License API

<?php
/**
 * Minimal Shawon Web licence client. Drop into any PHP product.
 *
 * $lic = new ShawonLicense('SW-ERP-001', __DIR__ . '/storage/license.json');
 * if (!$lic->isActive()) { header('Location: /activate.php'); exit; }
 */
final class ShawonLicense
{
    private const BASE = 'https://shawonweb.com/api/v1';

    /** Last failure message, for your "licence problem" screen. */
    public ?string $lastError = null;

    public function __construct(
        private string $productCode,
        private string $storePath
    ) {}

    /** Called once, from your activation screen. */
    public function activate(string $licenseKey): array
    {
        $res = $this->call('POST', '/license/activate', $licenseKey, [
            'product_code' => $this->productCode,
            'instance_id'  => $this->instanceId(),
            'device_name'  => gethostname(),
            'domain'       => $_SERVER['HTTP_HOST'] ?? null,
            'hostname'     => gethostname(),
            'platform'     => 'PHP ' . PHP_VERSION . ' / ' . PHP_OS,
            'version'      => APP_VERSION,
            'environment'  => 'production',
        ]);

        if (!($res['success'] ?? false)) {
            throw new RuntimeException($res['error']['message'] ?? 'Activation failed');
        }

        // Persist the key. From here on the product re-checks by itself and the
        // customer never types the key again -- not after a renewal, not after
        // a re-purchase, not after a restart.
        $this->save([
            'license_key'    => $licenseKey,
            'instance_token' => $res['data']['activation']['instance_token'],
            'signing_secret' => $res['data']['signing_secret'],
            'state'          => $res['data'],
            'checked_at'     => time(),
        ]);

        return $res['data'];
    }

    /** Called on every boot. Cheap: it only hits the network once a day. */
    public function isActive(): bool
    {
        $store = $this->load();
        if (empty($store['license_key'])) {
            return false;
        }

        $age = time() - (int)($store['checked_at'] ?? 0);
        $ttl = (int)($store['state']['revalidate_after'] ?? 86400);

        if ($age < $ttl) {
            return (bool)($store['state']['license']['valid'] ?? false);
        }

        try {
            $res = $this->call('POST', '/license/validate', $store['license_key'], [
                'product_code' => $this->productCode,
                'instance_id'  => $this->instanceId(),
                'version'      => APP_VERSION,
            ]);
        } catch (Throwable $e) {
            // Offline: keep running until the cached result goes stale enough
            // to be untrustworthy, then fail closed.
            return $age < 7 * 86400 && ($store['state']['license']['valid'] ?? false);
        }

        // The key is valid but this machine holds no slot. Re-activate with the
        // key we already have -- never re-prompt the user. If the licence is
        // already claimed by another machine this fails, and it should: that is
        // the one-installation rule doing its job.
        if ($res['data']['activation_required'] ?? false) {
            try {
                $this->activate($store['license_key']);
                return true;
            } catch (Throwable $e) {
                $this->lastError = $e->getMessage();   // show this, with the support link
                return false;
            }
        }

        $store['state'] = $res['data'];
        $store['checked_at'] = time();
        $this->save($store);

        return (bool)($res['data']['license']['valid'] ?? false);
    }

    /** True only on flexible (multi-seat) licences. */
    public function canDeactivate(): bool
    {
        return (bool)($this->load()['state']['seats']['transferable'] ?? false);
    }

    public function deactivate(): void
    {
        $store = $this->load();
        if (empty($store['license_key'])) {
            return;
        }

        // A strict licence is permanently bound; the endpoint would return
        // deactivation_not_permitted. Hide the button instead of calling it.
        if (!$this->canDeactivate()) {
            throw new RuntimeException(
                'This licence is permanently bound to this installation. '
                . 'Contact Shawon Web support to move it to another machine.'
            );
        }

        $this->call('POST', '/license/deactivate', $store['license_key'], [
            'instance_id' => $this->instanceId(),
            'reason'      => 'uninstall',
        ]);
        @unlink($this->storePath);
    }

    public function feature(string $name, $default = null)
    {
        return $this->load()['state']['entitlements']['features'][$name] ?? $default;
    }

