Feature/marketplace

[michalcharvat]

No description provided.

[mschering]

Nice going! How can I test this?

[michalcharvat]

There is a client-server implementation. The server (marketplaceserver) acts as the module manager, whilst the client (marketplace) simply utilises it. It is possible to have several stores on a single instance.

A. Server – prepare data

1. Install marketplaceserver, open its panel and check the package name in Settings (e.g. sf) — an RSA keypair is generated.
2. Create a Product of type module (moduleName = a test module, price > 0) and optionally one free product (empty price).
3. Upload a Release (ZIP with a single root folder {module}/, version, GO branch e.g. 6.8).
4. Create a Customer (or let the client self-register — see B2), set maxInstances (e.g. 1) and generate an API token for them (shown once).
5. Add an Entitlement for the customer on the paid product (with or without expiry).

B. Client – connect

1. Install marketplace, System Settings → Marketplace → Add repository: server URL + token → Save. Expect: package + public key are filled in, go/modules/{package} writability is checked.
2. Alternatively test Register (new account → verification e-mail is sent; until you click it the API returns verifyRequired) and Login (existing account → new token).
3. The catalog shows products: paid & owned = owned, free = downloadable, paid & not owned = buy.

C. Download and install

1. Download an owned module → it must appear in go/modules/{package}/{module} and the toast points to System Settings → Modules.
2. Install the module the standard way via Modules.
3. Negative: remove the entitlement on the server, try to download → 403 "No entitlement". Try a free module → works without any entitlement.

D. Licensing

1. Add isLicensed() to the test module using MarketplaceLicense::has('{package}', '{module}'). The module should be installable/active.
2. On the server revoke / expire the entitlement, on the client hit Refresh → the module must become unlicensed (disabled in Modules, cannot be installed). Restore the entitlement, Refresh → OK again.
3. Seat limit: maxInstances = 1, connect a second instance (different host) → the second one gets no license for paid modules; after seatActivityDays of inactivity of the first (or a manual release) it gets one.
4. Hostname mode: switch the entitlement to hostname; after the first Refresh it pins to that host; from another host it is not licensed; a manager clears boundHostname → it re-pins.
5. Offline: shut down / make the server unreachable, run the RefreshLicenses cron (or wait) → the license still works from cache, the repository shows a lastError.
6. Key rotation: generate a new keypair on the server, Refresh on the client → reports "security key changed", licensing keeps working on the cached JWT; re-save the token → the new key gets pinned.