feat(license): dual-path opsx-licence client alongside HMAC
Wire LIC-/LICOFF- activate/verify/heartbeat to licence.rlwj.cn/api, keep legacy HMAC accepted with deprecation banner, add instance_id fingerprint and licensing docs (product lokistack still needs admin create).
This commit is contained in:
opsx committed
1 parent
5f42d9f696
commit
af0298e994
13 files changed
+888
-37
No files matched your search
@@ -0,0 +1,333 @@
|
||||
package services
|
||||
|
||||
// opsx-licence 客户端：activate / verify / heartbeat。
|
||||
// 默认 Base = https://licence.rlwj.cn/api；product_code = lokistack。
|
||||
// 响应若带 Ed25519 sig 则验签（公钥与 OpsxShell 同源）。
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/ed25519"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"lokistack/config"
|
||||
)
|
||||
|
||||
const (
|
||||
licenceProductCode = "lokistack"
|
||||
licenceHTTPTimeout = 15 * time.Second
|
||||
// 与 OpsxShell / opsx-licence OFFLINE_LICENSE_SEED 派生公钥一致
|
||||
offlineLicensePublicKeyHex = "108375d485c58a1a738f93c2cbb838f76331de981ee5da13d90a1f280672131d"
|
||||
offlineToleranceSecs = int64(30 * 86400)
|
||||
weeklyVerifySecs = int64(7 * 86400)
|
||||
hmacDeprecationNotice = "当前为旧版本地 HMAC 许可码，将逐步停用。请联系发卡方换发 LIC- / LICOFF-（opsx-licence）授权码；迁移窗口内旧码仍有效，不会静默失效。"
|
||||
)
|
||||
|
||||
type licenceRemoteInfo struct {
|
||||
Valid bool
|
||||
LicenseKey string
|
||||
ProductCode string
|
||||
Features []string
|
||||
Status string
|
||||
ExpiresAtUnix int64
|
||||
MaxDevices int
|
||||
PlanType string
|
||||
InGrace bool
|
||||
GraceDaysLeft int
|
||||
ServerTime int64
|
||||
ActivationToken string
|
||||
Message string
|
||||
}
|
||||
|
||||
func licenceAPIBases() []string {
|
||||
primary := strings.TrimRight(config.GetConfig().LicenseAPIBase, "/")
|
||||
bases := []string{primary}
|
||||
// 仅当主节点不是 l123 时把 l123 作备灾（网络失败才切）
|
||||
backup := "https://l123.91ai.io/api"
|
||||
if primary != backup && !strings.Contains(primary, "l123.91ai.io") {
|
||||
bases = append(bases, backup)
|
||||
}
|
||||
return bases
|
||||
}
|
||||
|
||||
func isOpsxLicenseKey(key string) bool {
|
||||
k := strings.TrimSpace(key)
|
||||
return strings.HasPrefix(k, "LIC-") || strings.HasPrefix(k, "LICOFF-")
|
||||
}
|
||||
|
||||
func isOfflineLicenseKey(key string) bool {
|
||||
return strings.HasPrefix(strings.TrimSpace(key), "LICOFF-")
|
||||
}
|
||||
|
||||
func licenceHTTPClient() *http.Client {
|
||||
return &http.Client{Timeout: licenceHTTPTimeout}
|
||||
}
|
||||
|
||||
func postLicenceJSON(path string, body any) (map[string]any, error) {
|
||||
payload, err := json.Marshal(body)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var lastErr error
|
||||
for _, base := range licenceAPIBases() {
|
||||
url := base + path
|
||||
req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(payload))
|
||||
if err != nil {
|
||||
lastErr = err
|
||||
continue
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("User-Agent", "LokiStack/1")
|
||||
resp, err := licenceHTTPClient().Do(req)
|
||||
if err != nil {
|
||||
lastErr = fmt.Errorf("授权服务不可达: %w", err)
|
||||
continue
|
||||
}
|
||||
raw, readErr := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
|
||||
_ = resp.Body.Close()
|
||||
if readErr != nil {
|
||||
lastErr = readErr
|
||||
continue
|
||||
}
|
||||
var envelope map[string]any
|
||||
if err := json.Unmarshal(raw, &envelope); err != nil {
|
||||
lastErr = fmt.Errorf("授权服务响应无法解析 (%s)", resp.Status)
|
||||
continue
|
||||
