Rust REST client

cargo build --locked

// Complete Sandbox REST session. Rust1.82+, exact Cargo.toml/Cargo.lock.
// Run cargo run -- status|activate|check|validate|deactivate; safe JSON only.
// signature.rs is the unchanged P5 verifier body, without its original CLI main.
mod signature;
use chrono::{DateTime,Duration,Utc};
use fs2::FileExt;
use serde::{Deserialize,Serialize};
use serde_json::{Value,json};
use sha2::{Digest,Sha256};
use std::{env,fs::{self,File,OpenOptions},io::{Read,Write},path::{Path,PathBuf},time::Duration as Timeout};
enum Error {Setup,Network,Denied(String,Option<String>)}
type Result<T> = std::result::Result<T,Error>;
fn denied(code:&str)->Error {Error::Denied(code.into(),None)}
fn config(name:&str)->Result<String>{let value=env::var(name).map_err(|_|Error::Setup)?;if value.is_empty()||value.contains(['\r','\n']){return Err(Error::Setup)};Ok(value)}
fn hash(value:&str)->String{format!("{:x}",Sha256::digest(value.as_bytes()))}
fn safe_identifier(value:&str,max:usize)->bool{!value.is_empty()&&value.len()<=max&&value.bytes().all(|c|c.is_ascii_alphanumeric()||c==b'_'||c==b'-')}
fn read(path:&Path)->Result<Vec<u8>>{let stat=fs::symlink_metadata(path).map_err(|_|Error::Setup)?;if !stat.is_file()||stat.file_type().is_symlink()||stat.len()>1048576{return Err(Error::Setup)};fs::read(path).map_err(|_|Error::Setup)}
fn object(raw:&[u8])->Result<Value>{signature::validate_json(raw).map_err(|_|denied("INVALID_RESPONSE"))?;let v:Value=serde_json::from_slice(raw).map_err(|_|denied("INVALID_RESPONSE"))?;if !v.is_object(){return Err(denied("INVALID_RESPONSE"))};Ok(v)}
fn timestamp(value:&Value)->Result<DateTime<Utc>>{DateTime::parse_from_rfc3339(value.as_str().ok_or_else(||denied("INVALID_TIME"))?).map(|v|v.with_timezone(&Utc)).map_err(|_|denied("INVALID_TIME"))}
fn permission(path:&Path,mode:u32)->Result<()>{
 #[cfg(unix)]{use std::os::unix::fs::PermissionsExt;fs::set_permissions(path,fs::Permissions::from_mode(mode)).map_err(|_|Error::Setup)?;}
 #[cfg(not(unix))]{let _=(path,mode);}
 Ok(())
}
#[derive(Serialize,Deserialize)]
struct Stored {token:String,envelope:Option<String>,checkpoint:String}
struct Session {app:String,base:String,directory:PathBuf,installation:String,key:Vec<u8>,lock:File,agent:ureq::Agent}
impl Session {
 fn open()->Result<Self>{
  let app=config("KDP_APP_ID")?;if !safe_identifier(&app,160){return Err(Error::Setup)}
  let base=env::var("KDP_BASE_URL").unwrap_or_else(|_|"https://licensing.kdpika.com/api/v1".into()).trim_end_matches('/').to_string();let uri=url::Url::parse(&base).map_err(|_|Error::Setup)?;
  let local=uri.scheme()=="http"&&matches!(uri.host_str(),Some("127.0.0.1"|"localhost"))&&env::var("KDP_ALLOW_LOOPBACK").unwrap_or_default()=="1";
  if uri.host_str().is_none()||(uri.scheme()!="https"&&!local)||!uri.username().is_empty()||uri.password().is_some()||uri.query().is_some()||uri.fragment().is_some()||uri.path()!="/api/v1"{return Err(Error::Setup)}
  let root=PathBuf::from(config("KDP_STATE_DIR")?);let keyfile=PathBuf::from(config("KDP_TRUSTED_KEY_FILE")?);if !root.is_absolute()||!keyfile.is_absolute(){return Err(Error::Setup)};let key=read(&keyfile)?;let public=object(&key)?;if public["algorithm"]!="Ed25519"||public["encoding"]!="base64url"{return Err(Error::Setup)}
  fs::create_dir_all(&root).map_err(|_|Error::Setup)?;if fs::symlink_metadata(&root).map_err(|_|Error::Setup)?.file_type().is_symlink(){return Err(Error::Setup)}
