Add admin API to list licenses and create product keys.

Expose GET /v1/admin/licenses and POST /v1/admin/product-keys for the license manager app.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -56,6 +56,8 @@ npm test
 - `GET /v1/status?sub=...` → `{ revoked: boolean }`.
 - `POST /v1/admin/revoke` — `Authorization: Bearer <LICENSE_ADMIN_TOKEN>`, тело `{ "sub": "..." }`.
 - `POST /v1/admin/issue` — админская выдача (`sub`, `pid`, `iat`, `exp`, `did`).
+- `GET /v1/admin/licenses` — список продуктовых ключей с активациями и флагом `revoked`.
+- `POST /v1/admin/product-keys` — создание нового продуктового ключа (`pid`, `maxDevices`, `expiresAtSec`, опционально `key`, `sub`).
 - `GET /health` — `{ ok: true }`.
 
 ## Клиент

src/server.mjs

@@ -2,9 +2,8 @@ import { randomUUID } from 'node:crypto';
 import fs from 'node:fs';
 import http from 'node:http';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import { canonicalJson } from '../lib/canonicalJson.mjs';
 import { signPayload } from '../lib/signPayload.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -39,17 +38,26 @@ function readBody(req) {
   });
 }
 
-const privateKeyPem = process.env.LICENSE_PRIVATE_KEY_PEM;
+function checkAdmin(req, adminToken) {
-if (!privateKeyPem) {
+  const auth = req.headers.authorization ?? '';
-  console.error('Задайте LICENSE_PRIVATE_KEY_PEM (PKCS#8 PEM, Ed25519)');
+  const tok = auth.startsWith('Bearer ') ? auth.slice(7) : '';
-  process.exit(1);
+  return tok === adminToken;
 }
 
-const adminToken = process.env.LICENSE_ADMIN_TOKEN ?? 'change-me-admin';
+function generateProductKey() {
+  return `TTRPG-${randomUUID().toUpperCase()}`;
+}
 
-const port = Number(process.env.PORT ?? 3847);
+function generateSub() {
+  return `lic_${randomUUID().replace(/-/g, '')}`;
+}
 
-const server = http.createServer(async (req, res) => {
+export function createServer(options = {}) {
+  const privateKeyPem = options.privateKeyPem ?? process.env.LICENSE_PRIVATE_KEY_PEM;
+  const adminToken = options.adminToken ?? process.env.LICENSE_ADMIN_TOKEN ?? 'change-me-admin';
+  if (!privateKeyPem) throw new Error('LICENSE_PRIVATE_KEY_PEM required');
+
+  return http.createServer(async (req, res) => {
     try {
       const url = new URL(req.url ?? '/', `http://localhost`);
       if (req.method === 'GET' && url.pathname === '/v1/status') {
@@ -97,10 +105,52 @@ const server = http.createServer(async (req, res) => {
         return json(res, 200, { token, sub: pk.sub });
       }
 
+      if (req.method === 'GET' && url.pathname === '/v1/admin/licenses') {
+        if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
+        const data = readData();
+        const revokedSubs = Array.isArray(data.revokedSubs) ? data.revokedSubs : [];
+        const activations = data.activations ?? {};
+        const licenses = (data.productKeys ?? []).map((pk) => {
+          const devices = activations[pk.sub] ?? [];
+          return {
+            key: pk.key,
+            sub: pk.sub,
+            pid: pk.pid,
+            maxDevices: pk.maxDevices,
+            expiresAtSec: pk.expiresAtSec,
+            revoked: revokedSubs.includes(pk.sub),
+            activatedDevices: devices,
+            activatedCount: devices.length,
+          };
+        });
+        return json(res, 200, { licenses });
+      }
+
+      if (req.method === 'POST' && url.pathname === '/v1/admin/product-keys') {
+        if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
+        const raw = await readBody(req);
+        const body = JSON.parse(raw || '{}');
+        const now = Math.floor(Date.now() / 1000);
+        const entry = {
+          key: body.key ?? generateProductKey(),
+          sub: body.sub ?? generateSub(),
+          pid: body.pid ?? 'dnd_player',
+          maxDevices: body.maxDevices ?? 3,
+          expiresAtSec: body.expiresAtSec ?? now + 86400 * 365,
+        };
+        if (!entry.key || !entry.sub) return json(res, 400, { error: 'invalid_entry' });
+        const data = readData();
+        data.productKeys ??= [];
+        if (data.productKeys.some((x) => x.key === entry.key || x.sub === entry.sub)) {
+          return json(res, 409, { error: 'duplicate_key_or_sub' });
+        }
+        data.productKeys.push(entry);
+        writeData(data);
+        return json(res, 201, entry);
+      }
+
       if (req.method === 'POST' && url.pathname === '/v1/admin/revoke') {
-      const auth = req.headers.authorization ?? '';
+        if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
-      const tok = auth.startsWith('Bearer ') ? auth.slice(7) : '';
-      if (tok !== adminToken) return json(res, 401, { error: 'unauthorized' });
         const raw = await readBody(req);
         const body = JSON.parse(raw || '{}');
         const sub = body.sub;
@@ -113,9 +163,7 @@ const server = http.createServer(async (req, res) => {
       }
 
