Add download stats, key deletion, batch creation, and newest-first listing.

Track landing downloads per platform/month, support admin delete and bulk key issue, and sort licenses by createdAtSec.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/server.mjs

@@ -5,11 +5,19 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import {
+  buildProductKeyEntry,
+  deleteProductKey,
   enrichLicenseEntry,
   ensurePeriodActivated,
-  parseProductKeyExpiry,
   resolveTokenExp,
+  sortLicensesNewestFirst,
 } from '../lib/licenseLogic.mjs';
+import {
+  getDownloadStatsForMonth,
+  listDownloadMonths,
+  monthKeyFromDate,
+  recordDownload,
+} from '../lib/downloadStats.mjs';
 import { signPayload } from '../lib/signPayload.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -153,39 +161,91 @@ export function createServer(options = {}) {
         const revokedSubsList = revokedSubs(data);
         const revokedKeysList = revokedKeys(data);
         const activations = data.activations ?? {};
-        const licenses = (data.productKeys ?? []).map((pk) => {
-          const devices = activations[pk.sub] ?? [];
-          const revoked = revokedKeysList.includes(pk.key) || revokedSubsList.includes(pk.sub);
-          return enrichLicenseEntry(pk, devices, revoked);
-        });
+        const licenses = sortLicensesNewestFirst(
+          (data.productKeys ?? []).map((pk) => {
+            const devices = activations[pk.sub] ?? [];
+            const revoked = revokedKeysList.includes(pk.key) || revokedSubsList.includes(pk.sub);
+            return enrichLicenseEntry(pk, devices, revoked);
+          }),
+        );
         return json(res, 200, { licenses });
       }
 
+      if (req.method === 'GET' && url.pathname === '/v1/admin/stats/downloads') {
+        if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
+        const data = readData();
+        const monthParam = url.searchParams.get('month');
+        if (monthParam && monthParam !== 'all') {
+          return json(res, 200, getDownloadStatsForMonth(data, monthParam));
+        }
+        const months = listDownloadMonths(data);
+        return json(res, 200, {
+          months,
+          currentMonth: getDownloadStatsForMonth(data, monthKeyFromDate()),
+        });
+      }
+
+      if (req.method === 'POST' && url.pathname === '/v1/track/download') {
+        const raw = await readBody(req);
+        const body = JSON.parse(raw || '{}');
+        const data = readData();
+        const result = recordDownload(data, body.platform);
+        if (!result.ok) return json(res, 400, { error: result.error });
+        writeData(data);
+        return json(res, 200, { ok: true, ...result });
+      }
+
+      if (req.method === 'POST' && url.pathname === '/v1/admin/product-keys/delete') {
+        if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
+        const raw = await readBody(req);
+        const body = JSON.parse(raw || '{}');
+        const key = body.key;
+        if (!key) return json(res, 400, { error: 'missing_key' });
+        const data = readData();
+        const result = deleteProductKey(data, key);
+        if (!result.ok) return json(res, 404, { error: result.error });
+        writeData(data);
+        return json(res, 200, { ok: true, deleted: result.deleted });
+      }
+
       if (req.method === 'POST' && url.pathname === '/v1/admin/product-keys') {
         if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
         const raw = await readBody(req);
         const body = JSON.parse(raw || '{}');
-        const expiry = parseProductKeyExpiry(body);
-        if (!expiry.ok) return json(res, 400, { error: expiry.error });
+        const now = Math.floor(Date.now() / 1000);
+        const countRaw = body.count ?? 1;
+        const count = Number(countRaw);
+        if (!Number.isInteger(count) || count < 1 || count > 100) {
+          return json(res, 400, { error: 'invalid_count' });
+        }
 
-        const entry = {
-          key: body.key ?? generateProductKey(),
-          sub: body.sub ?? generateSub(),
-          pid: body.pid ?? 'dnd_player',
-          maxDevices: body.maxDevices ?? 3,
-          ...(expiry.expiresAtSec != null
-            ? { expiresAtSec: expiry.expiresAtSec }
-            : { validDays: expiry.validDays }),
-        };
-        if (!entry.key || !entry.sub) return json(res, 400, { error: 'invalid_entry' });
         const data = readData();
         data.productKeys ??= [];
-        if (data.productKeys.some((x) => x.key === entry.key || x.sub === entry.sub)) {
-          return json(res, 409, { error: 'duplicate_key_or_sub' });
+        const created = [];
+
+        for (let i = 0; i < count; i += 1) {
+          const itemBody = {
+            ...body,
+            key: count === 1 ? body.key : undefined,
+            sub: count === 1 ? body.sub : undefined,
+          };
+          const built = buildProductKeyEntry(itemBody, {
+            generateKey: generateProductKey,
+            generateSub: generateSub,
+            nowSec: now + i,
+          });
+          if (!built.ok) return json(res, 400, { error: built.error });
+
+          if (data.productKeys.some((x) => x.key === built.entry.key || x.sub === built.entry.sub)) {
+            return json(res, 409, { error: 'duplicate_key_or_sub' });
+          }
+          data.productKeys.push(built.entry);
+          created.push(built.entry);
         }
-        data.productKeys.push(entry);
+
         writeData(data);
-        return json(res, 201, entry);
+        if (count === 1) return json(res, 201, created[0]);
+        return json(res, 201, { keys: created, count: created.length });
       }
 
       if (req.method === 'POST' && url.pathname === '/v1/admin/revoke') {