FlowFuse / FlowFuse/flowfuse

Get proper license workflow in place

Open
#125 4 comments 0 reactions 1 assignee Claimed by @knolleary View on GitHub
scope:enterprise task type:feature
Dominant language
JavaScript
Stars
400
Forks
89
Avg merge
1d 21h
Merged PRs (30d)
146

Description

We currently have a very limited license mechanism in place. It needs a bit more work for MVP.

Current state:

1. A development-only pair of license signing keys are stored in the repository. These can be used to generate valid licenses - but are *not* what we'll use long term.
2. The license component checks the database to see if a license has been applied as part of the startup wizard.
3. If the license is present, it is verified and the terms it contains are stored
4. The Admin view in the UI will display the current license details but does not allow it to be modified

Required changes:

- [x] Generate the real license key files. Store private key in 1Password vault. Store public key in this repo
- [x] Remove placeholder key files from repository
- [ ] Generate a new development-only license using the real key files
- [x] #128 - Add Admin API end point to update license (`PUT /api/v1/admin/license`)
- [x] #128 - Allow Admin UI view to change the license
- [ ] Include license details (as needed by UI) in `GET /api/v1/settings` response
- [ ] Add license checks on API actions that create Users/Teams/Projects
- [ ] Add UI prompts where an action is restricted by license

Some outstanding design decisions that should be considered but could be put-off post-MVP
- Current model only allows for a single license. We may want to have them in their own DB table so we can have a history of previous licenses available.
- The current model also means if a user gets a new license, there must be overlap between the 'valid from' date of new license and 'expires at' of the old - so they can apply the new license without having to worry too much about timing. Whereas a DB table of licenses could allow for 'automatic' roll-over onto the whichever is the active license.
- Need to consider license expiry and what happens if a platform finds itself exceeding the current license (or missing license)
- Should we require all users to have a license of some type? Even in the completely free tier - a license we provide that reflects the free tier entitlement. When we get to adding usage telemetry, that would allow us to relate usage back to a license. Hard to retrofit. Downside is that could inhibit experimentation and long-tail adoption.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.