Add download stats, key deletion, batch creation, and newest-first listing.

Track landing downloads per platform/month, support admin delete and bulk key issue, and sort licenses by createdAtSec.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/adminApi.test.mjs

@@ -209,6 +209,117 @@ void test('POST /v1/admin/revoke by key revokes only that product key', async ()
   }
 });
 
+void test('POST /v1/admin/product-keys/delete removes key from data', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.writeFileSync(
+    dataPath,
+    JSON.stringify({
+      productKeys: [
+        {
+          key: 'TTRPG-DELETE-ME',
+          sub: 'lic_delete',
+          pid: 'dnd_player',
+          maxDevices: 1,
+          validDays: 30,
+          createdAtSec: 100,
+        },
+      ],
+      revokedSubs: [],
+      revokedKeys: ['TTRPG-DELETE-ME'],
+      activations: { lic_delete: ['dev1'] },
+    }),
+  );
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const del = await request(port, 'POST', '/v1/admin/product-keys/delete', {
+      token: adminToken,
+      body: { key: 'TTRPG-DELETE-ME' },
+    });
+    assert.equal(del.status, 200);
+    assert.equal(del.body.ok, true);
+
+    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
+    assert.equal(data.productKeys.length, 0);
+    assert.equal(data.activations.lic_delete, undefined);
+    assert.equal(data.revokedKeys.length, 0);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('POST /v1/admin/product-keys batch creates multiple keys', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'POST', '/v1/admin/product-keys', {
+      token: adminToken,
+      body: { count: 3, maxDevices: 2, validDays: 30 },
+    });
+    assert.equal(res.status, 201);
+    assert.equal(res.body.count, 3);
+    assert.equal(res.body.keys.length, 3);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('GET /v1/admin/licenses sorts newest first by createdAtSec', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.writeFileSync(
+    dataPath,
+    JSON.stringify({
+      productKeys: [
+        { key: 'OLD', sub: 'lic_old', pid: 'dnd_player', maxDevices: 1, validDays: 1, createdAtSec: 100 },
+        { key: 'NEW', sub: 'lic_new', pid: 'dnd_player', maxDevices: 1, validDays: 1, createdAtSec: 999 },
+      ],
+      revokedSubs: [],
+      revokedKeys: [],
+      activations: {},
+    }),
+  );
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const list = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
+    assert.equal(list.body.licenses[0].key, 'NEW');
+    assert.equal(list.body.licenses[1].key, 'OLD');
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('POST /v1/track/download and GET stats', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const track = await request(port, 'POST', '/v1/track/download', { body: { platform: 'windows' } });
+    assert.equal(track.status, 200);
+
+    const stats = await request(port, 'GET', '/v1/admin/stats/downloads', { token: adminToken });
+    assert.equal(stats.status, 200);
+    assert.ok(stats.body.currentMonth.windows >= 1);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
 void test('admin endpoints reject missing token', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
   const dataPath = path.join(tmp, 'data.json');

test/downloadStats.test.mjs

@@ -0,0 +1,45 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  getDownloadStatsForMonth,
+  listDownloadMonths,
+  monthKeyFromDate,
+  recordDownload,
+} from '../lib/downloadStats.mjs';
+
+void test('recordDownload increments platform counts by month', () => {
+  const data = {};
+  const r1 = recordDownload(data, 'windows', new Date('2026-07-15T12:00:00Z'));
+  assert.equal(r1.ok, true);
+  assert.equal(r1.month, '2026-07');
+  assert.equal(r1.count, 1);
+
+  recordDownload(data, 'macos', new Date('2026-07-20T12:00:00Z'));
+  recordDownload(data, 'windows', new Date('2026-07-21T12:00:00Z'));
+
+  const stats = getDownloadStatsForMonth(data, '2026-07');
+  assert.equal(stats.windows, 2);
+  assert.equal(stats.macos, 1);
+  assert.equal(stats.linux, 0);
+  assert.equal(stats.total, 3);
+});
+
+void test('recordDownload rejects invalid platform', () => {
+  const data = {};
+  const r = recordDownload(data, 'android');
+  assert.equal(r.ok, false);
+});
+
+void test('listDownloadMonths returns sorted keys', () => {
+  const data = {
+    downloadStats: {
+      byMonth: {
+        '2026-05': { windows: 1, macos: 0, linux: 0 },
+        '2026-07': { windows: 2, macos: 0, linux: 0 },
+      },
+    },
+  };
+  assert.deepEqual(listDownloadMonths(data), ['2026-07', '2026-05']);
+  assert.equal(monthKeyFromDate(new Date('2026-03-01T00:00:00Z')), '2026-03');
+});