5 Commits

Author	SHA1	Message	Date
Anso	865d792874	feat(pricing): collapse to two tiers (#1309) ... * feat(pricing): collapse to two tiers (Community + Admiral) Collapse Sencho's pricing from three tiers (Community / Skipper / Admiral) to two: a generous free Community tier and a single paid Admiral tier. The Skipper tier is removed. Now free in Community: auto-heal, auto-update, scheduled operations, webhooks, notification routing, Fleet Actions and bulk operations, SSO preset providers (Google / GitHub / Okta), unlimited users with admin and viewer roles, and deploy safety (atomic deploys, auto-rollback, and one-click rollback). Admiral (paid) is focused on running and governing a fleet: blueprints, Fleet Secrets, deploy enforcement, vulnerability report export, audit log, host console, private registries, mesh networking, node cordon, managed cloud backup, LDAP / Active Directory SSO, and the advanced RBAC roles (deployer, node-admin, auditor) with per-resource scoped assignments. Internally the license variant distinction is removed so tier is binary (community / paid). License validation still verifies the Lemon Squeezy store and product before granting paid status. Docs and the contributor guide are updated to the two-tier model. * docs(pricing): correct licensing page to two-tier pricing and tidy stale tier wording The licensing docs page kept the old Admiral pricing plus a Founder Lifetime column and an Enterprise paragraph after the two-tier collapse. Update it to $12/month or $99/year, drop the lifetime and Enterprise content, and link to the pricing page for current pricing. Also fix stale "Skipper" wording in CLA.md, SUPPORT.md, one test title, and three test comments. Historical CHANGELOG entries and the retired-Skipper license-guard test are intentionally left as-is. * docs: align licensing and SSO pages with the two-tier model Correct the SSO overview so the Google, GitHub, and Okta presets read as available on every tier, matching the provider table; only LDAP and Active Directory require Sencho Admiral. Remove the lifetime-plan references from the licensing, settings, and troubleshooting pages so they reflect subscription-only Admiral pricing. * fix(rbac): omit scoped permissions from /me on the Community tier Scoped role assignments only take effect on the paid tier, but GET /api/permissions/me returned them unconditionally, so a downgraded instance with leftover assignments rendered per-resource affordances the API then rejected with 403. The endpoint now mirrors the permission middleware and includes scoped permissions only on the paid tier. Adds a regression test covering the downgrade case. * docs: use custom-pricing wording on the contact page The two-tier model has no Enterprise tier; reword the contact page's enterprise pricing/deals to custom pricing/deals so it does not imply a tier that no longer exists.	2026-06-04 17:45:53 -04:00
Anso	0683aa9395	fix(settings): reflect role, tier, and node scope in settings panels (#1300) ... * fix(settings): reflect role, tier, and node scope in settings panels Three gate fixes so the Settings panels match what the backend enforces. Non-admin roles saw editable fields and a Save button on System Limits, Developer, and App Store, but writes require admin, so Save always failed. These panels now render read-only for non-admins (controls disabled, Save hidden) while still showing the values. The Developer panel is node-scoped but read and wrote the controlling instance regardless of the selected node, so a remote node's debug mode and retention windows could not be changed from the UI. It now targets the active node like System Limits. The settings shell derived the Admiral entitlement locally; it now consumes the backend-provided value the API authorizes against, and that value is corrected to require an active paid tier so an expired Admiral license no longer reports as Admiral. * fix(settings): gate audit_retention_days writes behind Admiral audit_retention_days configures the Admiral-only audit log (the audit-log routes require Admiral, and the Developer settings UI only shows the field to Admiral operators), but the settings POST/PATCH handlers only required an admin role. A non-Admiral admin (for example Skipper, or an expired-Admiral admin whose tier dropped to community) could still set it through the API. Gate writes to that key with requireAdmiral on both the single-key POST and the bulk PATCH paths, matching the audit-log routes and the UI. Other keys remain writable by any admin. * fix(settings): reject unknown keys on PATCH instead of silently stripping The bulk settings PATCH validated the body with a Zod object schema that strips unknown keys by default, so a request carrying a disallowed key (for example an auth_* secret) returned 200 as a no-op instead of being rejected. No secret was written, but it diverged from the single-key POST path, which rejects disallowed keys, and could hide client drift. PATCH now rejects any key outside the allowlist with a 400 before validation or write, keeping the bulk path fail-closed and consistent with POST.	2026-06-04 01:49:23 -04:00
Anso	e5b1c7b22b	refactor(backend): collapse entitlement provider abstraction back to LicenseService (#889) ... Removes backend/src/entitlements/ (registry, loadProvider, CommunityEntitlementProvider, types, headers, normalize) and the two abstraction-only tests. Relocates headers/normalize/types to services/license-*.ts. Swaps 22 consumer call sites from getEntitlementProvider() to LicenseService.getInstance(). Drops the Dockerfile install step plus PRO_PACKAGE_VERSION build-arg and github_token BuildKit secret in docker-publish.yml. Removes the now stale no-restricted-imports rule in backend/eslint.config.mjs. Net: 37 files changed, ~700 lines removed, no behavior change. Local dev no longer requires GitHub Packages auth to start the backend. Rationale and revisit conditions in docs/internal/adrs/2026-05-02-collapse-entitlement-provider.md.	2026-05-02 23:45:44 -04:00
