Leviro Licensing Infrastructure

Leviro Licensing is private infrastructure for issuing software licenses and authorizing customer installations. Operators manage products, plans, licenses, releases, and agreements in an admin application. A customer-host installer uses the API to activate and start an entitled release.

The problem

A license key alone cannot answer whether an installation may run, which release it may download, or what happens when a subscription changes. The system records those decisions centrally and gives an installation signed evidence it can verify. It also needs to protect activation slots when requests arrive at the same time or are retried after a failure.

Key features

• License keys are generated from cryptographic randomness; only verifiers are stored.
• Installations can activate, confirm, refresh, check status, and deactivate through versioned endpoints.
• Signed leases carry effective entitlements and an expiration time.
• Release resolution checks channels and update rights before returning a signed manifest and download authorization.
• Versioned agreements have recorded acceptances and separate activation, update, and runtime gates.
• Commerce events can issue, renew, suspend, or change licenses through an idempotent processor.
• An admin application manages customers, products, plans, licenses, installations, releases, agreements, and audit records.
• A restart-safe CLI activates an installation, verifies an artifact, starts Docker Compose services, checks health, and confirms the activation.

Technical architecture

A Fastify API exposes the licensing protocol and admin routes. Zod contracts define request and response shapes. Domain decisions live in separate core modules; Drizzle ORM repositories persist durable state in PostgreSQL. Redis holds replay nonces, rate-limit state, and admin sessions. The React admin app calls authenticated REST endpoints. The installer is a separate TypeScript CLI for customer hosts. It creates an Ed25519 installation identity, requests activation, verifies signatures and artifact digests, and records each completed phase so interrupted work can resume. The API signs leases; the release pipeline signs release manifests.

Engineering highlights

• License activation locks the license row in PostgreSQL before reserving a slot; a database index also rejects duplicate active reservations.
• Installation requests use HTTP message signatures and body digests. Redis replay nonces fail closed when replay protection is unavailable.
• Admin access combines password hashing, time-based one-time codes, sessions, CSRF protection, and route permissions.
• Missing license lookup IDs still perform a synthetic HMAC comparison to avoid exposing key validity through timing.
• Database migrations take an advisory lock to prevent concurrent deployment races.