SUPERMARKET POS V2 — STARTER LICENSE ACTIVATION KIT

WHAT IT DOES
- Creates unique license keys on your own license server.
- Activates each key against one domain.
- Supports lifetime licenses (no expiry) or expiry dates.
- Lets the vendor suspend/revoke a key by changing its status in the license database.
- Client checks online every 12 hours, with a 7-day grace window after a successful check if the server is temporarily unavailable.

IMPORTANT LIMITATION
This is a starter implementation, not tamper-proof DRM. If customers receive editable PHP source code, a technically skilled customer can remove client-side checks. Keep important licensing/business logic server-side or use PHP source protection if stronger enforcement is required.

1. LICENSE SERVER SETUP
- Create a separate MySQL database for the license service.
- Import license-server/schema.sql into it.
- Copy license-server/config.example.php to license-server/config.php and enter database credentials.
- Upload the license-server folder to a separate HTTPS host, e.g. https://license.yourdomain.com/ . The API endpoints should be reachable at https://license.yourdomain.com/api/activate.php and /api/validate.php. Ensure config.php is not publicly downloadable; deny direct web access to it using server configuration or place it above public_html.
- Move bin/create-license.php to a non-public directory if possible. It is designed to run only in CLI.
- Create a key from SSH/CLI: php create-license.php "ABC Supermarket" 2027-12-31
  Omit the date for lifetime validity. Send the resulting key securely to the customer.

2. CUSTOMER POS SETUP
- Copy pos-client/license/ into the POS installation root so the path is pos_v2/license/.
- Edit pos_v2/license/config.php and set POS_LICENSE_API_BASE to your real HTTPS URL plus /api.
- The activation page is pos_v2/license/license.php. The user needs the POS permission settings.manage.
- First test on a staging copy before adding the guard to your production bootstrap.

3. ENFORCE LICENSE CHECKS
After you test activation, add this line near the END of pos_v2/includes/bootstrap.php, after the PDO connection ($pdo) and session are initialized:

    require_once __DIR__ . '/../license/guard.php';

Do not include the guard before $pdo/session exist. If your bootstrap is used by endpoints that must stay available before activation (e.g. logout or installer), adjust the exemptions in guard.php for those exact routes. Ensure the activation page itself is exempt.

4. SUSPEND / REVOKE / TRANSFER
In the license-server database, set status='suspended' or status='revoked' to disable a license. To transfer a license, clear bound_domain and activated_at for that key, then let the customer activate it on the new domain. Do this only after confirming the customer request.

5. SECURITY
- HTTPS is required for the license server.
- Keep license-server/config.php and the license-creation script private.
- Restrict database credentials to the license database only.
- Back up the license database.
- A domain check is not a physical-device lock; localhost/staging domains should not be used for customer production licenses.
- This sample does not include a vendor web dashboard or automated billing/payment integration.
