Revoke licenses by product key instead of shared sub.

Add revokedKeys storage and accept key in admin revoke API so DND/TTRPG keys with the same sub can be revoked independently.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/server.mjs

@@ -52,6 +52,24 @@ function generateSub() {
   return `lic_${randomUUID().replace(/-/g, '')}`;
 }
 
+function revokedKeys(data) {
+  return Array.isArray(data.revokedKeys) ? data.revokedKeys : [];
+}
+
+function revokedSubs(data) {
+  return Array.isArray(data.revokedSubs) ? data.revokedSubs : [];
+}
+
+function isProductKeyRevoked(data, productKey) {
+  const pk = data.productKeys?.find((x) => x.key === productKey);
+  if (!pk) return false;
+  return revokedKeys(data).includes(pk.key) || revokedSubs(data).includes(pk.sub);
+}
+
+function isSubRevoked(data, sub) {
+  return revokedSubs(data).includes(sub);
+}
+
 export function createServer(options = {}) {
   const privateKeyPem = options.privateKeyPem ?? process.env.LICENSE_PRIVATE_KEY_PEM;
   const adminToken = options.adminToken ?? process.env.LICENSE_ADMIN_TOKEN ?? 'change-me-admin';
@@ -64,7 +82,7 @@ export function createServer(options = {}) {
         const sub = url.searchParams.get('sub');
         if (!sub) return json(res, 400, { error: 'missing_sub' });
         const data = readData();
-        const revoked = Array.isArray(data.revokedSubs) && data.revokedSubs.includes(sub);
+        const revoked = isSubRevoked(data, sub);
         return json(res, 200, { revoked });
       }
 
@@ -78,7 +96,7 @@ export function createServer(options = {}) {
         const data = readData();
         const pk = data.productKeys?.find((x) => x.key === productKey);
         if (!pk) return json(res, 403, { error: 'unknown_product_key' });
-        if (data.revokedSubs?.includes(pk.sub)) return json(res, 403, { error: 'license_revoked' });
+        if (isProductKeyRevoked(data, productKey)) return json(res, 403, { error: 'license_revoked' });
 
         data.activations ??= {};
         const list = data.activations[pk.sub] ?? [];
@@ -108,7 +126,8 @@ export function createServer(options = {}) {
       if (req.method === 'GET' && url.pathname === '/v1/admin/licenses') {
         if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
         const data = readData();
-        const revokedSubs = Array.isArray(data.revokedSubs) ? data.revokedSubs : [];
+        const revokedSubsList = revokedSubs(data);
+        const revokedKeysList = revokedKeys(data);
         const activations = data.activations ?? {};
         const licenses = (data.productKeys ?? []).map((pk) => {
           const devices = activations[pk.sub] ?? [];
@@ -118,7 +137,7 @@ export function createServer(options = {}) {
             pid: pk.pid,
             maxDevices: pk.maxDevices,
             expiresAtSec: pk.expiresAtSec,
-            revoked: revokedSubs.includes(pk.sub),
+            revoked: revokedKeysList.includes(pk.key) || revokedSubsList.includes(pk.sub),
             activatedDevices: devices,
             activatedCount: devices.length,
           };
@@ -153,11 +172,19 @@ export function createServer(options = {}) {
         if (!checkAdmin(req, adminToken)) return json(res, 401, { error: 'unauthorized' });
         const raw = await readBody(req);
         const body = JSON.parse(raw || '{}');
+        const key = body.key;
         const sub = body.sub;
-        if (!sub) return json(res, 400, { error: 'missing_sub' });
+        if (!key && !sub) return json(res, 400, { error: 'missing_key_or_sub' });
         const data = readData();
-        data.revokedSubs ??= [];
-        if (!data.revokedSubs.includes(sub)) data.revokedSubs.push(sub);
+        if (key) {
+          const pk = data.productKeys?.find((x) => x.key === key);
+          if (!pk) return json(res, 404, { error: 'unknown_product_key' });
+          data.revokedKeys ??= [];
+          if (!data.revokedKeys.includes(key)) data.revokedKeys.push(key);
+        } else {
+          data.revokedSubs ??= [];
+          if (!data.revokedSubs.includes(sub)) data.revokedSubs.push(sub);
+        }
         writeData(data);
         return json(res, 200, { ok: true });
       }