Adds a new DashCaddy app template that ships a glass-front vintage console
stereo UI tuning curated real internet-radio streams through a beautiful
analog control surface.
Adds src/docker/app-templates.js:vintage-radio with:
- Wooden end caps with Power / Mode / Mute knobs and a brushed-metal face
visible behind a smoked-glass overlay
- Slide-rule tuning rail with red cursor + flag and click/drag/touch/keyboard
- Twin glowing VU meters with smooth needle animation
- Vertical volume slider, prev/next preset buttons, signal LED
- MODE knob filters visible stations by genre (ALL/AMBIENT/ROCK/MIXED);
dial respects the active filter without resetting it
- 18 curated real streams (SomaFM, KEXP, Radio Paradise, etc.) live-verified
- Persistent visible MODE label and dynamic aria-label
- Narrow-screen zoom-based responsive scaling at 760/600/480px
Bundles dashcaddy-api/static-sites/vintage-radio/:
- web/index.html, web/radio.css, web/radio.js, web/stations.json
- install.sh (copies assets to /opt/vintage-radio/web, DASHCADDY_ROOT override)
- install-installer.sh (installs install.sh into /usr/local/bin)
Verification:
- 20/20 app-templates test suite passes
- Headless Chromium: 18 stations render, dial+filter+power all functional
with zero page errors
- 18/18 stream URLs return HTTP 200 from this host
- Codex grade B (urn:ump:ekaap5xpggifl76tia3dddq5iv5bi23rlvevbn22mux62yfkiexa)
First pricing enforcement. Per PRODUCT-SPEC-DECISIONS.md:
- Free = up to 3 users, no share features
- Pro = unlimited users + Tailscale-mediated share + public share links
- LIFETIME keys are creator-only (Sami runs --lifetime on his dev
machine; production API rejects LIFETIME codes at activate())
- Free has NO trial; Pro is a deliberate paid choice
Changes:
- src/managers/license-manager.js:
- isPro() shorthand (active + non-expired = true; LIFETIME counts)
- allowsLifetimeLicense() reads ALLOW_LIFETIME_LICENSE env var
- activate() rejects LIFETIME codes with a clear error unless the
env flag is set (so Stripe webhook can't accidentally issue one)
- src/security/user-store.js: countUsers() helper for the tier gate
- src/utilities/errors.js: PaymentRequiredError (HTTP 402, code DC-402)
- routes/auth/admin.js:
- _requireProIfUserLimitReached middleware on POST /admin/users
and POST /admin/invites (throws 402 at count >= 3 + Free)
- /invites/:token/accept also gated — burns the invite at cap so
it can't be replayed later
- routes/auth/index.js: bridge licenseManager + userStore onto
req.app.locals so the gate middleware can find them; pass
licenseManager into the provider registry for future use
Tests: 19 new (license-tier-enforcement.test.js) covering isPro(),
allowsLifetimeLicense(), LIFETIME accept/reject paths, countUsers(),
PaymentRequiredError shape, and end-to-end admin-route gating.
Full suite: 1317/1317 passing across 50 suites.
Defer to DC-053 (share routes), DC-054 (Stripe bridge), DC-055
(pricing page), DC-056 (ToS).
Sami's explicit decisions:
- Free is completely free — no Pro trial, no time-limited upsells.
Pro is a deliberate paid choice. Update pricing language in
PRODUCT-SPEC-DECISIONS.md so anyone reading it doesn't assume
there's a hidden trial period.
- Lifetime keys are creator-only (Sami runs license-keygen.js
--lifetime on his dev machine; the API rejects LIFETIME codes
at verifyCode time). No paid customer can ever buy or receive
a lifetime key — they get 30/90/180/365-day keys. Update both
PRODUCT-SPEC-DECISIONS.md and DC-052 in BACKLOG.md to spell
this out so the Stripe webhook (DC-054) doesn't accidentally
generate a LIFETIME for a buyer.
Captures the 14 product-spec decisions locked today with Sami:
- Time-based pricing: 30/90/180/365 day tiers at $20/$50/$70/$99
- Free = up to 3 users, Pro = unlimited
- Free = local-only; Pro adds Tailscale-mediated share + public share links
- Stripe Checkout, USD-only, optional dashcaddy.net account
- LIFETIME keys are creator-only (no public exposure)
- Use existing license-keygen, no new auth system
- Invitees MUST use email magic link (email = identity for non-host users)
BACKLOG gets 5 new build tickets:
- DC-052: License-tier enforcement (cap Free at 3 users, gate share on Pro)
- DC-053: Public + Tailscale-mediated share routes (the killer Pro feature)
- DC-054: Stripe webhook bridge for auto-issuing license keys
- DC-055: dashcaddy.net/pricing page + Stripe Checkout
- DC-056: ToS + Privacy Policy pages (GDPR-aware)
No code changes — pure planning artifacts. Code work begins next.
Hermes Agent