Class LicenseDocument

java.lang.Object
com.iizix.license.v2.LicenseDocument
public final class LicenseDocument extends Object
A verified licence document (LICENSE-V2-DESIGN.md section 2.2): the parsed payload with typed accessors, constructed only by LicenseVerifier.verify(byte[], UUID, PublicKey) after steps 1 and 2 of 2.5 accepted the bytes, so an instance is always a document signed by a key a pinned root certified. Step 5 is the document's own verdict: isExpired() tells whether expires had passed by the verifier's clock; an expired document is returned, never refused (2.5, 8).

The payload (2.2, ruling LV-1 (a)) is UTF-8 text, one key=value per line, every line terminated by LF, keys ascending in String order, each key once, no blank line, no comment, no byte-order mark, no carriage return or other control character, no empty value: one byte form of a given content, so the verifier verifies the bytes it received and only then parses them, and never canonicalises. The keys:

  • v - 2. Required.
  • lic - the licence UUID, lower case. Required.
  • product - 1 iiziGo, 2 iiziServer development, 3 iiziServer standard, 4 container; 5 is retired (LV-22) and refused. Required.
  • acct - the account's uid on the MLS. Required. acctName - its e-mail.
  • ikey - the installation's Ed25519 public key, base64url of its 32 bytes (2.3). Required.
  • iid - the hardware-bound installation ID.
  • ent, entName - the entitlement's UUID and display name.
  • state - active, trial, deactivated or revoked (LicenseState). Required.
  • validFrom, validTo - the entitlement's validity, epoch milliseconds UTC; absent = unbounded.
  • trialUntil - the end of a trial, epoch milliseconds.
  • maxUsers - concurrent signed-in users of the entitlement; -1 unlimited.
  • maxServers - members of one hub holding the entitlement; -1 unlimited.
  • devID, groupID - the Developer ID and Developer Group ID.
  • issued - the MLS's clock at issue, epoch milliseconds. Required.
  • refreshAfter - when the installation should ask for a new document (issued plus 7 days, LV-6). Required.
  • expires - when this document stops being valid, whatever the entitlement says (issued plus 30 days, LV-6). Required.
  • rn - the request nonce of the request that produced the document, base64url of 32 bytes (5.1).

A number is canonical decimal, a UUID lower case, an instant its epoch milliseconds, a byte string base64url without padding; every other spelling is refused, and so is an unknown key (a new key means a new v). Which optional keys a consumer needs is the consumer's check: a server needs ent and maxUsers, iiziGo does not. The document carries no secret and no personal data beyond the account's e-mail; a client may show all of it.

Author:
Christopher Mindus

  • Field Details

  • Method Details

    • getBytes

      public byte[] getBytes()
      Gets the document bytes, the envelope exactly as received: what a client stores and what a member sends the hub principal.
      Returns:
      A copy of the bytes.

    • getKeyID

      public String getKeyID()
      Gets the signing key's ID, the envelope's kid.
      Returns:
      The key ID.

    • getCertificate

      public KeyCertificate getCertificate()
      Gets the signing key's certificate, which verified under a pinned root.
      Returns:
      The certificate.

    • getVerifiedAt

      public Instant getVerifiedAt()
      Gets the verifier's clock when the document was verified.
      Returns:
      The instant.

    • isExpired

      public boolean isExpired()
      Tells whether the document had expired when it was verified: step 5 of 2.5, by the verifier's clock.
      Returns:
      true when expires was not in the future.

    • isExpired

      public boolean isExpired(Instant now)
      Tells whether the document has expired at an instant.
      Parameters:
      now - The instant.
      Returns:
      true when expires is not after it.

    • getVersion

      public int getVersion()
      Gets the format version.
      Returns:
      VERSION.

    • getLicenseUUID

      public UUID getLicenseUUID()
      Gets the licence UUID, lic.
      Returns:
      The UUID.

    • getProduct

      public int getProduct()
      Gets the product, product.
      Returns:
      PRODUCT_IIZIGO to PRODUCT_CONTAINER_SERVER.

    • getAccountUID

      public long getAccountUID()
      Gets the account's uid on the MLS, acct.
      Returns:
      The uid.

    • getAccountName

      public String getAccountName()
      Gets the account's e-mail, acctName.
      Returns:
      The e-mail, or null when absent.

    • getInstallationKey

      public PublicKey getInstallationKey()
      Gets the installation's public key, ikey.
      Returns:
      The Ed25519 public key.

    • getInstallationKeyBytes

      public byte[] getInstallationKeyBytes()
      Gets the installation's public key as its 32 bytes.
      Returns:
      A copy of the bytes.

    • getInstallationKeyText

      public String getInstallationKeyText()
      Gets the installation's public key as text, ikey as written.
      Returns:
      The key, base64url.

    • getInstallID

      public String getInstallID()
      Gets the hardware-bound installation ID, iid.
      Returns:
      The ID, or null when absent.

    • getEntitlementUUID

      public UUID getEntitlementUUID()
      Gets the entitlement's UUID, ent.
      Returns:
      The UUID, or null when absent.

    • getEntitlementName

      public String getEntitlementName()
      Gets the entitlement's display name, entName.
      Returns:
      The name, or null when absent.

    • getState

      public LicenseState getState()
      Gets the state, state.
      Returns:
      The state.

    • getValidFrom

      public Instant getValidFrom()
      Gets the start of the entitlement's validity, validFrom.
      Returns:
      The instant, or null when unbounded.

    • getValidTo

      public Instant getValidTo()
      Gets the end of the entitlement's validity, validTo.
      Returns:
      The instant, or null when unbounded.

    • getTrialUntil

      public Instant getTrialUntil()
      Gets the end of a trial, trialUntil.
      Returns:
      The instant, or null when absent.

    • getMaxUsers

      public Integer getMaxUsers()
      Gets the concurrent signed-in users allowed, maxUsers.
      Returns:
      The limit, UNLIMITED for none, or null when absent.

    • getMaxServers

      public Integer getMaxServers()
      Gets the members of one hub allowed, maxServers.
      Returns:
      The limit, UNLIMITED for none, or null when absent.

    • getDeveloperID

      public String getDeveloperID()
      Gets the Developer ID, devID.
      Returns:
      The ID, or null when absent.

    • getDeveloperGroupID

      public String getDeveloperGroupID()
      Gets the Developer Group ID, groupID.
      Returns:
      The ID, or null when absent.

    • getIssued

      public Instant getIssued()
      Gets the MLS's clock at issue, issued.
      Returns:
      The instant.

    • getRefreshAfter

      public Instant getRefreshAfter()
      Gets when the installation should ask for a new document, refreshAfter.
      Returns:
      The instant.

    • getExpires

      public Instant getExpires()
      Gets when the document stops being valid, expires.
      Returns:
      The instant.

    • getRequestNonce

      public byte[] getRequestNonce()
      Gets the request nonce, rn.
      Returns:
      A copy of the 32 bytes, or null when absent.

    • get

      public String get(String key)
      Gets a value as written.
      Parameters:
      key - The key.
      Returns:
      The value, or null when the key is absent.

    • asMap

      public Map<String,String> asMap()
      Gets the payload as written, in key order.
      Returns:
      An unmodifiable map.

    • toString

      public String toString()
      The licence UUID, the product, the state and the expiry.
      Overrides:
      toString in class Object