  let directory=root.join(&hash(&format!("{base}|{app}|SANDBOX|rust-rest-v1"))[..20]);fs::create_dir_all(&directory).map_err(|_|Error::Setup)?;
  if fs::symlink_metadata(&directory).map_err(|_|Error::Setup)?.file_type().is_symlink(){return Err(Error::Setup)};permission(&directory,0o700)?;
  let lockfile=directory.join(".lock");if let Ok(stat)=fs::symlink_metadata(&lockfile){if !stat.is_file()||stat.file_type().is_symlink(){return Err(Error::Setup)}}
  let lock=OpenOptions::new().create(true).truncate(false).read(true).write(true).open(&lockfile).map_err(|_|Error::Setup)?;permission(&lockfile,0o600)?;lock.try_lock_exclusive().map_err(|_|Error::Setup)?;
  let mut result=Self {app,base,directory,installation:String::new(),key,lock,agent:ureq::AgentBuilder::new().timeout(Timeout::from_secs(15)).redirects(0).build()};
  let identity=result.directory.join("installation.json");if !identity.exists(){result.write("installation.json",&json!({"installation_id":format!("lmp-install-{}",uuid::Uuid::new_v4())}))?}
  let value=object(&read(&identity)?)?;result.installation=value["installation_id"].as_str().ok_or(Error::Setup)?.to_string();
  if !result.installation.starts_with("lmp-install-")||result.installation.len()!=48||!safe_identifier(&result.installation,48){return Err(Error::Setup)};Ok(result)
 }
 fn write<T:Serialize>(&self,name:&str,value:&T)->Result<()>{let temporary=self.directory.join(format!("write-{}",uuid::Uuid::new_v4()));let mut file=OpenOptions::new().create_new(true).write(true).open(&temporary).map_err(|_|Error::Setup)?;permission(&temporary,0o600)?;file.write_all(&serde_json::to_vec(value).map_err(|_|Error::Setup)?).map_err(|_|Error::Setup)?;file.sync_all().map_err(|_|Error::Setup)?;drop(file);fs::rename(&temporary,self.directory.join(name)).map_err(|_|Error::Setup)}
 fn state(&self)->Result<Option<Stored>>{let file=self.directory.join("session.json");if !file.exists(){return Ok(None)};let raw=read(&file)?;object(&raw)?;let state:Stored=serde_json::from_slice(&raw).map_err(|_|Error::Setup)?;if !state.token.starts_with("act_")||!safe_identifier(&state.token,256){return Err(Error::Setup)};timestamp(&json!(state.checkpoint))?;Ok(Some(state))}
 fn clear(&self)->Result<()>{match fs::remove_file(self.directory.join("session.json")){Ok(())=>Ok(()),Err(e) if e.kind()==std::io::ErrorKind::NotFound=>Ok(()),Err(_)=>Err(Error::Setup)}}
 fn request(&self,endpoint:&str,body:&Value,token:Option<&str>)->Result<(Vec<u8>,Value,Option<String>)>{
  let mut request=self.agent.post(&(self.base.clone()+endpoint)).set("Accept","application/json").set("Content-Type","application/json").set("User-Agent","KDPika-REST-Rust-example/1.0");
  request=if let Some(token)=token{request.set("Authorization",&format!("Bearer {token}")).set("X-Installation-ID",&self.installation)}else{request.set("X-App-ID",&self.app).set("X-Environment","SANDBOX")};
  let response=match request.send_string(&body.to_string()){Ok(r)=>r,Err(ureq::Error::Status(_,r))=>r,Err(_)=>return Err(Error::Network)};let status=response.status();let mut raw=Vec::new();response.into_reader().take(1048577).read_to_end(&mut raw).map_err(|_|Error::Network)?;
  if raw.len()>1048576{return Err(denied("INVALID_RESPONSE"))};let value=object(&raw)?;let id=value["request_id"].as_str().filter(|id|id.starts_with("req_")&&safe_identifier(id,124)).map(String::from);
