewModel.cs: loads the cached license at startup (no network call), surfaces it as LicenseSummary in the top bar, exposes ActivateLicenseCommand to (re)open the onboarding dialog. RebuildList applies the per-version license filter so older installed versions remain launchable but newer-than-license ones can't be downloaded. - Views/MainWindow.xaml: top bar gains a "🔑 Activer / changer" button next to the license summary. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-01 10:12:37 +02:00
parent 9bdcdabb9e
commit 7a29dbb049
20 changed files with 977 additions and 34 deletions
--- a/src/PSLauncher.App/App.xaml.cs
+++ b/src/PSLauncher.App/App.xaml.cs
@@ -10,6 +10,7 @@ using PSLauncher.Core.Configuration;
 using PSLauncher.Core.Downloads;
 using PSLauncher.Core.Installations;
 using PSLauncher.Core.Integrity;
+using PSLauncher.Core.Licensing;
 using PSLauncher.Core.Manifests;
 using PSLauncher.Core.Process;
 using PSLauncher.Core.Updates;
@@ -66,6 +67,14 @@ public partial class App : Application
                services.AddSingleton<IDownloadManager, DownloadManager>();
                services.AddSingleton<IUpdateChecker, UpdateChecker>();

+                services.AddSingleton<ILicenseService>(sp =>
+                    new LicenseService(
+                        sp.GetRequiredService<HttpClient>(),
+                        () => sp.GetRequiredService<LocalConfig>().ServerBaseUrl,
+                        sp.GetRequiredService<IConfigStore>(),
+                        sp.GetRequiredService<LocalConfig>(),
+                        sp.GetRequiredService<ILogger<LicenseService>>()));
+
                services.AddSingleton<MainViewModel>();
                services.AddSingleton<MainWindow>();
            })
--- a/src/PSLauncher.App/ViewModels/MainViewModel.cs
+++ b/src/PSLauncher.App/ViewModels/MainViewModel.cs
@@ -9,6 +9,7 @@ using PSLauncher.App.Views;
 using PSLauncher.Core.Configuration;
 using PSLauncher.Core.Downloads;
 using PSLauncher.Core.Installations;
+using PSLauncher.Core.Licensing;
 using PSLauncher.Core.Manifests;
 using PSLauncher.Core.Process;
 using PSLauncher.Core.Updates;
@@ -26,8 +27,11 @@ public sealed partial class MainViewModel : ObservableObject
    private readonly IUpdateChecker _updateChecker;
    private readonly IDownloadManager _downloadManager;
    private readonly IZipInstaller _zipInstaller;
+    private readonly ILicenseService _licenseService;
    private readonly ILogger<MainViewModel> _logger;

+    private LicenseValidationResponse? _license;
+
    private RemoteManifest? _lastManifest;
    private CancellationTokenSource? _activeDownloadCts;
    private VersionRowViewModel? _activeRow;
@@ -57,7 +61,18 @@ public sealed partial class MainViewModel : ObservableObject
    [ObservableProperty] private double _progressPercent;
    [ObservableProperty] private string? _progressDetail;

-    public string LicenseSummary => "License : non configurée (v0.4)";
+    public string LicenseSummary
+    {
+        get
+        {
+            if (_license is null) return "License : non configurée";
+            if (_license.Status == "valid")
+                return $"License : {_license.OwnerName} • exp. {_license.DownloadEntitlementUntil:dd/MM/yyyy}";
+            if (_license.Status == "expired")
+                return $"License expirée le {_license.DownloadEntitlementUntil:dd/MM/yyyy}";
+            return $"License : {_license.Status}";
+        }
+    }

    public string EmptyHint =>
        "Aucune version locale ni distante.\n" +
@@ -85,6 +100,7 @@ public sealed partial class MainViewModel : ObservableObject
        IUpdateChecker updateChecker,
        IDownloadManager downloadManager,
        IZipInstaller zipInstaller,
+        ILicenseService licenseService,
        ILogger<MainViewModel> logger)
    {
        _registry = registry;
@@ -95,7 +111,13 @@ public sealed partial class MainViewModel : ObservableObject
        _updateChecker = updateChecker;
        _downloadManager = downloadManager;
        _zipInstaller = zipInstaller;
+        _licenseService = licenseService;
        _logger = logger;
+
+        // Charge la license depuis le cache (pas d'appel réseau au démarrage,
+        // ça reste rapide ; un refresh proactif arrive dès qu'on clique « Vérifier les MAJ »)
+        _license = _licenseService.GetCached();
+
        RebuildList();
    }