    /** Stable per-installation id. Generated once, then reused forever. */
    private function instanceId(): string
    {
        $store = $this->load();
        if (!empty($store['instance_id'])) {
            return $store['instance_id'];
        }
        $store['instance_id'] = bin2hex(random_bytes(16));
        $this->save($store);
        return $store['instance_id'];
    }

    private function call(string $method, string $path, string $key, array $body): array
    {
        $ch = curl_init(self::BASE . $path);
        curl_setopt_array($ch, [
            CURLOPT_CUSTOMREQUEST  => $method,
            CURLOPT_POSTFIELDS     => json_encode($body),
            CURLOPT_HTTPHEADER     => [
                'Authorization: Bearer ' . $key,
                'Content-Type: application/json',
            ],
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT        => 15,
        ]);
        $raw = curl_exec($ch);
        if ($raw === false) {
            throw new RuntimeException('Licence server unreachable: ' . curl_error($ch));
        }
        curl_close($ch);

        return json_decode($raw, true) ?: [];
    }

    private function load(): array
    {
        return is_file($this->storePath)
            ? (json_decode(file_get_contents($this->storePath), true) ?: [])
            : [];
    }

    private function save(array $data): void
    {
        @mkdir(dirname($this->storePath), 0750, true);
        file_put_contents($this->storePath, json_encode($data), LOCK_EX);
        @chmod($this->storePath, 0600);
    }
}

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

// Shawon Web licence client for .NET desktop / service products.
public sealed class ShawonLicense
{
    private const string Base = "https://shawonweb.com/api/v1";
    private static readonly HttpClient Http = new() { Timeout = TimeSpan.FromSeconds(15) };

    private readonly string _productCode;
    private readonly string _storePath;

    public ShawonLicense(string productCode, string storePath)
    {
        _productCode = productCode;
        _storePath = storePath;
    }

    public async Task<JsonElement> ActivateAsync(string licenseKey)
    {
        var res = await CallAsync("/license/activate", licenseKey, new
        {
            product_code = _productCode,
            instance_id  = InstanceId(),
            device_name  = Environment.MachineName,
            hostname     = Environment.MachineName,
            platform     = $".NET {Environment.Version} / {Environment.OSVersion}",
            version      = typeof(ShawonLicense).Assembly.GetName().Version?.ToString(),
            environment  = "production"
        });

        if (!res.GetProperty("success").GetBoolean())
            throw new InvalidOperationException(res.GetProperty("error").GetProperty("message").GetString());

        var data = res.GetProperty("data");
        SaveStore(new Store
        {
            LicenseKey    = licenseKey,
            InstanceId    = InstanceId(),
            InstanceToken = data.GetProperty("activation").GetProperty("instance_token").GetString(),
            SigningSecret = data.GetProperty("signing_secret").GetString(),
            StateJson     = data.GetRawText(),
            CheckedAt     = DateTimeOffset.UtcNow
        });

        return data;
    }

    /// Call at startup. Hits the network at most once a day.
    public async Task<bool> IsActiveAsync()
    {
        var store = LoadStore();
        if (store?.LicenseKey is null) return false;

        var cached = JsonDocument.Parse(store.StateJson!).RootElement;
        var ttl = cached.GetProperty("revalidate_after").GetInt32();
        var age = (DateTimeOffset.UtcNow - store.CheckedAt).TotalSeconds;

        if (age < ttl)
            return cached.GetProperty("license").GetProperty("valid").GetBoolean();

        JsonElement res;
        try
        {
            res = await CallAsync("/license/validate", store.LicenseKey, new
            {
                product_code = _productCode,
                instance_id  = store.InstanceId
            });
        }
        catch (HttpRequestException)
        {
            // Offline tolerance: trust the cached verdict for up to 7 days.
            return age < TimeSpan.FromDays(7).TotalSeconds
                && cached.GetProperty("license").GetProperty("valid").GetBoolean();
        }

        var data = res.GetProperty("data");

