Investigate: manually re-installing a re-signed key with the same license id doesn't take effect #87

New issue

Closed

opened 2026-07-31 01:12:32 +00:00 by Cordy · 0 comments

Cordy commented

2026-07-31 01:12:32 +00:00

Owner

Dogfood finding (Nikola): after a seat change re-signed the license (same id, 60 → 65 seats), pasting the updated key into the License panel left the display at 60. Installing a different license and then re-installing the updated one showed 65 correctly.

Hypotheses, to verify against internal/license + the API handler before touching anything:

The manual PUT /api/v1/license path has a same-id or same-key short-circuit that skips re-verification/re-install when the incoming license id matches the current one (a guard that's correct for check-in auto-install may be wrong for explicit manual installs — an operator pasting a key is expressing intent).
The panel UI renders cached license info and doesn't re-fetch after install.
Operator error is possible too (pasting the pre-change key string from an old copy) — the fix should make this impossible to confuse: after install, the panel should always show the now-effective seats.

An explicit manual install of a valid, unexpired key must always take effect, whatever id it carries.

Dogfood finding (Nikola): after a seat change re-signed the license (same id, 60 → 65 seats), pasting the updated key into the License panel left the display at 60. Installing a *different* license and then re-installing the updated one showed 65 correctly. Hypotheses, to verify against `internal/license` + the API handler before touching anything: 1. The manual `PUT /api/v1/license` path has a same-id or same-key short-circuit that skips re-verification/re-install when the incoming license id matches the current one (a guard that's correct for check-in auto-install may be wrong for explicit manual installs — an operator pasting a key is expressing intent). 2. The panel UI renders cached license info and doesn't re-fetch after install. 3. Operator error is possible too (pasting the pre-change key string from an old copy) — the fix should make this impossible to confuse: after install, the panel should always show the now-effective seats. An explicit manual install of a *valid, unexpired* key must always take effect, whatever id it carries.