@@ -131,10 +153,15 @@ public sealed partial class MainViewModel : ObservableObject
        }

        // Marque les rows distantes qui ont un DL en pause (partial + state.json présents)
+        // et applique le filtre license
        foreach (var r in rows.Where(r => r.IsRemoteOnly))
        {
            var st = _downloadManager.GetResumableState(r.Version);
            if (st is not null) r.ResumableBytes = st.DownloadedBytes;
+
+            // License : la version est-elle téléchargeable selon notre entitlement ?
+            r.LicenseAllowsDownload = r.Remote is not null
+                && _licenseService.CanDownloadVersion(_license, r.Remote);
        }

        // Featured : plus haute installée, sinon plus haute distante
@@ -199,6 +226,20 @@ public sealed partial class MainViewModel : ObservableObject
    }
    private bool CanCheckUpdates() => !IsBusy;

+    [RelayCommand]
+    private async Task ActivateLicenseAsync()
+    {
+        var dialog = new Views.OnboardingDialog(_licenseService) { Owner = Application.Current.MainWindow };
+        dialog.ShowDialog();
+        if (dialog.LicenseActivated)
+        {
+            _license = _licenseService.GetCached();
+            OnPropertyChanged(nameof(LicenseSummary));
+            RebuildList();
+        }
+        await Task.CompletedTask;
+    }
+
    [RelayCommand]
    private void OpenInstallRoot()
    {
@@ -245,21 +286,28 @@ public sealed partial class MainViewModel : ObservableObject

        try
        {
-            // 1) Récupère release notes (best effort)
-            string notes = "_Aucune release note fournie._";
-            if (!string.IsNullOrEmpty(row.Remote.ReleaseNotesUrl))
-            {
-                try
-                {
-                    notes = await _manifestService.FetchReleaseNotesAsync(row.Remote.ReleaseNotesUrl, ct);
-                }
-                catch (Exception ex) { _logger.LogWarning(ex, "Release notes fetch failed"); notes = "_Release notes indisponibles._"; }
-            }
+            // Si reprise d'un DL interrompu, on saute la popup de release notes :
+            // l'utilisateur a déjà confirmé sa décision la première fois.
+            var isResume = row.HasResumableDownload;

-            // 2) Dialog de confirmation avec release notes
-            var dialog = new UpdateAvailableDialog(row.Remote, notes) { Owner = Application.Current.MainWindow };
-            dialog.ShowDialog();
-            if (!dialog.DownloadRequested) return;
+            if (!isResume)
+            {
+                // 1) Récupère release notes (best effort)
+                string notes = "_Aucune release note fournie._";
+                if (!string.IsNullOrEmpty(row.Remote.ReleaseNotesUrl))
+                {
+                    try
+                    {
+                        notes = await _manifestService.FetchReleaseNotesAsync(row.Remote.ReleaseNotesUrl, ct);
+                    }
+                    catch (Exception ex) { _logger.LogWarning(ex, "Release notes fetch failed"); notes = "_Release notes indisponibles._"; }
+                }
+
+                // 2) Dialog de confirmation avec release notes
+                var dialog = new UpdateAvailableDialog(row.Remote, notes) { Owner = Application.Current.MainWindow };
+                dialog.ShowDialog();
+                if (!dialog.DownloadRequested) return;
+            }

            // 3) Download
            row.State = VersionRowState.Downloading;
--- a/src/PSLauncher.App/ViewModels/VersionRowViewModel.cs
+++ b/src/PSLauncher.App/ViewModels/VersionRowViewModel.cs
@@ -42,12 +42,20 @@ public sealed partial class VersionRowViewModel : ObservableObject
    [NotifyPropertyChangedFor(nameof(HasResumableDownload))]
    private long _resumableBytes;

+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(InstallButtonLabel))]
+    [NotifyPropertyChangedFor(nameof(LicenseAllowsInstall))]
+    [NotifyCanExecuteChangedFor(nameof(InstallCommand))]
+    private bool _licenseAllowsDownload = true;
+
    public bool HasResumableDownload => ResumableBytes > 0;
+    public bool LicenseAllowsInstall => LicenseAllowsDownload;

    public string InstallButtonLabel
    {
        get
        {
+            if (!LicenseAllowsDownload) return "🔒  License insuffisante";
            if (!HasResumableDownload) return "⬇  Installer";
            if (Remote is null || Remote.Download.SizeBytes <= 0) return "↻  Reprendre";
            var pct = (double)ResumableBytes / Remote.Download.SizeBytes * 100.0;
@@ -133,7 +141,7 @@ public sealed partial class VersionRowViewModel : ObservableObject

