"""Self-contained browser handoff for air-gapped license activation.""" from __future__ import annotations import secrets from fastapi.responses import HTMLResponse from licensing_shared.constants import MAX_SIGNED_DOCUMENT_BYTES OFFLINE_ACTIVATION_PATH = "/offline-activation" CONTENT_SECURITY_NONCE_PLACEHOLDER = "__APOLON_CSP_NONCE__" MAXIMUM_FILE_BYTES_PLACEHOLDER = "__APOLON_MAXIMUM_FILE_BYTES__" OFFLINE_ACTIVATION_HTML = """ Apolon offline licensing

Offline activation, trial, renewal, and release

On the offline computer, create a request in License Center. Transfer that request file here. Activation requests also need the serial from the purchase; release requests securely free the existing device slot. Trial requests are reviewed without requiring a card. Renewal requests use account sign-in in License Center on a connected computer.

Ready.

The browser does not retain the serial or request file. The licensing authority stores only the serial's keyed digest. Trial request files contain a public device key and privacy-bounded evidence digests, never raw hardware identifiers. Release requires a valid enrolled-device signature.

""" def offline_activation_response() -> HTMLResponse: nonce = secrets.token_urlsafe(24) body = OFFLINE_ACTIVATION_HTML.replace( CONTENT_SECURITY_NONCE_PLACEHOLDER, nonce, ).replace( MAXIMUM_FILE_BYTES_PLACEHOLDER, str(MAX_SIGNED_DOCUMENT_BYTES), ) return HTMLResponse( body, headers={ "Cache-Control": "no-store", "Content-Security-Policy": ( "default-src 'none'; " f"script-src 'nonce-{nonce}'; style-src 'nonce-{nonce}'; " "connect-src 'self'; base-uri 'none'; form-action 'none'; " "frame-ancestors 'none'" ), "Cross-Origin-Opener-Policy": "same-origin", "Permissions-Policy": "camera=(), microphone=(), geolocation=()", "Referrer-Policy": "no-referrer", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", }, ) __all__ = ["OFFLINE_ACTIVATION_PATH", "offline_activation_response"]