Add download stats, key deletion, batch creation, and newest-first listing.

Track landing downloads per platform/month, support admin delete and bulk key issue, and sort licenses by createdAtSec.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/adminApi.test.mjs

@@ -209,6 +209,117 @@ void test('POST /v1/admin/revoke by key revokes only that product key', async ()
   }
 });
 
+void test('POST /v1/admin/product-keys/delete removes key from data', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.writeFileSync(
+    dataPath,
+    JSON.stringify({
+      productKeys: [
+        {
+          key: 'TTRPG-DELETE-ME',
+          sub: 'lic_delete',
+          pid: 'dnd_player',
+          maxDevices: 1,
+          validDays: 30,
+          createdAtSec: 100,
+        },
+      ],
+      revokedSubs: [],
+      revokedKeys: ['TTRPG-DELETE-ME'],
+      activations: { lic_delete: ['dev1'] },
+    }),
+  );
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const del = await request(port, 'POST', '/v1/admin/product-keys/delete', {
+      token: adminToken,
+      body: { key: 'TTRPG-DELETE-ME' },
+    });
+    assert.equal(del.status, 200);
+    assert.equal(del.body.ok, true);
+
+    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
+    assert.equal(data.productKeys.length, 0);
+    assert.equal(data.activations.lic_delete, undefined);
+    assert.equal(data.revokedKeys.length, 0);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('POST /v1/admin/product-keys batch creates multiple keys', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'POST', '/v1/admin/product-keys', {
+      token: adminToken,
+      body: { count: 3, maxDevices: 2, validDays: 30 },
+    });
+    assert.equal(res.status, 201);
+    assert.equal(res.body.count, 3);
+    assert.equal(res.body.keys.length, 3);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('GET /v1/admin/licenses sorts newest first by createdAtSec', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.writeFileSync(
+    dataPath,
+    JSON.stringify({
+      productKeys: [
+        { key: 'OLD', sub: 'lic_old', pid: 'dnd_player', maxDevices: 1, validDays: 1, createdAtSec: 100 },
+        { key: 'NEW', sub: 'lic_new', pid: 'dnd_player', maxDevices: 1, validDays: 1, createdAtSec: 999 },
+      ],
+      revokedSubs: [],
+      revokedKeys: [],
+      activations: {},
+    }),
+  );
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const list = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
+    assert.equal(list.body.licenses[0].key, 'NEW');
+    assert.equal(list.body.licenses[1].key, 'OLD');
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('POST /v1/track/download and GET stats', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const track = await request(port, 'POST', '/v1/track/download', { body: { platform: 'windows' } });
+    assert.equal(track.status, 200);
+
+    const stats = await request(port, 'GET', '/v1/admin/stats/downloads', { token: adminToken });
+    assert.equal(stats.status, 200);
+    assert.ok(stats.body.currentMonth.windows >= 1);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
 void test('admin endpoints reject missing token', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
   const dataPath = path.join(tmp, 'data.json');