Add offline license capture to setup

ansible/roles/cezen-backend/files/main.py

@@ -34,6 +34,7 @@ DATA_DIR  = Path(os.environ.get("CEZEN_DATA", "/opt/cezen/data"))
 DB_PATH   = DATA_DIR / "cezen.db"
 SECRET_FILE = DATA_DIR / ".jwt_secret"
 BACKUP_DIR = Path(os.environ.get("CEZEN_BACKUP_DIR", str(DATA_DIR.parent / "backups")))
+LICENSE_FILE = Path(os.environ.get("CEZEN_LICENSE_JSON", "/opt/cezen/license.json"))
 
 DATA_DIR.mkdir(parents=True, exist_ok=True)
 BACKUP_DIR.mkdir(parents=True, exist_ok=True)
@@ -825,22 +826,46 @@ def _normalize_tier(value: str) -> str:
         return raw
     return TIER_ALIASES.get(raw, "basic")
 
+def _license_record() -> dict:
+    try:
+        if LICENSE_FILE.exists():
+            data = json.loads(LICENSE_FILE.read_text())
+            if isinstance(data, dict):
+                return data
+    except Exception:
+        pass
+    return {}
+
+def _public_license_record(record: dict) -> dict:
+    public = {k: v for k, v in (record or {}).items() if k != "license_key"}
+    if record.get("license_key"):
+        public["license_key_prefix"] = record["license_key"][:12]
+        public["license_key_present"] = True
+    else:
+        public["license_key_present"] = False
+    return public
+
 def _current_tier() -> str:
     if CEZEN_TIER:
         return _normalize_tier(CEZEN_TIER)
+    license_tier = (_license_record().get("tier") or "").strip()
+    if license_tier:
+        return _normalize_tier(license_tier)
     return _normalize_tier(_setting_value("tier_label", "Basic"))
 
 def _tier_payload() -> dict:
     tier = _current_tier()
     info = TIER_MATRIX[tier]
+    license_record = _license_record()
     return {
         "tier": tier,
         "label": info["label"],
-        "locked": bool(CEZEN_TIER),
+        "locked": bool(CEZEN_TIER or license_record.get("tier")),
         "positioning": info["positioning"],
         "max_users": info["max_users"],
         "features": info["features"],
         "tiers": TIER_MATRIX,
+        "license_record": _public_license_record(license_record),
     }
 
 def _readiness_score(feasibility: dict, license_info: dict) -> dict:
@@ -1777,12 +1802,20 @@ async def get_branding():
     rows = db.execute("SELECT key, value FROM settings").fetchall()
     db.close()
     result = {r["key"]: r["value"] for r in rows}
+    license_record = _license_record()
     # If Cezen has locked the tier via env var, override whatever is in DB
-    if CEZEN_TIER:
-        result["tier_label"] = CEZEN_TIER
+    if CEZEN_TIER or license_record.get("tier"):
+        tier = _current_tier()
+        result["tier_label"] = TIER_MATRIX[tier]["label"]
+        result["tier_slug"] = tier
         result["tier_locked"] = "true"
     else:
         result["tier_locked"] = "false"
+    if license_record:
+        result["license_customer"] = license_record.get("customer_name", "")
+        result["license_customer_id"] = license_record.get("customer_id", "")
+        result["license_key_prefix"] = (license_record.get("license_key", "") or "")[:12]
+        result["license_support_until"] = license_record.get("support_until", "")
     return result
 
 @app.put("/api/settings/branding")

ansible/roles/cezen-backend/tasks/main.yml

@@ -30,6 +30,19 @@
     group: "{{ cezen_user }}"
     mode: "0750"
 
+- name: Check for captured license file
+  stat:
+    path: /opt/cezen/license.json
+  register: cezen_license_file
+
+- name: Allow backend service to read captured license
+  file:
+    path: /opt/cezen/license.json
+    owner: root
+    group: "{{ cezen_user }}"
+    mode: "0640"
+  when: cezen_license_file.stat.exists
+
 - name: Copy FastAPI application
   copy:
     src: main.py