    [RelayCommand(CanExecute = nameof(CanInstall))]
    private void Install() => InstallHandler?.Invoke(this);
-    private bool CanInstall() => State == VersionRowState.AvailableIdle;
+    private bool CanInstall() => State == VersionRowState.AvailableIdle && LicenseAllowsDownload;

    [RelayCommand(CanExecute = nameof(CanUninstall))]
    private void Uninstall() => UninstallHandler?.Invoke(this);
--- a/src/PSLauncher.App/Views/MainWindow.xaml
+++ b/src/PSLauncher.App/Views/MainWindow.xaml
@@ -172,7 +172,10 @@
                            Margin="0,0,12,0" />
                    <TextBlock Text="{Binding LicenseSummary}"
                               Foreground="{StaticResource Brush.Text.Secondary}"
-                               VerticalAlignment="Center" />
+                               VerticalAlignment="Center" Margin="0,0,8,0" />
+                    <Button Style="{StaticResource SecondaryButton}"
+                            Content="🔑  Activer / changer"
+                            Command="{Binding ActivateLicenseCommand}" />
                </StackPanel>
            </Grid>
        </Border>
--- a/src/PSLauncher.App/Views/OnboardingDialog.xaml
+++ b/src/PSLauncher.App/Views/OnboardingDialog.xaml
@@ -0,0 +1,66 @@
+<Window x:Class="PSLauncher.App.Views.OnboardingDialog"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        Title="Activation PROSERVE Launcher"
+        Width="540" Height="420"
+        MinWidth="480" MinHeight="380"
+        WindowStartupLocation="CenterOwner"
+        ResizeMode="CanResize"
+        Background="{StaticResource Brush.Bg.Window}">
+    <Grid Margin="32,28">
+        <Grid.RowDefinitions>
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="*" />
+            <RowDefinition Height="Auto" />
+        </Grid.RowDefinitions>
+
+        <TextBlock Grid.Row="0" Text="Activer votre license"
+                   FontSize="22" FontWeight="SemiBold"
+                   Foreground="{StaticResource Brush.Text.Primary}" />
+
+        <TextBlock Grid.Row="1"
+                   Text="Saisis la clé fournie par ASTERION. Elle te donne accès aux téléchargements jusqu'à la date de validité associée."
+                   TextWrapping="Wrap"
+                   Foreground="{StaticResource Brush.Text.Secondary}"
+                   Margin="0,8,0,18" />
+
+        <TextBlock Grid.Row="2" Text="Clé de license"
+                   FontSize="12" FontWeight="Bold"
+                   Foreground="{StaticResource Brush.Text.Secondary}" />
+        <TextBox  Grid.Row="3" x:Name="KeyBox"
+                  Margin="0,6,0,16"
+                  Padding="10,8"
+                  FontFamily="Consolas" FontSize="14"
+                  CharacterCasing="Upper"
+                  Background="#1A1A20"
+                  Foreground="{StaticResource Brush.Text.Primary}"
+                  BorderBrush="{StaticResource Brush.Border}"
+                  BorderThickness="1"
+                  Text="PRSRV-XXXX-XXXX-XXXX-XXXX" />
+
+        <ScrollViewer Grid.Row="4" VerticalScrollBarVisibility="Auto">
+            <StackPanel x:Name="StatusPanel">
+                <TextBlock x:Name="StatusText"
+                           TextWrapping="Wrap"
+                           Foreground="{StaticResource Brush.Text.Secondary}" />
+            </StackPanel>
+        </ScrollViewer>
+
+        <StackPanel Grid.Row="5" Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,18,0,0">
+            <Button Style="{StaticResource SecondaryButton}"
+                    Content="Plus tard"
+                    IsCancel="True"
+                    Margin="0,0,12,0"
+                    Click="OnLater" />
+            <Button Style="{StaticResource AccentButton}"
+                    Content="Activer"
+                    Padding="32,10"
+                    IsDefault="True"
+                    Click="OnActivate"
+                    x:Name="ActivateButton" />
+        </StackPanel>
+    </Grid>
+</Window>
--- a/src/PSLauncher.App/Views/OnboardingDialog.xaml.cs
+++ b/src/PSLauncher.App/Views/OnboardingDialog.xaml.cs
@@ -0,0 +1,91 @@
+using System.Windows;
+using System.Windows.Media;
+using PSLauncher.Core.Licensing;
+
+namespace PSLauncher.App.Views;
+
+public partial class OnboardingDialog : Window
+{
+    private readonly ILicenseService _licenseService;
+
+    public bool LicenseActivated { get; private set; }
+
+    public OnboardingDialog(ILicenseService licenseService, string? prefilledKey = null)
+    {
+        _licenseService = licenseService;
+        InitializeComponent();
+        if (!string.IsNullOrEmpty(prefilledKey)) KeyBox.Text = prefilledKey;
