j.foucher
7a29dbb049
UX bonus: clicking "Reprendre" on an interrupted download skips the
release-notes confirmation dialog (the user already approved when they
first clicked Installer).
Server side
-----------
- migrations/001_init.sql: licenses, license_machines, rate_limit,
audit_log on InnoDB/utf8mb4. Foreign keys, unique on license_key, slot
uniqueness per (license_id, machine_id).
- api/lib/Db.php: thin PDO singleton (exception mode, prepared, no emul).
- api/lib/Crypto.php: Ed25519 sign/verify via libsodium (sodium_crypto_*),
HMAC-SHA-256 helper for v0.6, canonicalJson() that strips `signature`
before serializing — must match exactly the encoding done client-side
before verify.
- api/routes/ValidateLicense.php: POST /license/validate. Looks up the
key, walks the machine slot logic (insert or update last_seen),
enforces max_machines, returns a payload signed Ed25519 + status of
valid/expired/revoked/machine_limit_exceeded/invalid. Audit logs every
outcome. Rate-limit 10/min/IP via the rate_limit table.
- tools/generate-keypair.php: prints a fresh sodium keypair so the
operator drops the hex into config.php and the public_key_hex into the
launcher resource.
- tools/issue-license.php: PRSRV-XXXX-XXXX-XXXX-XXXX generator (32-char
unambiguous alphabet), inserts the license, prints the key once.
- tools/sign-manifest.php: now also signs the manifest itself with
Ed25519 after computing the per-zip sha256s.
- config.example.php: schema rewritten with sections db / hmac / ed25519
/ jwt / rate-limit. config.php remains gitignored.
Client side
-----------
- Models/License.cs: LicenseValidationRequest + LicenseValidationResponse
with CanDownload(VersionManifest) — entitlement_until vs version's
minLicenseDate. The status valid|expired|revoked|machine_limit_exceeded
flow is preserved end-to-end.
- Core/Licensing/LicenseService.cs:
* machineId = SHA-256 of HKLM/Software/Microsoft/Cryptography/MachineGuid
+ UserName (stable, no PII leak)
* online ValidateAsync calls /license/validate with launcher version
* embedded server-pubkey.txt drives Ed25519 verification of the
response (skipped gracefully if pubkey not yet provisioned)
* SaveCached / GetCached use DPAPI CurrentUser scope on the license
key; the cleartext key never touches disk
* GetCached has a 7-day offline grace window after the last successful
validation, so going offline doesn't lock the user out
- Core/Resources/server-pubkey.txt: EmbeddedResource. Default content is
a comment, which the service treats as "no pubkey configured" and
bypasses verification. Operator pastes the real hex post-deploy and
rebuilds.
- Core/PSLauncher.Core.csproj: Polly, NSec.Cryptography (Ed25519),
System.Security.Cryptography.ProtectedData (DPAPI).
- App/Views/OnboardingDialog.xaml(.cs): first-launch / "🔑 Activer"
modal. Calls LicenseService, displays status messages with red
foreground on errors and green-tinted secondary text otherwise.
- ViewModels/VersionRowViewModel.cs: new LicenseAllowsDownload property.
Install button label switches to "🔒 License insuffisante" when the
user's entitlement_until precedes the version's minLicenseDate;
CanInstall is false in that case so the click is a no-op too.
- ViewModels/MainViewModel.cs: loads the cached license at startup (no
network call), surfaces it as LicenseSummary in the top bar, exposes
ActivateLicenseCommand to (re)open the onboarding dialog. RebuildList
applies the per-version license filter so older installed versions
remain launchable but newer-than-license ones can't be downloaded.
- Views/MainWindow.xaml: top bar gains a "🔑 Activer / changer" button
next to the license summary.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
86 lines
2.8 KiB
PHP
86 lines
2.8 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
// Erreurs en JSON, jamais en HTML — pour ne plus avoir d'écran Apache 500 opaque.
|
|
ini_set('display_errors', '0');
|
|
ini_set('log_errors', '1');
|
|
|
|
set_error_handler(function ($severity, $message, $file, $line) {
|
|
if (!(error_reporting() & $severity)) return false;
|
|
throw new ErrorException($message, 0, $severity, $file, $line);
|
|
});
|
|
|
|
set_exception_handler(function (\Throwable $e) {
|
|
if (!headers_sent()) {
|
|
http_response_code(500);
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
}
|
|
error_log('[PSLauncher] ' . $e->getMessage() . ' @ ' . $e->getFile() . ':' . $e->getLine());
|
|
echo json_encode([
|
|
'error' => 'server_error',
|
|
'message' => $e->getMessage(),
|
|
'file' => basename($e->getFile()),
|
|
'line' => $e->getLine(),
|
|
]);
|
|
exit;
|
|
});
|
|
|
|
require __DIR__ . '/lib/Response.php';
|
|
|
|
use PSLauncher\Response;
|
|
|
|
// Charge la config (config.example.php est le template ; config.php est gitignored)
|
|
$configPath = __DIR__ . '/config.php';
|
|
if (!is_file($configPath)) {
|
|
Response::error('config_missing', 'config.php absent — copier config.example.php', 500);
|
|
}
|
|
$config = require $configPath;
|
|
|
|
// La route est passée via ?route=... par le .htaccess
|
|
$route = trim((string)($_GET['route'] ?? ''), '/');
|
|
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
|
|
|
|
if ($method === 'GET' && ($route === '' || $route === 'manifest')) {
|
|
require __DIR__ . '/routes/Manifest.php';
|
|
\PSLauncher\Routes\Manifest::handle($config);
|
|
return;
|
|
}
|
|
|
|
if ($method === 'GET' && preg_match('#^releasenotes/([0-9]+\.[0-9]+\.[0-9]+)$#', $route, $m)) {
|
|
require __DIR__ . '/routes/Releasenotes.php';
|
|
\PSLauncher\Routes\Releasenotes::handle($m[1]);
|
|
return;
|
|
}
|
|
|
|
if ($method === 'POST' && $route === 'license/validate') {
|
|
require __DIR__ . '/lib/Db.php';
|
|
require __DIR__ . '/lib/Crypto.php';
|
|
require __DIR__ . '/routes/ValidateLicense.php';
|
|
\PSLauncher\Routes\ValidateLicense::handle($config);
|
|
return;
|
|
}
|
|
|
|
if ($method === 'GET' && $route === 'health') {
|
|
Response::json([
|
|
'status' => 'ok',
|
|
'serverTime' => gmdate('c'),
|
|
'phpVersion' => PHP_VERSION,
|
|
'configLoaded' => is_array($config),
|
|
]);
|
|
}
|
|
|
|
if ($method === 'GET' && $route === 'debug') {
|
|
Response::json([
|
|
'status' => 'ok',
|
|
'route' => $route,
|
|
'request_uri' => $_SERVER['REQUEST_URI'] ?? '',
|
|
'script_name' => $_SERVER['SCRIPT_NAME'] ?? '',
|
|
'php' => PHP_VERSION,
|
|
'sodium' => function_exists('sodium_crypto_sign_detached'),
|
|
'pdo_mysql' => extension_loaded('pdo_mysql'),
|
|
'manifest_file' => is_file(dirname(__DIR__) . '/manifest/versions.json'),
|
|
]);
|
|
}
|
|
|
|
Response::error('not_found', "Route not found: '{$route}'", 404);
|