entitlement

Documentation

Overview

Package entitlement manages local plan state and package access gates. Production builds will verify signed JWTs from the control plane; until then, dev license keys activate plans offline.

Index

• Constants
• func Clear() error
• func ControlPlaneURL() string
• func DevPrivateKey() (ed25519.PrivateKey, error)
• func DevPublicKey() (ed25519.PublicKey, error)
• func LocalControlPlaneURL() string
• func Path() (string, error)
• func ProdPublicKey() (ed25519.PublicKey, error)
• func RecordPackageInstall(name string) error
• func Save(s State) error
• func SignClaims(claims Claims, privateKey ed25519.PrivateKey, ttl time.Duration) (string, error)
• func TrustedPublicKeys() ([]ed25519.PublicKey, error)
• type Claims
  • func ParseToken(tokenString string, publicKey ed25519.PublicKey) (*Claims, error)
• type Plan
• type State
  • func Activate(key string) (State, error)
  • func ActivateDevKey(key string) (State, error)
  • func ApplyToken(token string) (State, error)
  • func Default() State
  • func Load() (State, error)
  • func Refresh() (State, error)
  • func StateFromClaims(c *Claims, token string) State
  • func (s State) EffectiveEntitlements() []string
  • func (s State) HasAllEntitlements(required []string) []string
  • func (s State) HasEntitlement(required string) bool
  • func (s State) IsExpired() bool

Constants

const DevPrivateKeyHex = "d8d14ea39788842c5151355fc582afe30ff498e4afbead6fecaeb8e443ce13da"

DevPrivateKeyHex is the Ed25519 seed for sandbox JWT signing (control plane dev only).

const ProdControlPlaneURL = "https://agentctl-api.myk8s.pp.ua"

ProdControlPlaneURL is the hosted control plane new licenses activate against by default — no env var needed for a real customer.

const ProdPublicKeyHex = "40fc1129bc55910ddc27f960ad3c360ef3744313b78d92b0e9f04275390b15a4"

ProdPublicKeyHex is the Ed25519 public key for the production control plane (agentctl-api.myk8s.pp.ua). Only the public half lives in the client/repo — the matching private key is held as a cluster secret and never committed.

Functions

func Clear

func Clear() error

Clear removes entitlement file (revert to free).

func ControlPlaneURL

func ControlPlaneURL() string

ControlPlaneURL returns AGENTCTL_CONTROL_PLANE_URL, or the production control plane when unset. Set AGENTCTL_CONTROL_PLANE_URL=http://localhost:8090 (or empty via AGENTCTL_CONTROL_PLANE_URL=-) to target a local sandbox instead.

func DevPrivateKey

func DevPrivateKey() (ed25519.PrivateKey, error)

DevPrivateKey returns the sandbox signing key (control plane dev only).

func DevPublicKey

func DevPublicKey() (ed25519.PublicKey, error)

DevPublicKey returns the sandbox verification key derived from the dev seed.

func LocalControlPlaneURL

func LocalControlPlaneURL() string

LocalControlPlaneURL is the default URL used by `m controlplane serve`.

func Path

func Path() (string, error)

Path returns ~/.config/m/entitlement.json.

func ProdPublicKey

func ProdPublicKey() (ed25519.PublicKey, error)

ProdPublicKey returns the production control-plane verification key.

func RecordPackageInstall

func RecordPackageInstall(name string) error

RecordPackageInstall appends an installed package name to state.

func Save

func Save(s State) error

Save persists entitlement state.

func SignClaims

func SignClaims(claims Claims, privateKey ed25519.PrivateKey, ttl time.Duration) (string, error)

SignClaims issues a JWT for the control plane (server-side).

func TrustedPublicKeys

func TrustedPublicKeys() ([]ed25519.PublicKey, error)

TrustedPublicKeys returns every key the client accepts entitlement JWTs from: production first, then the dev/sandbox key for local `m controlplane serve` testing.

Types

type Claims

type Claims struct {
	Plan         Plan     `json:"plan"`
	Entitlements []string `json:"entitlements,omitempty"`
	Packages     []string `json:"packages,omitempty"`
	Ver          int      `json:"ver,omitempty"`
	Subject      string   `json:"-"`
	jwt.RegisteredClaims
}

Claims is the signed entitlement payload exchanged with the control plane.

func ParseToken

func ParseToken(tokenString string, publicKey ed25519.PublicKey) (*Claims, error)

ParseToken verifies a JWT and returns claims using the given public key.

type Plan

type Plan string

Plan identifies the subscription tier.

const (
	PlanFree       Plan = "free"
	PlanPro        Plan = "pro"
	PlanTeam       Plan = "team"
	PlanEnterprise Plan = "enterprise"
)

type State

type State struct {
	Plan         Plan     `json:"plan"`
	Packages     []string `json:"packages,omitempty"`
	Entitlements []string `json:"entitlements,omitempty"`
	Subject      string   `json:"subject,omitempty"`
	LicenseHint  string   `json:"licenseHint,omitempty"`
	ActivatedAt  int64    `json:"activatedAt,omitempty"`
	ExpiresAt    int64    `json:"expiresAt,omitempty"`
	Source       string   `json:"source,omitempty"` // dev-key | control-plane
	Token        string   `json:"token,omitempty"`  // signed JWT from control plane
}

State is persisted under ~/.config/m/entitlement.json.

func Activate

func Activate(key string) (State, error)

Activate tries offline dev keys first, then the control plane when configured.

func ActivateDevKey

func ActivateDevKey(key string) (State, error)

ActivateDevKey maps offline dev keys to a plan (until control plane ships).

func ApplyToken

func ApplyToken(token string) (State, error)

ApplyToken verifies a JWT against every trusted public key (production, then dev/sandbox) and returns the resulting state.

func Default

func Default() State

Default returns the free-tier state.

func Load

func Load() (State, error)

Load reads entitlement state from disk. Missing file => free tier.

func Refresh

func Refresh() (State, error)

Refresh exchanges a cached JWT for a new one from the control plane.

func StateFromClaims

func StateFromClaims(c *Claims, token string) State

StateFromClaims maps verified JWT claims to persisted local state.

func (State) EffectiveEntitlements

func (s State) EffectiveEntitlements() []string

EffectiveEntitlements returns entitlement keys granted by the current plan.

func (State) HasAllEntitlements

func (s State) HasAllEntitlements(required []string) []string

HasAllEntitlements returns missing keys (empty slice = ok).

func (State) HasEntitlement

func (s State) HasEntitlement(required string) bool

HasEntitlement reports whether the user can use a required entitlement key.

func (State) IsExpired

func (s State) IsExpired() bool

IsExpired reports whether the license has passed ExpiresAt.