feat: add cmshopee authorization shadow routes

apps/licensing/services.py

@@ -39,6 +39,18 @@ class LicensingError(Exception):
         super().__init__(message)
 
 
+@dataclass(frozen=True)
+class AuthorizationDecision:
+    product_code: str
+    allowed: bool
+    code: str
+    credential_id: int | None = None
+
+    @property
+    def would_reject(self) -> bool:
+        return not self.allowed
+
+
 @dataclass(frozen=True)
 class DeviceRegistrationResult:
     device: ClientDevice
@@ -579,3 +591,32 @@ def revoke_device_credential(*, credential: DeviceCredential, reason: str, actor
             now=now,
         )
     return locked_credential
+
+
+def evaluate_device_authorization(*, user, product_code: str, device=None, raw_credential_token: str = "", now=None):
+    now = now or timezone.now()
+    if device is None:
+        return AuthorizationDecision(product_code, False, "device_not_bound")
+    if device.user_id != user.id or device.product_code != product_code:
+        return AuthorizationDecision(product_code, False, "device_mismatch")
+
+    raw_credential_token = str(raw_credential_token or "").strip()
+    if not raw_credential_token:
+        return AuthorizationDecision(product_code, False, "license_required")
+    credential = (
+        DeviceCredential.objects.select_related("device", "entitlement", "seat")
+        .filter(token_hash=MigrationRequest.hash_credential_token(raw_credential_token))
+        .first()
+    )
+    if credential is None:
+        return AuthorizationDecision(product_code, False, "license_required")
+    if (
+        credential.user_id != user.id
+        or credential.product_code != product_code
+        or credential.device_id != device.id
+        or credential.seat.device_id != device.id
+    ):
+        return AuthorizationDecision(product_code, False, "device_mismatch", credential.id)
+    if not credential.is_active_at(now) or not credential.entitlement.is_usable_at(now):
+        return AuthorizationDecision(product_code, False, "license_expired", credential.id)
+    return AuthorizationDecision(product_code, True, "", credential.id)

apps/licensing/tests.py

@@ -26,6 +26,7 @@ from apps.licensing.services import (
     confirm_migration_request,
     create_legacy_migration_grant,
     create_migration_request,
+    evaluate_device_authorization,
     grant_software_entitlement,
     record_device_heartbeat,
     release_license_seat,
@@ -625,3 +626,50 @@ class LegacyMigrationFlowTests(TestCase):
                 now=timezone.now(),
             )
         self.assertFalse(DeviceCredential.objects.exists())
+
+    def test_authorization_decision_handles_missing_mismatched_and_expired_credentials(self):
+        self.grant_migration()
+        migration_request, raw_token = create_migration_request(
+            user=self.user,
+            device=self.device,
+        )
+        _request, credential, created = confirm_migration_request(
+            request_id=migration_request.request_id,
+            user=self.user,
+        )
+        self.assertTrue(created)
+        self.assertEqual(
+            evaluate_device_authorization(
+                user=self.user,
+                product_code="cmshopee",
+            ).code,
+            "device_not_bound",
+        )
+        self.assertEqual(
+            evaluate_device_authorization(
+                user=self.user,
+                product_code="cmshopee",
+                device=self.device,
+            ).code,
+            "license_required",
+        )
+        allowed = evaluate_device_authorization(
+            user=self.user,
+            product_code="cmshopee",
+            device=self.device,
+            raw_credential_token=raw_token,
+        )
+        self.assertTrue(allowed.allowed)
+        self.assertEqual(allowed.credential_id, credential.id)
+
+        DeviceCredential.objects.filter(pk=credential.pk).update(
+            expires_at=timezone.now() - timedelta(seconds=1)
+        )
+        expired = evaluate_device_authorization(
+            user=self.user,
+            product_code="cmshopee",
+            device=self.device,
+            raw_credential_token=raw_token,
+        )
+        self.assertTrue(expired.would_reject)
+        self.assertEqual(expired.code, "license_expired")