       if (req.method === 'POST' && url.pathname === '/v1/admin/issue') {
-      const auth = req.headers.authorization ?? '';
+        if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
-      const tok = auth.startsWith('Bearer ') ? auth.slice(7) : '';
-      if (tok !== adminToken) return json(res, 401, { error: 'unauthorized' });
         const raw = await readBody(req);
         const body = JSON.parse(raw || '{}');
         const now = Math.floor(Date.now() / 1000);
@@ -139,8 +187,22 @@ const server = http.createServer(async (req, res) => {
     } catch (e) {
       json(res, 500, { error: e instanceof Error ? e.message : String(e) });
     }
-});
+  });
+}
 
-server.listen(port, () => {
+const isMain =
+  process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url;
+
+if (isMain) {
+  const privateKeyPem = process.env.LICENSE_PRIVATE_KEY_PEM;
+  if (!privateKeyPem) {
+    console.error('Задайте LICENSE_PRIVATE_KEY_PEM (PKCS#8 PEM, Ed25519)');
+    process.exit(1);
+  }
+
+  const port = Number(process.env.PORT ?? 3847);
+  const server = createServer();
+  server.listen(port, () => {
     console.log(`DndGamePlayerLicenseServer listening on http://localhost:${port}`);
-});
+  });
+}

test/adminApi.test.mjs

@@ -0,0 +1,130 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import { generateKeyPairSync } from 'node:crypto';
+
+import { createServer } from '../src/server.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(__dirname, '..');
+
+function listen(server) {
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      resolve(server.address().port);
+    });
+  });
+}
+
+function request(port, method, pathname, { token, body } = {}) {
+  return new Promise((resolve, reject) => {
+    const headers = { 'Content-Type': 'application/json' };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const req = http.request(
+      { hostname: '127.0.0.1', port, method, path: pathname, headers },
+      (res) => {
+        const chunks = [];
+        res.on('data', (c) => chunks.push(c));
+        res.on('end', () => {
+          const raw = Buffer.concat(chunks).toString('utf8');
+          resolve({ status: res.statusCode, body: raw ? JSON.parse(raw) : null });
+        });
+      },
+    );
+    req.on('error', reject);
+    if (body) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+function makeServer(dataPath, adminToken = 'test-admin') {
+  const { privateKey } = generateKeyPairSync('ed25519');
+  const pem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  process.env.DND_LICENSE_DATA_PATH = dataPath;
+  const server = createServer({ privateKeyPem: pem, adminToken });
+  return { server, adminToken };
+}
+
+void test('GET /v1/admin/licenses returns enriched product keys', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.writeFileSync(
+    dataPath,
+    JSON.stringify({
+      productKeys: [
+        {
+          key: 'TTRPG-TEST-KEY',
+          sub: 'lic_test',
+          pid: 'dnd_player',
+          maxDevices: 2,
+          expiresAtSec: 1893456000,
+        },
+      ],
+      revokedSubs: ['lic_test'],
+      activations: { lic_test: ['dev1', 'dev2'] },
+    }),
+  );
+
+  const { server, adminToken } = makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
+    assert.equal(res.status, 200);
+    assert.equal(res.body.licenses.length, 1);
+    assert.equal(res.body.licenses[0].key, 'TTRPG-TEST-KEY');
+    assert.equal(res.body.licenses[0].revoked, true);
+    assert.deepEqual(res.body.licenses[0].activatedDevices, ['dev1', 'dev2']);
+    assert.equal(res.body.licenses[0].activatedCount, 2);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('POST /v1/admin/product-keys creates a new product key', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server, adminToken } = makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'POST', '/v1/admin/product-keys', {
+      token: adminToken,
+      body: { maxDevices: 5, expiresAtSec: 2000000000, pid: 'dnd_player' },
+    });
+    assert.equal(res.status, 201);
+    assert.match(res.body.key, /^TTRPG-/);
+    assert.match(res.body.sub, /^lic_/);
+    assert.equal(res.body.maxDevices, 5);
+    assert.equal(res.body.expiresAtSec, 2000000000);
+
+    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
+    assert.equal(data.productKeys.length, 2);
+    assert.ok(data.productKeys.some((x) => x.key === res.body.key));
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('admin endpoints reject missing token', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server } = makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'GET', '/v1/admin/licenses');
+    assert.equal(res.status, 401);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});