        // Valid key but no slot on this machine: re-activate with the key we
        // already hold, never re-prompt. If another machine owns the licence
        // this throws -- show the message, it carries the support link.
        if (data.TryGetProperty("activation_required", out var need) && need.GetBoolean())
        {
            try
            {
                await ActivateAsync(store.LicenseKey);
                return true;
            }
            catch (InvalidOperationException ex)
            {
                LastError = ex.Message;
                return false;
            }
        }

        store.StateJson = data.GetRawText();
        store.CheckedAt = DateTimeOffset.UtcNow;
        SaveStore(store);

        return data.GetProperty("license").GetProperty("valid").GetBoolean();
    }

    private async Task<JsonElement> CallAsync(string path, string key, object body)
    {
        using var req = new HttpRequestMessage(HttpMethod.Post, Base + path)
        {
            Content = new StringContent(JsonSerializer.Serialize(body), Encoding.UTF8, "application/json")
        };
        req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", key);

        using var resp = await Http.SendAsync(req);
        var text = await resp.Content.ReadAsStringAsync();
        return JsonDocument.Parse(text).RootElement.Clone();
    }

    // InstanceId(), LoadStore() and SaveStore() persist a small JSON file next
    // to the app (or a registry key). The instance id is generated once with
    // Guid.NewGuid() and must never change for the life of the install.
}

// Shawon Web licence client for Node / Electron products.
import { randomUUID } from 'node:crypto';
import { readFileSync, writeFileSync, existsSync } from 'node:fs';
import os from 'node:os';

const BASE = 'https://shawonweb.com/api/v1';

export class ShawonLicense {
  constructor(productCode, storePath) {
    this.productCode = productCode;
    this.storePath = storePath;
  }

  async activate(licenseKey) {
    const data = await this.#call('/license/activate', licenseKey, {
      product_code: this.productCode,
      instance_id: this.#instanceId(),
      device_name: os.hostname(),
      hostname: os.hostname(),
      platform: `Node ${process.version} / ${os.platform()} ${os.release()}`,
      version: process.env.APP_VERSION,
      environment: 'production',
    });

    this.#save({
      license_key: licenseKey,
      instance_id: this.#instanceId(),
      instance_token: data.activation.instance_token,
      signing_secret: data.signing_secret,
      state: data,
      checked_at: Date.now(),
    });

    return data;
  }

  /** Call on every launch. */
  async isActive() {
    const store = this.#load();
    if (!store.license_key) return false;

    const ageMs = Date.now() - (store.checked_at ?? 0);
    const ttlMs = (store.state?.revalidate_after ?? 86400) * 1000;
    if (ageMs < ttlMs) return store.state?.license?.valid === true;

    let data;
    try {
      data = await this.#call('/license/validate', store.license_key, {
        product_code: this.productCode,
        instance_id: store.instance_id,
        version: process.env.APP_VERSION,
      });
    } catch {
      // Offline grace: keep the last verdict for a week, then fail closed.
      return ageMs < 7 * 86400_000 && store.state?.license?.valid === true;
    }

    // Valid key, no slot on this machine: re-activate with the key we already
    // hold, never re-prompt. Failure here means another machine owns the
    // licence -- surface the message, it carries the support link.
    if (data.activation_required) {
      try {
        await this.activate(store.license_key);
        return true;
      } catch (e) {
        this.lastError = e.message;
        return false;
      }
    }

    this.#save({ ...store, state: data, checked_at: Date.now() });
    return data.license.valid === true;
  }

  /** True only on flexible (multi-seat) licences. */
  canDeactivate() {
    return this.#load().state?.seats?.transferable === true;
  }

  async deactivate() {
    const store = this.#load();
    if (!store.license_key) return;

