feat(server): modularize backend and admin console

app/services/license_service.py

@@ -0,0 +1,37 @@
+import base64
+import hashlib
+import os
+from pathlib import Path
+
+from cryptography.fernet import Fernet, InvalidToken
+
+from app.core.security import ADMIN_TOKEN
+from app.services.signing_service import MANIFEST_PRIVATE_KEY_PATH
+
+
+def license_key_encryption_material() -> bytes:
+    configured_secret = os.getenv("LICENSE_KEY_ENCRYPTION_SECRET", "").strip()
+    if configured_secret:
+        return configured_secret.encode("utf-8")
+    key_path = Path(MANIFEST_PRIVATE_KEY_PATH)
+    if key_path.exists():
+        return key_path.read_bytes()
+    return ADMIN_TOKEN.encode("utf-8")
+
+
+def license_key_cipher() -> Fernet:
+    key = base64.urlsafe_b64encode(hashlib.sha256(license_key_encryption_material()).digest())
+    return Fernet(key)
+
+
+def encrypt_license_key(license_key: str) -> str:
+    return license_key_cipher().encrypt(license_key.encode("utf-8")).decode("ascii")
+
+
+def decrypt_license_key(cipher_text: str) -> str:
+    if not cipher_text:
+        return ""
+    try:
+        return license_key_cipher().decrypt(cipher_text.encode("ascii")).decode("utf-8")
+    except (InvalidToken, UnicodeDecodeError, ValueError):
+        return ""