+        KeyBox.SelectAll();
+        KeyBox.Focus();
+    }
+
+    private async void OnActivate(object sender, RoutedEventArgs e)
+    {
+        var key = KeyBox.Text?.Trim().ToUpperInvariant() ?? string.Empty;
+        if (string.IsNullOrEmpty(key) || key.Contains("XXXX"))
+        {
+            ShowStatus("Saisis une clé valide au format PRSRV-XXXX-XXXX-XXXX-XXXX.", isError: true);
+            return;
+        }
+
+        ActivateButton.IsEnabled = false;
+        ShowStatus("Validation en cours…", isError: false);
+
+        try
+        {
+            var resp = await _licenseService.ValidateAsync(key, CancellationToken.None);
+            switch (resp.Status)
+            {
+                case "valid":
+                    _licenseService.SaveCached(key, resp);
+                    ShowStatus($"License activée ({resp.OwnerName}). Téléchargements autorisés jusqu'au {resp.DownloadEntitlementUntil:dd/MM/yyyy}.", isError: false);
+                    LicenseActivated = true;
+                    DialogResult = true;
+                    Close();
+                    return;
+
+                case "expired":
+                    _licenseService.SaveCached(key, resp); // on cache quand même pour permettre de lancer les versions installées
+                    ShowStatus($"License expirée le {resp.DownloadEntitlementUntil:dd/MM/yyyy}. Tu peux toujours utiliser les versions déjà installées, mais plus en télécharger de nouvelles.", isError: true);
+                    LicenseActivated = true;
+                    DialogResult = true;
+                    Close();
+                    return;
+
+                case "revoked":
+                    ShowStatus("Cette license a été révoquée. Contacte ASTERION.", isError: true);
+                    break;
+                case "machine_limit_exceeded":
+                    ShowStatus(resp.Message ?? "Cette license a atteint son nombre maximum de machines.", isError: true);
+                    break;
+                case "invalid":
+                default:
+                    ShowStatus(resp.Message ?? "Clé de license inconnue.", isError: true);
+                    break;
+            }
+        }
+        catch (Exception ex)
+        {
+            ShowStatus($"Erreur de communication avec le serveur :\n{ex.Message}", isError: true);
+        }
+        finally
+        {
+            ActivateButton.IsEnabled = true;
+        }
+    }
+
+    private void OnLater(object sender, RoutedEventArgs e)
+    {
+        LicenseActivated = false;
+        DialogResult = false;
+        Close();
+    }
+
+    private void ShowStatus(string text, bool isError)
+    {
+        StatusText.Text = text;
+        StatusText.Foreground = isError
+            ? new SolidColorBrush(Color.FromRgb(0xF8, 0x71, 0x71))
+            : (System.Windows.Media.Brush)Application.Current.FindResource("Brush.Text.Secondary");
+    }
+}
--- a/src/PSLauncher.Core/Licensing/ILicenseService.cs
+++ b/src/PSLauncher.Core/Licensing/ILicenseService.cs
@@ -0,0 +1,14 @@
+using PSLauncher.Models;
+
+namespace PSLauncher.Core.Licensing;
+
+public interface ILicenseService
+{
+    Task<LicenseValidationResponse> ValidateAsync(string licenseKey, CancellationToken ct);
+    LicenseValidationResponse? GetCached();
+    void SaveCached(string licenseKey, LicenseValidationResponse response);
+    void Clear();
+    bool HasLicense();
+    string GetMachineId();
+    bool CanDownloadVersion(LicenseValidationResponse? license, VersionManifest version);
+}
--- a/src/PSLauncher.Core/Licensing/LicenseService.cs
+++ b/src/PSLauncher.Core/Licensing/LicenseService.cs
@@ -0,0 +1,253 @@
+using System.Net.Http.Json;
+using System.Reflection;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Microsoft.Extensions.Logging;
+using NSec.Cryptography;
+using PSLauncher.Core.Configuration;
+using PSLauncher.Models;
+
+namespace PSLauncher.Core.Licensing;
+
+public sealed class LicenseService : ILicenseService
+{
+    private const int CachedValidityDays = 7;
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+    };
+
+    private readonly HttpClient _http;
+    private readonly Func<string> _serverBaseUrlProvider;
+    private readonly IConfigStore _configStore;
+    private readonly LocalConfig _config;
+    private readonly ILogger<LicenseService> _logger;
+    private readonly string? _serverPublicKeyHex;
+
+    public LicenseService(
+        HttpClient http,
+        Func<string> serverBaseUrlProvider,
+        IConfigStore configStore,
+        LocalConfig config,
+        ILogger<LicenseService> logger)
+    {