    // A strict licence is permanently bound and the endpoint would refuse.
    // Gate your uninstall UI on this rather than calling and catching.
    if (!this.canDeactivate()) {
      throw new Error(
        'This licence is permanently bound to this installation. ' +
        'Contact Shawon Web support to move it to another machine.'
      );
    }

    await this.#call('/license/deactivate', store.license_key, {
      instance_id: store.instance_id,
      reason: 'uninstall',
    });
  }

  feature(name, fallback = null) {
    return this.#load().state?.entitlements?.features?.[name] ?? fallback;
  }

  async #call(path, key, body) {
    const r = await fetch(BASE + path, {
      method: 'POST',
      headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
      body: JSON.stringify(body),
    });
    const json = await r.json();
    if (!json.success) throw new Error(`${json.error.code}: ${json.error.message}`);
    return json.data;
  }

  #instanceId() {
    const store = this.#load();
    if (store.instance_id) return store.instance_id;
    store.instance_id = randomUUID();
    this.#save(store);
    return store.instance_id;
  }

  #load() {
    return existsSync(this.storePath) ? JSON.parse(readFileSync(this.storePath, 'utf8')) : {};
  }

  #save(data) {
    writeFileSync(this.storePath, JSON.stringify(data), { mode: 0o600 });
  }
}

"""Shawon Web licence client for Python products."""
import json, os, platform, socket, time, uuid
from pathlib import Path

import requests

BASE = "https://shawonweb.com/api/v1"


class ShawonLicense:
    def __init__(self, product_code: str, store_path: str):
        self.product_code = product_code
        self.store = Path(store_path)

    # -- public ----------------------------------------------------------
    def activate(self, license_key: str) -> dict:
        data = self._call("/license/activate", license_key, {
            "product_code": self.product_code,
            "instance_id": self._instance_id(),
            "device_name": socket.gethostname(),
            "hostname": socket.gethostname(),
            "platform": f"Python {platform.python_version()} / {platform.system()}",
            "version": os.getenv("APP_VERSION"),
            "environment": "production",
        })
        self._save({
            "license_key": license_key,
            "instance_id": self._instance_id(),
            "instance_token": data["activation"]["instance_token"],
            "signing_secret": data["signing_secret"],
            "state": data,
            "checked_at": time.time(),
        })
        return data

    def is_active(self) -> bool:
        store = self._load()
        if not store.get("license_key"):
            return False

        age = time.time() - store.get("checked_at", 0)
        ttl = store.get("state", {}).get("revalidate_after", 86400)
        if age < ttl:
            return bool(store["state"]["license"]["valid"])

        try:
            data = self._call("/license/validate", store["license_key"], {
                "product_code": self.product_code,
                "instance_id": store["instance_id"],
            })
        except requests.RequestException:
            # Offline: trust the cached verdict for up to a week.
            return age < 7 * 86400 and bool(store["state"]["license"]["valid"])

        # Valid key, no slot on this machine: re-activate with the key we already
        # hold, never re-prompt. A RuntimeError here means another machine owns
        # the licence -- show it, the message carries the support link.
        if data.get("activation_required"):
            try:
                self.activate(store["license_key"])
                return True
            except RuntimeError as exc:
                self.last_error = str(exc)
                return False

        store["state"], store["checked_at"] = data, time.time()
        self._save(store)
        return bool(data["license"]["valid"])

    def feature(self, name, default=None):
        return self._load().get("state", {}).get("entitlements", {}).get("features", {}).get(name, default)

    # -- internals -------------------------------------------------------
    def _call(self, path: str, key: str, body: dict) -> dict:
        r = requests.post(
            BASE + path,
            json=body,
            headers={"Authorization": f"Bearer {key}"},
            timeout=15,
        )
        payload = r.json()
        if not payload.get("success"):
            err = payload.get("error", {})
            raise RuntimeError(f"{err.get('code')}: {err.get('message')}")
        return payload["data"]

    def _instance_id(self) -> str:
        store = self._load()
        if not store.get("instance_id"):
            store["instance_id"] = str(uuid.uuid4())
            self._save(store)
        return store["instance_id"]

    def _load(self) -> dict:
        return json.loads(self.store.read_text()) if self.store.exists() else {}

    def _save(self, data: dict) -> None:
        self.store.parent.mkdir(parents=True, exist_ok=True)
        self.store.write_text(json.dumps(data))
        os.chmod(self.store, 0o600)