feat: add admin client policy control

apps/api/tests.py

@@ -65,6 +65,7 @@ from apps.moderation.models import SensitiveWord
 from apps.moderation.providers.keyword import reset_keyword_matcher_cache
 from apps.portal.models import DownloadRelease
 from apps.licensing.models import (
+    ClientSubscriptionPolicy,
     ClientDevice,
     SoftwareEntitlement,
     SoftwareOrder,
@@ -690,6 +691,29 @@ class ClientLatestReleaseApiTests(TestCase):
             },
         )
 
+    @override_settings(
+        CMSHOPEE_CLIENT_SUBSCRIPTION_POLICY="off",
+        CMSHOPEE_CLIENT_SUBSCRIPTION_POLICY_UPDATED_AT="2026-07-28T00:00:00+08:00",
+    )
+    def test_latest_release_prefers_admin_policy_without_restart(self):
+        policy = ClientSubscriptionPolicy.objects.create(
+            mode=ClientSubscriptionPolicy.Mode.OBSERVE,
+        )
+
+        response = self.client.get(self.url)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Cache-Control"], "no-store")
+        self.assertEqual(
+            response.data["client_policy"],
+            {
+                "policy_version": 1,
+                "subscription_check_enabled": True,
+                "subscription_enforcement_enabled": False,
+                "updated_at": policy.updated_at.isoformat(),
+            },
+        )
+
     @override_settings(
         CMSHOPEE_CLIENT_SUBSCRIPTION_POLICY="invalid",
         CMSHOPEE_CLIENT_SUBSCRIPTION_POLICY_UPDATED_AT="2026-07-28T10:00:00+08:00",

apps/api/views.py

@@ -1,6 +1,4 @@
 import logging
-
-from config.client_subscription_policy import get_client_subscription_policy
 from django.http import HttpResponse
 from django.utils import timezone
 from django.utils.decorators import method_decorator
@@ -81,6 +79,7 @@ from apps.licensing.services import (
     query_and_apply_software_payment,
     evaluate_subscription_access,
     software_subscription_status,
+    get_published_client_subscription_policy,
     record_device_heartbeat,
     register_device,
     resolve_optional_device_session,
@@ -675,7 +674,7 @@ class ClientLatestReleaseView(APIView):
     permission_classes = (AllowAny,)
 
     def get(self, request):
-        client_policy = get_client_subscription_policy()
+        client_policy = get_published_client_subscription_policy()
         platform = (
             request.query_params.get("platform")
             or DownloadRelease.Platform.WINDOWS