sqep 0.1.0

//! SQEP License Validator – Offline key checker for Plus mode
//! Author: Kaizen Raijin
//! Used in: SQEPPlus::is_license_valid()

use sha2::{Sha256, Digest};
use base64::{engine::general_purpose::STANDARD, Engine};
use std::time::{SystemTime, UNIX_EPOCH};

/// Private signing key (shared with keygen)
const LICENSE_SECRET: &str = "SQEP-AUTHOR-CERTIFIED";

/// Validates a license string generated via `keygen.rs`
/// Expected format: `<base64_payload>:<unix_timestamp>`
pub fn validate_license(license_str: &str) -> Result<(), &'static str> {
    let parts: Vec<&str> = license_str.trim().split(':').collect();
    if parts.len() != 2 {
        return Err("Invalid license format");
    }

    let encoded_payload = parts[0];
    let expiration_ts = parts[1];

    let decoded = STANDARD
        .decode(encoded_payload)
        .map_err(|_| "Base64 decode failed")?;

    if decoded.len() < 32 {
        return Err("Corrupted license payload");
    }

    let (payload, signature) = decoded.split_at(decoded.len() - 32);

    // Recompute hash for signature validation
    let mut hasher = Sha256::new();
    hasher.update(payload);
    hasher.update(LICENSE_SECRET.as_bytes());
    let expected_hash = hasher.finalize();

    if signature != &expected_hash[..] {
        return Err("Invalid license signature");
    }

    // Check expiration time
    let provided_ts: u64 = expiration_ts.parse().map_err(|_| "Invalid timestamp")?;
    let now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs();

    if now > provided_ts {
        return Err("License expired");
    }

    Ok(())
}