Anso	3324616e59	refactor(backend): extract EntitlementProvider abstraction (Phase 1) (#878) ... * refactor(backend): extract EntitlementProvider abstraction (Phase 1) Phase 1 of the open-core hybrid extraction described in docs/internal/adrs/2026-05-02-open-core-hybrid-strategy.md. Introduces the abstraction without moving any code out of the public repo; Phase 2 will actually move services/LicenseService.ts to a private @studio-saelix/sencho-pro package. The new backend/src/entitlements/ module contains: - types.ts. The EntitlementProvider interface plus all tier/license types (LicenseTier, LicenseVariant, LicenseInfo, SeatLimits, ActivationResult, etc.). The interface mirrors the existing LicenseService public surface so the migration was mechanical. - registry.ts. Module-scope holder for the active provider with setEntitlementProvider, getEntitlementProvider, and a test-only reset helper. getEntitlementProvider throws if called before bootstrap registers a provider; the throw is intentional fail-fast on a bootstrap-order bug rather than a silent degradation. - CommunityEntitlementProvider.ts. Phase 2 fallback that returns community tier and rejects activate(). NOT instantiated in production today; a smoke test keeps it covered against bitrot. - loadProvider.ts. Async resolver. Phase 1 returns LicenseService.getInstance() directly. The async signature matches what Phase 2 needs (dynamic import of @studio-saelix/sencho-pro with a "module not found" vs "construction threw" narrowing); the call site does not change between phases. - headers.ts. PROXY_TIER_HEADER and PROXY_VARIANT_HEADER constants. These are part of the wire contract between Sencho instances and belong in the public core regardless of which entitlement provider is bound. - normalize.ts. isLicenseTier, isLicenseVariant, normalizeTier, normalizeVariant. Domain knowledge about Sencho's tier model (legacy name maps from pre-0.38.1 versions), not LemonSqueezy internals. Phase 2 keeps these in the public core. services/LicenseService.ts now imports its types from entitlements/types and adds an "implements EntitlementProvider" clause. Re-exports the types for back-compat with ~20 type-only consumers; a follow-up PR will sweep those imports to entitlements/ types directly before Phase 2 deletes the file. bootstrap/startup.ts awaits loadEntitlementProvider, registers the result, then calls initialize. shutdown.ts calls getEntitlementProvider().destroy() instead of the LicenseService singleton. middleware/tierGates.ts, the chokepoint for ~154 tier-check call sites, now reads through getEntitlementProvider. Sixteen other production files (routes/{fleet,imageUpdates,license,permissions, scheduledTasks,security,stacks,templates,users,webhooks}, services/{BlueprintService,CloudBackupService,SchedulerService, SSOService}, proxy/remoteNodeProxy, websocket/{hostConsole, remoteForwarder}, middleware/auth) had their LicenseService.getInstance calls and utility-export imports redirected to the entitlements module. The only remaining LicenseService.getInstance in production code is in entitlements/loadProvider.ts itself, which is the intentional Phase-1 binding site. Test infrastructure: setupTestDb registers LicenseService.getInstance() as the active provider so existing test files using the helper need no changes. The mocking pattern many tests use, vi.spyOn(LicenseService.getInstance(), 'getTier'), keeps working because LicenseService.getInstance() and getEntitlementProvider() return the same singleton in Phase 1. scheduler-service.test.ts is the only test that does not use setupTestDb but exercises tier-gating; it now mocks entitlements/registry alongside its existing LicenseService mock. Adds a smoke test for CommunityEntitlementProvider so the Phase 2 fallback class stays covered. Adds an architecture doc at docs/internal/architecture/entitlement-provider.md covering the runtime registry, bootstrap order invariants, and the Phase 1 vs Phase 2 binding table. Test results: 89/89 backend test files pass, 1657 passing tests, 5 pre-existing skips. The pre-existing database-metrics > handles 1000+ metrics stress test continues to flake under parallel load and pass when re-run solo, same flake observed in PRs #862, #863. * chore(backend): drop unused entitlement type imports from LicenseService Phase 1 of the EntitlementProvider extraction left five type imports (ActivationResult, BillingPortalError, BillingPortalResult, DeactivationResult, ValidationResult) unreferenced after the runtime methods that produced them began inferring their result shapes via the EntitlementProvider interface contract. ESLint's no-unused-vars rule flagged them as errors and failed the lint step in CI.	2026-05-02 05:07:00 -04:00
Anso	50e64b058b	refactor(backend): extract 8 low-blast-radius route groups into routers (phase 4a-1) (#734) ... First slice of Phase 4 (route extraction). Pulls 8 well-tested, mostly independent route groups out of index.ts into focused Router files. No behavior change; every handler body moves verbatim. New route files under backend/src/routes/: - meta.ts /api/health, /api/meta (mounted before authGate) - license.ts /api/license/* + /api/system/update, exports scheduleLocalUpdate for the fleet route - permissions.ts /api/permissions/me - convert.ts POST /api/convert - alerts.ts /api/alerts/* - labels.ts /api/labels/* + PUT /api/stacks/:name/labels (exported as stackLabelsRouter) - apiTokens.ts /api/api-tokens/* - auditLog.ts /api/audit-log/* Shared helper lifts: - helpers/cacheInvalidation.ts: invalidateNodeCaches() - middleware/tierGates.ts: requireBody (was inline in index.ts) - utils/errors.ts: isSqliteUniqueViolation (was inline in index.ts) - middleware/apiTokenScope.ts: rejectApiTokenScope() helper (new) - utils/csv.ts: escapeCsvField() (new) index.ts drops from ~7520 to ~6775 lines and now mounts the routers right after enforceApiTokenScope. The remote proxy and fleet/auth/webhooks/users routes remain inline in index.ts pending later Phase 4 slices. Code review fixes: rejectApiTokenScope helper replaces duplicated `if (req.apiTokenScope) 403 SCOPE_DENIED` blocks in apiTokens.ts and license.ts; escapeCsvField replaces the inline CSV escape in auditLog.ts.	2026-04-23 20:24:37 -04:00