feat: add cmshopee authorization shadow routes

apps/licensing/services.py

@@ -39,6 +39,18 @@ class LicensingError(Exception):
         super().__init__(message)
 
 
+@dataclass(frozen=True)
+class AuthorizationDecision:
+    product_code: str
+    allowed: bool
+    code: str
+    credential_id: int | None = None
+
+    @property
+    def would_reject(self) -> bool:
+        return not self.allowed
+
+
 @dataclass(frozen=True)
 class DeviceRegistrationResult:
     device: ClientDevice
@@ -579,3 +591,32 @@ def revoke_device_credential(*, credential: DeviceCredential, reason: str, actor
             now=now,
         )
     return locked_credential
+
+
+def evaluate_device_authorization(*, user, product_code: str, device=None, raw_credential_token: str = "", now=None):
+    now = now or timezone.now()
+    if device is None:
+        return AuthorizationDecision(product_code, False, "device_not_bound")
+    if device.user_id != user.id or device.product_code != product_code:
+        return AuthorizationDecision(product_code, False, "device_mismatch")
+
+    raw_credential_token = str(raw_credential_token or "").strip()
+    if not raw_credential_token:
+        return AuthorizationDecision(product_code, False, "license_required")
+    credential = (
+        DeviceCredential.objects.select_related("device", "entitlement", "seat")
+        .filter(token_hash=MigrationRequest.hash_credential_token(raw_credential_token))
+        .first()
+    )
+    if credential is None:
+        return AuthorizationDecision(product_code, False, "license_required")
+    if (
+        credential.user_id != user.id
+        or credential.product_code != product_code
+        or credential.device_id != device.id
+        or credential.seat.device_id != device.id
+    ):
+        return AuthorizationDecision(product_code, False, "device_mismatch", credential.id)
+    if not credential.is_active_at(now) or not credential.entitlement.is_usable_at(now):
+        return AuthorizationDecision(product_code, False, "license_expired", credential.id)
+    return AuthorizationDecision(product_code, True, "", credential.id)