# DashCaddy License Server

Stripe-driven license automation for DashCaddy.

## Purpose

This service is the billing and license orchestration layer for DashCaddy.
It receives Stripe webhooks, maps purchases/subscriptions to license entitlements,
and exposes license validation/deactivation endpoints for DashCaddy instances.

## Planned responsibilities

- Verify Stripe webhook signatures
- Track customers, subscriptions, invoices, and purchases
- Generate or extend DashCaddy licenses
- Expose `/api/license/validate` for DashCaddy activation
- Expose `/api/license/deactivate` for DashCaddy deactivation
- Support renewals, expirations, cancellations, and grace periods

## Architecture

- **Stripe** is billing truth
- **License server database** is entitlement truth
- **DashCaddy app** remains the consumer of license validation
- Existing DashCaddy license logic should be reused, not reinvented

## Next steps

1. Extract/reuse the current DashCaddy license key generation and verification logic
2. Define DB schema for customers, licenses, activations, and Stripe mapping
3. Implement webhook ingestion and event processing
4. Implement validate/deactivate endpoints
5. Add admin tooling for manual recovery and support workflows


## Current implementation status

Implemented now:
- Stripe Checkout session creation
- Stripe webhook ingestion scaffold with subscription/license sync
- File-backed persistence for customers, subscriptions, and licenses
- License validation endpoint
- License deactivation endpoint
- One-machine-at-a-time activation enforcement

Still required before production:
- durable database
- email delivery for license keys
- deployment on Contabo
- Stripe webhook registration
- end-to-end live checkout verification

## Environment

```env
PORT=3010
APP_BASE_URL=https://licenses.dashcaddy.net
DASHCADDY_WEBSITE_URL=https://dashcaddy.net
STRIPE_SECRET_KEY=sk_live_...
STRIPE_PUBLISHABLE_KEY=pk_live_...
STRIPE_WEBHOOK_SECRET=whsec_...
DATA_DIR=./data
```

## HTTP endpoints

- `GET /health`
- `GET /api/public/config`
- `GET /api/public/plans`
- `POST /api/checkout/session`
- `POST /api/stripe/webhook`
- `POST /api/license/validate`
- `POST /api/license/deactivate`
- `GET /api/admin/debug/store`