+        _http = http;
+        _serverBaseUrlProvider = serverBaseUrlProvider;
+        _configStore = configStore;
+        _config = config;
+        _logger = logger;
+        _serverPublicKeyHex = TryReadEmbeddedPublicKey();
+    }
+
+    public bool HasLicense() => !string.IsNullOrEmpty(_config.License.EncryptedKey);
+
+    public string GetMachineId()
+    {
+        // Combine MachineGuid + nom utilisateur, hash SHA-256 → ID stable, sans leak du GUID brut
+        string raw;
+        try
+        {
+            using var key = Microsoft.Win32.Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Cryptography");
+            raw = (key?.GetValue("MachineGuid") as string) ?? Environment.MachineName;
+        }
+        catch
+        {
+            raw = Environment.MachineName;
+        }
+        var input = $"{raw}|{Environment.UserName}";
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(input));
+        return Convert.ToHexString(hash).ToLowerInvariant();
+    }
+
+    public async Task<LicenseValidationResponse> ValidateAsync(string licenseKey, CancellationToken ct)
+    {
+        var url = TrimSlash(_serverBaseUrlProvider()) + "/license/validate";
+        var req = new LicenseValidationRequest
+        {
+            LicenseKey = licenseKey,
+            MachineId = GetMachineId(),
+            MachineLabel = $"{Environment.MachineName} / {Environment.UserName}",
+            LauncherVersion = GetLauncherVersion(),
+        };
+
+        _logger.LogInformation("Validating license at {Url} (key {KeyHint}…)", url, licenseKey.Length >= 8 ? licenseKey[..8] : licenseKey);
+
+        using var httpReq = new HttpRequestMessage(HttpMethod.Post, url);
+        httpReq.Content = JsonContent.Create(req);
+        using var resp = await _http.SendAsync(httpReq, ct).ConfigureAwait(false);
+
+        var bodyText = await resp.Content.ReadAsStringAsync(ct).ConfigureAwait(false);
+        LicenseValidationResponse? parsed;
+        try
+        {
+            parsed = JsonSerializer.Deserialize<LicenseValidationResponse>(bodyText, JsonOptions);
+        }
+        catch (Exception ex)
+        {
+            throw new InvalidOperationException($"Réponse serveur invalide : {ex.Message}\n{bodyText}", ex);
+        }
+        if (parsed is null)
+            throw new InvalidOperationException("Réponse serveur vide");
+
+        // Statuts d'erreur applicatifs renvoyés en 4xx avec un body décrivant l'erreur
+        if (!resp.IsSuccessStatusCode && string.IsNullOrEmpty(parsed.Status))
+        {
+            parsed.Status = "invalid";
+            parsed.Message ??= $"HTTP {(int)resp.StatusCode}";
+        }
+
+        // Vérification de la signature serveur (si on a la clé publique embarquée et une signature)
+        if (!string.IsNullOrEmpty(_serverPublicKeyHex) && !string.IsNullOrEmpty(parsed.Signature))
+        {
+            if (!VerifySignature(parsed, parsed.Signature, _serverPublicKeyHex!))
+            {
+                _logger.LogError("License response signature INVALID — possible MITM");
+                throw new InvalidOperationException("Réponse serveur non authentifiée (signature invalide)");
+            }
+            _logger.LogDebug("License response signature OK");
+        }
+
+        return parsed;
+    }
+
+    public LicenseValidationResponse? GetCached()
+    {
+        if (string.IsNullOrEmpty(_config.License.EncryptedKey)) return null;
+        if (_config.License.LastValidationAt is null) return null;
+
+        // Cache offline valide 7 jours après la dernière validation réussie
+        var age = DateTime.UtcNow - _config.License.LastValidationAt.Value;
+        if (age.TotalDays > CachedValidityDays) return null;
+
+        return new LicenseValidationResponse
+        {
+            Status = _config.License.CachedEntitlementUntil >= DateTime.UtcNow ? "valid" : "expired",
+            OwnerName = _config.License.CachedOwnerName,
+            DownloadEntitlementUntil = _config.License.CachedEntitlementUntil,
+            ServerTime = _config.License.LastValidationAt,
+        };
+    }
+
+    public void SaveCached(string licenseKey, LicenseValidationResponse response)
+    {
+        var encrypted = ProtectKey(licenseKey);
+        _config.License.EncryptedKey = encrypted;
+        _config.License.LastValidationAt = DateTime.UtcNow;
+        _config.License.CachedOwnerName = response.OwnerName;
+        _config.License.CachedEntitlementUntil = response.DownloadEntitlementUntil;
+        _configStore.Save(_config);
+    }
+
+    public void Clear()
+    {
+        _config.License = new LicenseConfig();
