Add admin API to list licenses and create product keys.

Expose GET /v1/admin/licenses and POST /v1/admin/product-keys for the license manager app.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/adminApi.test.mjs

@@ -0,0 +1,130 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import { generateKeyPairSync } from 'node:crypto';
+
+import { createServer } from '../src/server.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(__dirname, '..');
+
+function listen(server) {
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      resolve(server.address().port);
+    });
+  });
+}
+
+function request(port, method, pathname, { token, body } = {}) {
+  return new Promise((resolve, reject) => {
+    const headers = { 'Content-Type': 'application/json' };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const req = http.request(
+      { hostname: '127.0.0.1', port, method, path: pathname, headers },
+      (res) => {
+        const chunks = [];
+        res.on('data', (c) => chunks.push(c));
+        res.on('end', () => {
+          const raw = Buffer.concat(chunks).toString('utf8');
+          resolve({ status: res.statusCode, body: raw ? JSON.parse(raw) : null });
+        });
+      },
+    );
+    req.on('error', reject);
+    if (body) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+function makeServer(dataPath, adminToken = 'test-admin') {
+  const { privateKey } = generateKeyPairSync('ed25519');
+  const pem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  process.env.DND_LICENSE_DATA_PATH = dataPath;
+  const server = createServer({ privateKeyPem: pem, adminToken });
+  return { server, adminToken };
+}
+
+void test('GET /v1/admin/licenses returns enriched product keys', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.writeFileSync(
+    dataPath,
+    JSON.stringify({
+      productKeys: [
+        {
+          key: 'TTRPG-TEST-KEY',
+          sub: 'lic_test',
+          pid: 'dnd_player',
+          maxDevices: 2,
+          expiresAtSec: 1893456000,
+        },
+      ],
+      revokedSubs: ['lic_test'],
+      activations: { lic_test: ['dev1', 'dev2'] },
+    }),
+  );
+
+  const { server, adminToken } = makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
+    assert.equal(res.status, 200);
+    assert.equal(res.body.licenses.length, 1);
+    assert.equal(res.body.licenses[0].key, 'TTRPG-TEST-KEY');
+    assert.equal(res.body.licenses[0].revoked, true);
+    assert.deepEqual(res.body.licenses[0].activatedDevices, ['dev1', 'dev2']);
+    assert.equal(res.body.licenses[0].activatedCount, 2);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('POST /v1/admin/product-keys creates a new product key', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server, adminToken } = makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'POST', '/v1/admin/product-keys', {
+      token: adminToken,
+      body: { maxDevices: 5, expiresAtSec: 2000000000, pid: 'dnd_player' },
+    });
+    assert.equal(res.status, 201);
+    assert.match(res.body.key, /^TTRPG-/);
+    assert.match(res.body.sub, /^lic_/);
+    assert.equal(res.body.maxDevices, 5);
+    assert.equal(res.body.expiresAtSec, 2000000000);
+
+    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
+    assert.equal(data.productKeys.length, 2);
+    assert.ok(data.productKeys.some((x) => x.key === res.body.key));
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('admin endpoints reject missing token', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server } = makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'GET', '/v1/admin/licenses');
+    assert.equal(res.status, 401);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});