}
|
||||
return envelope, nil
|
||||
}
|
||||
if lastErr == nil {
|
||||
lastErr = fmt.Errorf("无可用授权节点")
|
||||
}
|
||||
return nil, lastErr
|
||||
}
|
||||
|
||||
func envelopeCode(m map[string]any) int {
|
||||
switch v := m["code"].(type) {
|
||||
case float64:
|
||||
return int(v)
|
||||
case int:
|
||||
return v
|
||||
default:
|
||||
return 0
|
||||
}
|
||||
}
|
||||
|
||||
func envelopeMessage(m map[string]any) string {
|
||||
if s, ok := m["message"].(string); ok {
|
||||
return s
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func envelopeData(m map[string]any) map[string]any {
|
||||
if d, ok := m["data"].(map[string]any); ok {
|
||||
return d
|
||||
}
|
||||
return m
|
||||
}
|
||||
|
||||
func jsonString(m map[string]any, keys ...string) string {
|
||||
for _, k := range keys {
|
||||
if s, ok := m[k].(string); ok && s != "" {
|
||||
return s
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func jsonInt(m map[string]any, keys ...string) int {
|
||||
for _, k := range keys {
|
||||
switch v := m[k].(type) {
|
||||
case float64:
|
||||
return int(v)
|
||||
case int:
|
||||
return v
|
||||
case json.Number:
|
||||
n, _ := v.Int64()
|
||||
return int(n)
|
||||
}
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func jsonInt64(m map[string]any, keys ...string) int64 {
|
||||
for _, k := range keys {
|
||||
switch v := m[k].(type) {
|
||||
case float64:
|
||||
return int64(v)
|
||||
case int64:
|
||||
return v
|
||||
case int:
|
||||
return int64(v)
|
||||
}
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func jsonBool(m map[string]any, keys ...string) bool {
|
||||
for _, k := range keys {
|
||||
if b, ok := m[k].(bool); ok {
|
||||
return b
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func parseRemoteInfo(data map[string]any) licenceRemoteInfo {
|
||||
features := []string{}
|
||||
if arr, ok := data["features"].([]any); ok {
|
||||
for _, item := range arr {
|
||||
if s, ok := item.(string); ok {
|
||||
features = append(features, s)
|
||||
}
|
||||
}
|
||||
}
|
||||
return licenceRemoteInfo{
|
||||
Valid: jsonBool(data, "valid"),
|
||||
LicenseKey: jsonString(data, "license_key", "licenseKey"),
|
||||
ProductCode: jsonString(data, "product_code", "productCode"),
|
||||
Features: features,
|
||||
Status: jsonString(data, "status"),
|
||||
ExpiresAtUnix: jsonInt64(data, "expires_at_unix", "expiresAtUnix"),
|
||||
MaxDevices: jsonInt(data, "max_devices", "maxDevices"),
|
||||
PlanType: jsonString(data, "plan_type", "planType"),
|
||||
InGrace: jsonBool(data, "in_grace", "inGrace"),
|
||||
GraceDaysLeft: jsonInt(data, "grace_days_left", "graceDaysLeft"),
|
||||
ServerTime: jsonInt64(data, "server_time", "serverTime"),
|
||||
ActivationToken: jsonString(data, "activation_token", "activationToken"),
|
||||
Message: jsonString(data, "message"),
|
||||
}
|
||||
}
|
||||
|
||||
func verifyLicenceResponseSig(licenseKey string, data map[string]any) error {
|
||||
sigHex := jsonString(data, "sig")
|
||||
if sigHex == "" {
|
||||
// 开发环境可能未配 OFFLINE_LICENSE_SEED；生产应有签名
|
||||
return nil
|
||||
}
|
||||
pub, err := hex.DecodeString(offlineLicensePublicKeyHex)
|
||||
if err != nil || len(pub) != ed25519.PublicKeySize {
|
||||
return fmt.Errorf("离线验签公钥配置错误")
|
||||
}
|
||||
sig, err := hex.DecodeString(sigHex)
|
||||
if err != nil {
|
||||
return fmt.Errorf("授权响应签名无效")
|
||||
}
|
||||
valid := jsonBool(data, "valid")
|
||||
status := jsonString(data, "status")
|
||||