+        _configStore.Save(_config);
+    }
+
+    public bool CanDownloadVersion(LicenseValidationResponse? license, VersionManifest version)
+    {
+        if (license is null) return false;
+        return license.CanDownload(version);
+    }
+
+    public string? GetDecryptedKey()
+    {
+        if (string.IsNullOrEmpty(_config.License.EncryptedKey)) return null;
+        try { return UnprotectKey(_config.License.EncryptedKey); }
+        catch (Exception ex) { _logger.LogWarning(ex, "Failed to decrypt cached license key"); return null; }
+    }
+
+    // ----- DPAPI -----
+
+    private static string ProtectKey(string clearKey)
+    {
+        var data = Encoding.UTF8.GetBytes(clearKey);
+        var protectedBytes = ProtectedData.Protect(data, optionalEntropy: null, scope: DataProtectionScope.CurrentUser);
+        return Convert.ToBase64String(protectedBytes);
+    }
+
+    private static string UnprotectKey(string base64)
+    {
+        var protectedBytes = Convert.FromBase64String(base64);
+        var data = ProtectedData.Unprotect(protectedBytes, optionalEntropy: null, scope: DataProtectionScope.CurrentUser);
+        return Encoding.UTF8.GetString(data);
+    }
+
+    // ----- Signature -----
+
+    /// <summary>
+    /// Encode canonical du payload en JSON sans le champ 'signature', exactement comme côté PHP
+    /// (Crypto::canonicalJson : JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE).
+    /// </summary>
+    public static byte[] CanonicalBytesFor(LicenseValidationResponse response)
+    {
+        // On reconstruit un dictionnaire ordonné comme côté PHP, sans signature
+        var dict = new Dictionary<string, object?>
+        {
+            ["status"]                     = response.Status,
+            ["licenseId"]                  = response.LicenseId,
+            ["ownerName"]                  = response.OwnerName,
+            ["issuedAt"]                   = FormatDateAtom(response.IssuedAt),
+            ["downloadEntitlementUntil"]   = FormatDateAtom(response.DownloadEntitlementUntil),
+            ["maxMachines"]                = response.MaxMachines,
+            ["serverTime"]                 = FormatDateAtom(response.ServerTime),
+        };
+        var opts = new JsonSerializerOptions
+        {
+            Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping,
+            DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+        };
+        return JsonSerializer.SerializeToUtf8Bytes(dict, opts);
+    }
+
+    private static string? FormatDateAtom(DateTime? d) =>
+        d?.ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:sszzz");
+
+    public static bool VerifySignature(LicenseValidationResponse response, string base64Signature, string publicKeyHex)
+    {
+        try
+        {
+            var alg = SignatureAlgorithm.Ed25519;
+            var pkBytes = Convert.FromHexString(publicKeyHex);
+            var pk = PublicKey.Import(alg, pkBytes, KeyBlobFormat.RawPublicKey);
+            var sig = Convert.FromBase64String(base64Signature);
+            var payload = CanonicalBytesFor(response);
+            return alg.Verify(pk, payload, sig);
+        }
+        catch
+        {
+            return false;
+        }
+    }
+
+    // ----- Public key embarquée -----
+
+    private static string? TryReadEmbeddedPublicKey()
+    {
+        var asm = Assembly.GetExecutingAssembly();
+        foreach (var name in asm.GetManifestResourceNames())
+        {
+            if (name.EndsWith("server-pubkey.txt", StringComparison.OrdinalIgnoreCase))
+            {
+                using var s = asm.GetManifestResourceStream(name);
+                if (s is null) continue;
+                using var sr = new StreamReader(s);
+                var hex = sr.ReadToEnd().Trim();
+                if (hex.StartsWith("#") || string.IsNullOrEmpty(hex)) return null; // placeholder/ commenté
+                return hex;
+            }
+        }
+        return null;
+    }
+
+    private static string GetLauncherVersion()
+    {
+        var asm = Assembly.GetExecutingAssembly();
+        return asm.GetName().Version?.ToString() ?? "0.0.0";
+    }
+
+    private static string TrimSlash(string s) => s.TrimEnd('/');
+}
--- a/src/PSLauncher.Core/PSLauncher.Core.csproj
+++ b/src/PSLauncher.Core/PSLauncher.Core.csproj
@@ -10,10 +10,16 @@
  <ItemGroup>
    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.2" />
    <PackageReference Include="Polly" Version="8.4.2" />
+    <PackageReference Include="NSec.Cryptography" Version="24.4.0" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
  </ItemGroup>

