entitlement

package
v0.8.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 5, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Overview

Package entitlement manages local plan state and package access gates. Production builds will verify signed JWTs from the control plane; until then, dev license keys activate plans offline.

Index

Constants

View Source 
const DevPrivateKeyHex = "d8d14ea39788842c5151355fc582afe30ff498e4afbead6fecaeb8e443ce13da"

DevPrivateKeyHex is the Ed25519 seed for sandbox JWT signing (control plane dev only).

View Source 
const ProdControlPlaneURL = "https://agentctl-api.myk8s.pp.ua"

ProdControlPlaneURL is the hosted control plane new licenses activate against by default — no env var needed for a real customer.

View Source 
const ProdPublicKeyHex = "40fc1129bc55910ddc27f960ad3c360ef3744313b78d92b0e9f04275390b15a4"

ProdPublicKeyHex is the Ed25519 public key for the production control plane (agentctl-api.myk8s.pp.ua). Only the public half lives in the client/repo — the matching private key is held as a cluster secret and never committed.

Variables

This section is empty.

Functions

func Clear 

func Clear() error

Clear removes entitlement file (revert to free).

func ControlPlaneURL added in v0.7.0 

func ControlPlaneURL() string

ControlPlaneURL returns AGENTCTL_CONTROL_PLANE_URL, or the production control plane when unset. Set AGENTCTL_CONTROL_PLANE_URL=http://localhost:8090 (or empty via AGENTCTL_CONTROL_PLANE_URL=-) to target a local sandbox instead.

func DevPrivateKey added in v0.7.0 

func DevPrivateKey() (ed25519.PrivateKey, error)

DevPrivateKey returns the sandbox signing key (control plane dev only).

func DevPublicKey added in v0.7.0 

func DevPublicKey() (ed25519.PublicKey, error)

DevPublicKey returns the sandbox verification key derived from the dev seed.

func LocalControlPlaneURL added in v0.7.0 

func LocalControlPlaneURL() string

LocalControlPlaneURL is the default URL used by `m controlplane serve`.

func Path 

func Path() (string, error)

Path returns ~/.config/m/entitlement.json.

func ProdPublicKey added in v0.8.0 

func ProdPublicKey() (ed25519.PublicKey, error)

ProdPublicKey returns the production control-plane verification key.

func RecordPackageInstall 

func RecordPackageInstall(name string) error

RecordPackageInstall appends an installed package name to state.

func Save 

func Save(s State) error

Save persists entitlement state.

func SignClaims added in v0.7.0 

func SignClaims(claims Claims, privateKey ed25519.PrivateKey, ttl time.Duration) (string, error)

SignClaims issues a JWT for the control plane (server-side).

func TrustedPublicKeys added in v0.8.0 

func TrustedPublicKeys() ([]ed25519.PublicKey, error)

TrustedPublicKeys returns every key the client accepts entitlement JWTs from: production first, then the dev/sandbox key for local `m controlplane serve` testing.

Types

type Claims added in v0.7.0 

type Claims struct {
	Plan         Plan     `json:"plan"`
	Entitlements []string `json:"entitlements,omitempty"`
	Packages     []string `json:"packages,omitempty"`
	Ver          int      `json:"ver,omitempty"`
	Subject      string   `json:"-"`
	jwt.RegisteredClaims
}

Claims is the signed entitlement payload exchanged with the control plane.

func ParseToken added in v0.7.0 

func ParseToken(tokenString string, publicKey ed25519.PublicKey) (*Claims, error)

ParseToken verifies a JWT and returns claims using the given public key.

type Plan 

type Plan string

Plan identifies the subscription tier. 

const (
	PlanFree       Plan = "free"
	PlanPro        Plan = "pro"
	PlanTeam       Plan = "team"
	PlanEnterprise Plan = "enterprise"
)

type State 

type State struct {
	Plan         Plan     `json:"plan"`
	Packages     []string `json:"packages,omitempty"`
	Entitlements []string `json:"entitlements,omitempty"`
	Subject      string   `json:"subject,omitempty"`
	LicenseHint  string   `json:"licenseHint,omitempty"`
	ActivatedAt  int64    `json:"activatedAt,omitempty"`
	ExpiresAt    int64    `json:"expiresAt,omitempty"`
	Source       string   `json:"source,omitempty"` // dev-key | control-plane
	Token        string   `json:"token,omitempty"`  // signed JWT from control plane
}

State is persisted under ~/.config/m/entitlement.json.

func Activate added in v0.7.0 

func Activate(key string) (State, error)

Activate tries offline dev keys first, then the control plane when configured.

func ActivateDevKey 

func ActivateDevKey(key string) (State, error)

ActivateDevKey maps offline dev keys to a plan (until control plane ships).

func ApplyToken added in v0.7.0 

func ApplyToken(token string) (State, error)

ApplyToken verifies a JWT against every trusted public key (production, then dev/sandbox) and returns the resulting state.

func Default 

func Default() State

Default returns the free-tier state.

func Load 

func Load() (State, error)

Load reads entitlement state from disk. Missing file => free tier.

func Refresh added in v0.7.0 

func Refresh() (State, error)

Refresh exchanges a cached JWT for a new one from the control plane.

func StateFromClaims added in v0.7.0 

func StateFromClaims(c *Claims, token string) State

StateFromClaims maps verified JWT claims to persisted local state.

func (State) EffectiveEntitlements 

func (s State) EffectiveEntitlements() []string

EffectiveEntitlements returns entitlement keys granted by the current plan.

func (State) HasAllEntitlements 

func (s State) HasAllEntitlements(required []string) []string

HasAllEntitlements returns missing keys (empty slice = ok).

func (State) HasEntitlement 

func (s State) HasEntitlement(required string) bool

HasEntitlement reports whether the user can use a required entitlement key.

func (State) IsExpired 

func (s State) IsExpired() bool

IsExpired reports whether the license has passed ExpiresAt.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.