expiresUnix := jsonInt64(data, "expires_at_unix", "expiresAtUnix")
|
||||
serverTime := jsonInt64(data, "server_time", "serverTime")
|
||||
inGrace := jsonBool(data, "in_grace", "inGrace")
|
||||
maxDevices := jsonInt(data, "max_devices", "maxDevices")
|
||||
planType := jsonString(data, "plan_type", "planType")
|
||||
msg := "v1|" + licenseKey + "|" +
|
||||
strconv.FormatBool(valid) + "|" +
|
||||
status + "|" +
|
||||
strconv.FormatInt(expiresUnix, 10) + "|" +
|
||||
strconv.FormatInt(serverTime, 10) + "|" +
|
||||
strconv.FormatBool(inGrace) + "|" +
|
||||
strconv.Itoa(maxDevices) + "|" +
|
||||
planType
|
||||
if !ed25519.Verify(ed25519.PublicKey(pub), []byte(msg), sig) {
|
||||
return fmt.Errorf("授权响应签名校验失败（疑似假服务器）")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func remoteActivateLicence(licenseKey, deviceID string) (*licenceRemoteInfo, error) {
|
||||
body := map[string]string{
|
||||
"license_key": licenseKey,
|
||||
"device_id": deviceID,
|
||||
"device_name": "LokiStack",
|
||||
}
|
||||
env, err := postLicenceJSON("/v1/license/activate", body)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if envelopeCode(env) != 0 {
|
||||
msg := envelopeMessage(env)
|
||||
if msg == "" {
|
||||
msg = "激活失败"
|
||||
}
|
||||
return nil, fmt.Errorf("%s", msg)
|
||||
}
|
||||
data := envelopeData(env)
|
||||
if err := verifyLicenceResponseSig(licenseKey, data); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
info := parseRemoteInfo(data)
|
||||
if info.LicenseKey == "" {
|
||||
info.LicenseKey = licenseKey
|
||||
}
|
||||
if !info.Valid && info.Status == "" {
|
||||
// activate payload 可能不带 valid，视为成功
|
||||
info.Valid = true
|
||||
}
|
||||
return &info, nil
|
||||
}
|
||||
|
||||
func remoteVerifyLicence(licenseKey, deviceID string) (*licenceRemoteInfo, error) {
|
||||
body := map[string]string{
|
||||
"license_key": licenseKey,
|
||||
"device_id": deviceID,
|
||||
}
|
||||
env, err := postLicenceJSON("/v1/license/verify", body)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("network:%w", err)
|
||||
}
|
||||
// verify 可能是裸对象或 envelope
|
||||
var data map[string]any
|
||||
if _, ok := env["valid"]; ok {
|
||||
data = env
|
||||
} else if envelopeCode(env) == 0 {
|
||||
data = envelopeData(env)
|
||||
} else if c := envelopeCode(env); c != 0 {
|
||||
msg := envelopeMessage(env)
|
||||
if msg == "" {
|
||||
msg = "验证失败"
|
||||
}
|
||||
return nil, fmt.Errorf("rejected:%s", msg)
|
||||
} else {
|
||||
data = env
|
||||
}
|
||||
info := parseRemoteInfo(data)
|
||||
if info.LicenseKey == "" {
|
||||
info.LicenseKey = licenseKey
|
||||
}
|
||||
if !info.Valid {
|
||||
msg := info.Message
|
||||
if msg == "" {
|
||||
msg = envelopeMessage(env)
|
||||
}
|
||||
if msg == "" {
|
||||
msg = "许可证无效"
|
||||
}
|
||||
return nil, fmt.Errorf("rejected:%s", msg)
|
||||
}
|
||||
if err := verifyLicenceResponseSig(licenseKey, data); err != nil {
|
||||
return nil, fmt.Errorf("rejected:%v", err)
|
||||
}
|
||||
return &info, nil
|
||||
}
|
||||
|
||||
func remoteHeartbeatLicence(licenseKey, deviceID string) error {
|
||||
body := map[string]string{
|
||||
"license_key": licenseKey,
|
||||
"device_id": deviceID,
|
||||
}
|
||||
env, err := postLicenceJSON("/v1/license/heartbeat", body)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if envelopeCode(env) != 0 {
|
||||
return fmt.Errorf("%s", envelopeMessage(env))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
Reference in new issue
Block a user