License panel: "Refresh license" button — forced check-in for instant seat updates #86

New issue

Closed

opened 2026-07-31 01:12:26 +00:00 by Cordy · 0 comments

Cordy commented

2026-07-31 01:12:26 +00:00

Owner

The propagation mechanism already exists: POST /v1/checkin returns the current signed key, and cairnd auto-installs it (#58). What's missing is a way to trigger it on demand.

Decision (discussed with Nikola): pull, never push. A "Refresh license" button in the admin License panel calls a new admin endpoint that performs an immediate check-in and installs any refreshed key, then reports the result. The alternative — the license server pushing updates into instances — is rejected outright: the server doesn't know where instances live, and a vendor server reaching into self-hosted deployments is exactly what Cairn's sovereignty positioning promises never happens.

Scope: admin endpoint (e.g. POST /api/v1/license/refresh) that runs the existing check-in path synchronously; button + result feedback in the License panel; only meaningful when a license with a check-in URL is installed (feature-detect as the panel already does).

Dogfood finding (Nikola): after a seat change on swisscairn.ch, the instance doesn't reflect the new count until the next monthly check-in — up to a month of lag between paying for seats and having them. The propagation mechanism already exists: `POST /v1/checkin` returns the current signed key, and cairnd auto-installs it (#58). What's missing is a way to trigger it on demand. Decision (discussed with Nikola): **pull, never push.** A "Refresh license" button in the admin License panel calls a new admin endpoint that performs an immediate check-in and installs any refreshed key, then reports the result. The alternative — the license server pushing updates into instances — is rejected outright: the server doesn't know where instances live, and a vendor server reaching into self-hosted deployments is exactly what Cairn's sovereignty positioning promises never happens. Scope: admin endpoint (e.g. `POST /api/v1/license/refresh`) that runs the existing check-in path synchronously; button + result feedback in the License panel; only meaningful when a license with a check-in URL is installed (feature-detect as the panel already does).