  <ItemGroup>
    <ProjectReference Include="..\PSLauncher.Models\PSLauncher.Models.csproj" />
  </ItemGroup>

+  <ItemGroup>
+    <EmbeddedResource Include="Resources\server-pubkey.txt" />
+  </ItemGroup>
+
 </Project>
--- a/src/PSLauncher.Core/Resources/server-pubkey.txt
+++ b/src/PSLauncher.Core/Resources/server-pubkey.txt
@@ -0,0 +1,6 @@
+# Clé publique Ed25519 du serveur PS_Launcher.
+# Génère-la via : `php tools/generate-keypair.php` sur le serveur OVH.
+# Recopie ici les 64 hex chars de public_key_hex (rien d'autre, pas de commentaires sur la même ligne),
+# puis recompile le launcher.
+# Tant que ce fichier commence par '#' ou est vide, la vérification de signature
+# côté client est skippée (le launcher accepte la réponse serveur sans vérifier).
--- a/src/PSLauncher.Models/License.cs
+++ b/src/PSLauncher.Models/License.cs
@@ -0,0 +1,52 @@
+using System.Text.Json.Serialization;
+
+namespace PSLauncher.Models;
+
+public sealed class LicenseValidationResponse
+{
+    [JsonPropertyName("status")]
+    public string Status { get; set; } = "invalid";
+
+    [JsonPropertyName("licenseId")]
+    public string? LicenseId { get; set; }
+
+    [JsonPropertyName("ownerName")]
+    public string? OwnerName { get; set; }
+
+    [JsonPropertyName("issuedAt")]
+    public DateTime? IssuedAt { get; set; }
+
+    [JsonPropertyName("downloadEntitlementUntil")]
+    public DateTime? DownloadEntitlementUntil { get; set; }
+
+    [JsonPropertyName("maxMachines")]
+    public int? MaxMachines { get; set; }
+
+    [JsonPropertyName("serverTime")]
+    public DateTime? ServerTime { get; set; }
+
+    [JsonPropertyName("message")]
+    public string? Message { get; set; }
+
+    [JsonPropertyName("signature")]
+    public string? Signature { get; set; }
+
+    public bool IsValid => Status == "valid";
+    public bool IsExpired => Status == "expired";
+
+    public bool CanDownload(VersionManifest version)
+    {
+        if (!IsValid && !IsExpired) return false;
+        if (DownloadEntitlementUntil is null) return false;
+        if (version.MinLicenseDate is null) return true; // pas de minimum imposé
+        return DownloadEntitlementUntil >= version.MinLicenseDate;
+    }
+}
+
+public sealed class LicenseValidationRequest
+{
+    [JsonPropertyName("licenseKey")] public string LicenseKey { get; set; } = string.Empty;
+    [JsonPropertyName("machineId")] public string MachineId { get; set; } = string.Empty;
+    [JsonPropertyName("machineLabel")] public string? MachineLabel { get; set; }
+    [JsonPropertyName("launcherVersion")] public string LauncherVersion { get; set; } = string.Empty;
+}