Hermes
d478268de6
Site-vs-product audit (2026-10-09, owner decision: "advertise as Premium")
reconciles the entitlement triangle: marketing copy <-> PREMIUM_FEATURES
<-> license-server grant list.
- Fleet: the pricing page has always sold Multi-Host Fleet Management as
Premium; code never gated it. Added fleet to PREMIUM_FEATURES and mounted
requirePremium('fleet') at the ROUTER level (app.js) so every current AND
future /fleet/* sub-route inherits the gate (fail-closed for new endpoints).
License-server side: plans.js grants fleet for new activations; existing
premium license records backfilled (ops, DNS-license-server).
- Workflows + auto-backup: these were requirePremium-gated in routes since
forever but absent from PREMIUM_FEATURES — the offline path could never
grant them and the site never advertised them. Listed them (descriptions
taken from bundled-workflows.js + backups/schedule schema fields) so the
single source of truth now covers every gated feature; offline migration
(below) grants them to existing activations; server grant list updated.
- Offline activation forward-migration: load() now refreshes an OFFLINE
activation's features snapshot to the current PREMIUM_FEATURES set when
entries are missing (exactly what re-activating the same code today would
store). ONLINE activations are never touched — the license server stays
authoritative across the network boundary; this is the creator's local
build-to-build coherence rule, not an entitlement widening over an
external service. Persisted via credential store; in-memory state is
correct even if persistence fails (warn, not fail).
- GET /api/v1/capabilities (public, like /version): machine-readable ground
truth of the RUNNING build — version, template count + categories, MCP
tool names, protocol revisions, premium features, language count. Every
number derived from the same modules the product uses (no drift by
construction). Registered in PUBLIC_ROUTES (exact:true, GET), added to
public-routes-drift.test.js directMounts, guarded like /version.
No secrets, no host data (tested).
- 8 new executed tests: fleet 403-on-free / pass-on-premium through the REAL
requirePremium middleware (duck-typed LicenseManager instance, prototype
preserved), hasFeature fallback, offline migration (persisted + in-memory),
online NOT migrated (valid bounded cache stub incl. lastOnlineValidatedAt),
capabilities payload == module-derived values (78 templates/17 cats/31
langs/fleet present), no-secrets scan of the payload.
Tests: dc165 8/8; license-manager 76; tier-enforcement 21; public-routes-
drift + composition-root unchanged green (119 combined on the targeted run).
76 lines
3.0 KiB
JavaScript
76 lines
3.0 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* DC-165: Public capability manifest — one machine-readable ground truth
|
|
* about what THIS running DashCaddy build actually does.
|
|
*
|
|
* Purpose (Sami 2026-10-09: "It should be LLM readable"): the marketing
|
|
* site, llms.txt, docs and the live product must never disagree. Static
|
|
* prose drifts (77 vs 78 templates proved it). This endpoint lets any AI
|
|
* assistant — or the site build itself — read the truth from the running
|
|
* product: exact version, template count + categories, MCP tool list,
|
|
* premium feature list, protocol revisions. Every number is derived from
|
|
* the same modules the product uses at runtime; nothing is hand-typed, so
|
|
* it cannot drift by construction.
|
|
*
|
|
* Public by design (like /version and /health): no secrets, no usage data,
|
|
* no hostnames — only static capability facts of the installed build.
|
|
* Registered in PUBLIC_ROUTES (middleware.js, exact:true, GET) and guarded
|
|
* by public-routes-drift.test.js like every other public route.
|
|
*
|
|
* buildRouter() is attached as a property so the drift test's router-walk
|
|
* sees the route (routes/version.js convention).
|
|
*/
|
|
|
|
const express = require('express');
|
|
const { ok } = require('../src/utils/responses');
|
|
const versionRoute = require('./version');
|
|
|
|
function buildRouter(deps = {}) {
|
|
const router = express.Router();
|
|
const asyncHandler = deps.asyncHandler
|
|
|| ((fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next));
|
|
|
|
router.get('/capabilities', asyncHandler(async (req, res) => {
|
|
const { APP_TEMPLATES } = require('../src/docker/app-templates');
|
|
const templates = APP_TEMPLATES || {};
|
|
const templateIds = Object.keys(templates);
|
|
const categories = {};
|
|
for (const id of templateIds) {
|
|
const c = (templates[id] && templates[id].category) || 'uncategorized';
|
|
categories[c] = (categories[c] || 0) + 1;
|
|
}
|
|
|
|
const { TOOLS } = require('../src/mcp/mcp-core');
|
|
const tools = (TOOLS || []).map((t) => t.name).sort();
|
|
|
|
const { PREMIUM_FEATURES } = require('../src/managers/license-manager');
|
|
const premiumFeatures = Object.keys(PREMIUM_FEATURES || {}).sort();
|
|
|
|
const i18n = require('../src/utilities/i18n');
|
|
let languageCount = null;
|
|
try { languageCount = i18n.getSupportedLanguages().length; } catch (_) { /* optional surface */ }
|
|
|
|
ok(res, {
|
|
product: 'dashcaddy',
|
|
version: versionRoute.getVersion(),
|
|
description: 'Self-hosting dashboard: one-click Docker app deployment with automatic SSL, DNS and reverse proxy; AI intent router; MCP control plane.',
|
|
templates: { count: templateIds.length, categories },
|
|
mcp: {
|
|
transport: 'streamable-http',
|
|
protocolVersions: ['2025-03-10', '2024-11-05'],
|
|
endpoint: '/api/v1/mcp',
|
|
tools
|
|
},
|
|
premiumFeatures,
|
|
api: { restMount: '/api/v1' },
|
|
i18n: { languageCount }
|
|
});
|
|
}));
|
|
|
|
return router;
|
|
}
|
|
|
|
module.exports = { buildRouter };
|
|
module.exports.default = function factory(ctx) { return buildRouter(ctx); };
|