  if !(200..300).contains(&status)||value["success"]!=true {let code=value["error"]["code"].as_str().filter(|v|v.len()<=64&&v.bytes().all(|c|c.is_ascii_uppercase()||c.is_ascii_digit()||c==b'_')).unwrap_or("HTTP_ERROR");return Err(Error::Denied(code.into(),id))};Ok((raw,value,id))
 }
 fn verify(&self,envelope:&str,source:&str,checkpoint:Option<&str>,id:Option<String>)->Result<Value>{
  if !signature::verify_envelope(&self.key,envelope.as_bytes()){return Err(Error::Denied("SIGNATURE_INVALID".into(),id))};let env=object(envelope.as_bytes())?;let p=&env["payload"];
  if p["product_id"]!=self.app||p["environment"]!="sandbox"||p["device"]["installation_hash"]!=hash(&self.installation){return Err(denied("BINDING_MISMATCH"))}
  let server=timestamp(&p["server_time"])?;let next=timestamp(&p["next_validation_at"])?;let grace=timestamp(&p["offline_grace_until"])?;if next<server||grace<server{return Err(denied("INVALID_TIME"))};let latest=match checkpoint{Some(c)=>server.max(timestamp(&json!(c))?),None=>server};let now=Utc::now();
  if now+Duration::seconds(300)<latest{return Err(denied("CLOCK_ROLLBACK_DETECTED"))};if p["status"]!="active"{return Err(denied("LICENSE_NOT_ACTIVE"))};if !p["starts_at"].is_null()&&now<timestamp(&p["starts_at"])?{return Err(denied("LICENSE_NOT_STARTED"))};if !p["expires_at"].is_null()&&now>=timestamp(&p["expires_at"])?{return Err(denied("LICENSE_EXPIRED"))};if source!="online"&&now>grace{return Err(denied("OFFLINE_GRACE_EXPIRED"))}
  if !p["features"].is_object(){return Err(denied("INVALID_RESPONSE"))};let mut value=accepted(source,id);value["signature_valid"]=json!(true);value["pdf_export_allowed"]=json!(p["features"]["pdf_export"]==true);if let Some(count)=p["features"]["seat_count"].as_u64(){if count<=9007199254740991{value["seat_count"]=json!(count)}};Ok(value)
 }
 fn run(&self,action:&str)->Result<Value>{
  let saved=self.state()?;if action=="status"{return Ok(json!({"activated":saved.is_some(),"installation_hash":hash(&self.installation),"storage_security":"permission-protected-file"}))}
  if action=="activate"{let license=config("KDP_LICENSE_KEY")?;if !license.starts_with("TEST"){return Err(Error::Setup)};if saved.is_some(){return Err(denied("ALREADY_ACTIVATED"))};let mut body=json!({"license_key":license,"device_id":self.installation,"device_name":"Rust REST example","platform":env::consts::OS,"app_version":"1.0.0"});if env::var("KDP_CUSTOMER_EMAIL").is_ok_and(|v|!v.is_empty()){body["email"]=json!(config("KDP_CUSTOMER_EMAIL")?)}
   let(raw,reply,id)=self.request("/licenses/activate",&body,None)?;let token=reply["activation_token"].as_str().ok_or_else(||denied("INVALID_RESPONSE"))?;if !token.starts_with("act_")||!safe_identifier(token,256){return Err(denied("INVALID_RESPONSE"))}
   let envelope=signature::envelope_from_response(&raw).map_err(|_|denied("INVALID_RESPONSE"))?;match self.verify(&envelope,"online",None,id){Ok(value)=>{self.write("session.json",&Stored{token:token.into(),envelope:Some(envelope),checkpoint:Utc::now().to_rfc3339()})?;return Ok(value)},Err(error)=>{let _=self.request("/licenses/deactivate",&json!({}),Some(token));return Err(error)}}}
