feat(auth): expose current license app permissions

.woodpecker.yml

@@ -28,11 +28,11 @@ steps:
         commit="$(printf %.8s "$CI_COMMIT_SHA")"
         job="studio-auth-migrate-$commit"
         kubectl --kubeconfig=/tmp/kubeconfig -n studio-system delete job "$job" --ignore-not-found
-        cat <<EOF | kubectl --kubeconfig=/tmp/kubeconfig apply -f -
+        cat <<'EOF' | sed "s/__JOB_NAME__/$job/g" | kubectl --kubeconfig=/tmp/kubeconfig apply -f -
         apiVersion: batch/v1
         kind: Job
         metadata:
-          name: $job
+          name: __JOB_NAME__
           namespace: studio-system
         spec:
           backoffLimit: 1
@@ -44,10 +44,17 @@ steps:
                 - name: migrate
                   image: localhost:5000/studio-auth-be:0.1.1
                   imagePullPolicy: Always
-                  command: ["sh", "-lc", "bunx --no-install prisma migrate deploy"]
+                  command:
+                    - sh
+                    - -lc
+                    - |
+                      export DATABASE_URL="postgresql://$(printenv POSTGRES_USER):$(bun -e 'process.stdout.write(encodeURIComponent(process.env.POSTGRES_PASSWORD ?? ""))')@studio-auth-db.studio-system.svc.cluster.local:5432/$(printenv POSTGRES_DB)?schema=public"
+                      bunx --no-install prisma migrate deploy
                   envFrom:
                     - secretRef:
                         name: studio-auth-be-env
+                    - secretRef:
+                        name: studio-auth-db-secret
         EOF
         if ! kubectl --kubeconfig=/tmp/kubeconfig -n studio-system wait --for=condition=complete "job/$job" --timeout=180s; then
           kubectl --kubeconfig=/tmp/kubeconfig -n studio-system logs "job/$job" --all-containers=true || true

prisma/schema.prisma

@@ -92,11 +92,26 @@ model License {
   createdAt           DateTime      @default(now()) @map("created_at") @db.Timestamptz(3)
   updatedAt           DateTime      @updatedAt @map("updated_at") @db.Timestamptz(3)
   userLicenses        UserLicense[]
+  appPermissions      LicenseAppPermission[]
 
   @@index([isActive])
   @@map("licenses")
 }
 
+model LicenseAppPermission {
+  id        String   @id @default(uuid()) @db.Uuid
+  licenseId String   @map("license_id") @db.Uuid
+  appKey    String   @map("app_key")
+  canLaunch Boolean  @default(true) @map("can_launch")
+  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(3)
+  updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz(3)
+  license   License  @relation(fields: [licenseId], references: [id], onDelete: Cascade)
+
+  @@unique([licenseId, appKey])
+  @@index([appKey])
+  @@map("license_app_permissions")
+}
+
 model UserLicense {
   id           String    @id @default(uuid()) @db.Uuid
   userId       String    @map("user_id") @db.Uuid

src/auth/license-policy.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it, mock } from 'bun:test'
+
+const findFirst = mock(async (): Promise<unknown> => null)
+mock.module('../prisma', () => ({ prisma: { userLicense: { findFirst } } }))
+const { getLauncherAppPolicy } = await import('./license-policy')
+
+describe('launcher license policy', () => {
+  it('returns the current license app policy', async () => {
+    findFirst.mockResolvedValueOnce({ license: { appPermissions: [{ appKey: 'LMS', canLaunch: true }, { appKey: 'OTHER', canLaunch: false }] } })
+    expect(await getLauncherAppPolicy('student')).toEqual({
+      defaultCanLaunch: true,
+      permissions: [{ appKey: 'LMS', canLaunch: true }, { appKey: 'OTHER', canLaunch: false }],
+    })
+    expect(findFirst).toHaveBeenCalledWith(expect.objectContaining({
+      where: expect.objectContaining({
+        userId: 'student', startsAt: { lte: expect.any(Date) },
+        OR: [{ expiresAt: null }, { expiresAt: { gt: expect.any(Date) } }],
+        license: { isActive: true },
+      }),
+      orderBy: { startsAt: 'desc' },
+    }))
+  })
+
+  it('denies by default without an active license', async () => {
+    findFirst.mockResolvedValueOnce(null)
+    expect(await getLauncherAppPolicy('student')).toEqual({ defaultCanLaunch: false, permissions: [] })
+  })
+})

src/auth/license-policy.ts

@@ -0,0 +1,22 @@
+import { prisma } from '../prisma'
+
+export async function getLauncherAppPolicy(userId: string) {
+  const now = new Date()
+  const current = await prisma.userLicense.findFirst({
+    where: {
+      userId,
+      startsAt: { lte: now },
+      OR: [{ expiresAt: null }, { expiresAt: { gt: now } }],
+      license: { isActive: true }
+    },
+    orderBy: { startsAt: 'desc' },
+    select: {
+      license: { select: { appPermissions: { select: { appKey: true, canLaunch: true } } } }
+    }
+  })
+  return {
+    // Match the admin license policy: unspecified apps are allowed for active licenses.
+    defaultCanLaunch: Boolean(current),
+    permissions: current?.license.appPermissions ?? []
+  }
+}

src/auth/routes.ts

@@ -8,6 +8,7 @@ import { verifyPassword } from '../security/password'
 import { signAccessToken, verifyAccessToken } from '../security/tokens'
 import type { AuthUser } from '../types'
 import { authRequired, type AuthVariables } from './middleware'
+import { getLauncherAppPolicy } from './license-policy'
 import {
   clearLoginAttempts,
   assignUserAffiliation,
@@ -686,6 +687,10 @@ authRoutes.post('/logout', async (c) => {
   return c.json({ ok: true })
 })
 
+authRoutes.get('/launcher-app-policy', authRequired, async (c) => {
+  return c.json(await getLauncherAppPolicy(c.get('user').id))
+})
+
 authRoutes.get('/me', authRequired, (c) => {
   return c.json({ user: userResponse(c.get('user')) })
 })
@@ -826,10 +831,9 @@ authRoutes.post('/instructor/students', authRequired, async (c) => {
 
   const email = body.data.email.toLowerCase()
   const existingUser = await findUserByEmail(email)
-  if (existingUser) return c.json({ error: 'email_already_registered' }, 409)
 
   try {
-    const user = await createManagedUser({
+    const user = existingUser ?? await createManagedUser({
       email,
       password: body.data.password,
       name: body.data.name,
@@ -839,17 +843,25 @@ authRoutes.post('/instructor/students', authRequired, async (c) => {
       licenseCode: body.data.licenseCode,
     })
 
-    await prisma.userAppRole.create({
+    await prisma.userAppRole.upsert({
-      data: {
+      where: {
+        userId_appKey_roleCode: {
+          userId: user.id,
+          appKey: 'LMS',
+          roleCode: 'STUDENT',
+        },
+      },
+      create: {
         userId: user.id,
         appKey: 'LMS',
         roleCode: 'STUDENT',
         assignedById: instructor.id,
       },
+      update: {},
     })
 
-    const createdUser = await findUserById(user.id)
+    const resolvedUser = await findUserById(user.id)
-    return c.json({ user: userResponse(createdUser ?? user) }, 201)
+    return c.json({ user: userResponse(resolvedUser ?? user) }, existingUser ? 200 : 201)
   } catch {
     return c.json({ error: 'user_create_failed' }, 400)
   }