  let mut state=saved.ok_or_else(||denied("NOT_ACTIVATED"))?;if action=="deactivate"{let(_,reply,id)=self.request("/licenses/deactivate",&json!({}),Some(&state.token))?;if reply["deactivated"]!=true{return Err(denied("INVALID_RESPONSE"))};self.clear()?;let mut value=accepted("online",id);value["message"]=json!("This installation has been deactivated.");return Ok(value)}
  if action=="check"{if let Some(envelope)=&state.envelope{match self.verify(envelope,"cache",Some(&state.checkpoint),None){Ok(value)=>{let p=object(envelope.as_bytes())?;if Utc::now()<timestamp(&p["payload"]["next_validation_at"])?{state.checkpoint=Utc::now().to_rfc3339();self.write("session.json",&state)?;return Ok(value)}},Err(_)=>{state.envelope=None;self.write("session.json",&state)?}}}}
  let answer=self.request("/licenses/validate",&json!({}),Some(&state.token));let value=match answer {
   Ok((raw,_,id))=>{let envelope=signature::envelope_from_response(&raw).map_err(|_|denied("INVALID_RESPONSE"))?;match self.verify(&envelope,"online",Some(&state.checkpoint),id){Ok(value)=>{state.envelope=Some(envelope);value},Err(error)=>{state.envelope=None;self.write("session.json",&state)?;return Err(error)}}},
   Err(Error::Network)=>{let envelope=state.envelope.as_ref().ok_or_else(||denied("OFFLINE_CACHE_MISSING"))?;self.verify(envelope,"offline",Some(&state.checkpoint),None)?},
   Err(Error::Denied(code,id))=>{if ["INVALID_TOKEN","DEVICE_MISMATCH","LICENSE_REVOKED","LICENSE_EXPIRED","LICENSE_CANCELLED"].contains(&code.as_str()){self.clear()?}else{state.envelope=None;self.write("session.json",&state)?};return Err(Error::Denied(code,id))},Err(error)=>return Err(error)};
  state.checkpoint=Utc::now().to_rfc3339();self.write("session.json",&state)?;Ok(value)
 }
}
impl Drop for Session {fn drop(&mut self){let _=FileExt::unlock(&self.lock);}}
fn accepted(source:&str,id:Option<String>)->Value{json!({"valid":true,"source":source,"signature_valid":false,"error_code":null,"request_id":id,"pdf_export_allowed":false,"seat_count":null,"message":"Your license is ready."})}
fn execute()->Result<i32>{let args:Vec<String>=env::args().collect();if args.len()!=2||!["status","activate","check","validate","deactivate"].contains(&args[1].as_str()){return Err(Error::Setup)};let client=Session::open()?;match client.run(&args[1]){Ok(value)=>{println!("{value}");Ok(0)},Err(error)=>{let(code,id)=match error{Error::Denied(c,id)=>(c,id),Error::Network=>("NETWORK_ERROR".into(),None),Error::Setup=>return Err(Error::Setup)};let mut value=accepted("local",id);value["valid"]=json!(false);value["error_code"]=json!(code);value["message"]=json!("Your license could not be confirmed. Connect and try again, or contact your software provider.");println!("{value}");Ok(1)}}}
fn main(){let code=match execute(){Ok(code)=>code,Err(_)=>{eprintln!("Check application settings and private storage. Contact your software provider if the problem continues.");2}};std::process::exit(code)}

[package]
name = "kdpika-rust-rest-example"
version = "1.0.0"
edition = "2021"
rust-version = "1.82"
publish = false

[dependencies]
base64 = "=0.22.1"
base64ct = "=1.6.0"
ed25519-dalek = "=2.2.0"
serde = { version = "=1.0.228", features = ["derive"] }
serde_json = { version = "=1.0.145", features = ["raw_value"] }
sha2 = "=0.10.9"
zeroize = "=1.8.1"
ureq = { version = "=2.12.1", default-features = false, features = ["tls"] }
url = "=2.5.2"
chrono = { version = "=0.4.38", default-features = false, features = ["clock", "std"] }
uuid = { version = "=1.11.0", features = ["v4"] }
fs2 = "=0.4.3"