Every CoreInto site runs with a CoreInto licence key (CI- and four groups of five letters and digits), bought from the CoreInto licence server, https://system.coreinto.com. The key is entered when installing, on Utilities > CoreInto Licence, or with php cli.php licence-set KEY. This chapter covers the licence of your own site. Selling licences for your own software is the Licensing Manager, in Licensing.
How the licence is checked
The site sends the licence server its key, the product coreinto, its domain and install folder, its server name, its version, how many clients it has, and a fresh random value. The licence server answers with a signed token (ES256) saying whether the licence is active, until when the answer is valid, the grace days, the edition, the client limit, who the licence is registered to and when the next payment is due. The licence is bound to the domain and install folder of its first check when the licence product says so; the token names them, and a token for another domain or folder is not accepted.
The domain is taken from the site's address in configuration.php (system_url), never from what a browser sends.
The site trusts only tokens signed with the licence server's key that is built into CoreInto (app/src/Licence/Licence.php). A token that is changed, signed with another key, meant for another key or product, issued in the future, or an answer to another request, is refused. So a site cannot be licensed by a fake licence server, and a token copied from another site does not work.
The answer is saved (settings CILicenceKey and CILicenceState) and checked again:
- by the automation task
licence-check(every hour; it checks in only when a check is due): a day after the last answer; after a failed attempt, an hour later, then every six hours; - with "Check now" on Utilities > CoreInto Licence, or
php cli.php licence-check.
The site also remembers the latest time it ran at (setting CILicenceSeen). When the server's clock is set more than an hour back from it, the licence counts as Restricted with "The server's clock is behind the time this site last ran at. Correct the date and time, then check the licence again." A fresh answer from the licence server after the clock is put right clears it.
The three states
| State | When | What happens |
|---|---|---|
| Licensed | The last answer is active and still valid. | Everything works. |
| Grace period | The answer has run out because the licence server could not be reached, but the grace days have not. | Everything works. Every admin page shows "CoreInto licence: The licence server could not be reached recently. Everything keeps working until DATE." |
| Restricted | No key; never confirmed; past the grace days; or the licence server's latest answer is a refusal (suspended, expired, wrong domain or folder, unknown key...). A refusal acts at once, without grace. | See below. |
What a restricted site can still do
- The client area, the store, payments and the payment providers' notifications, invoicing, reminders, ticket mail and the rest of the automation keep working, so your clients can still pay.
- New services are not set up and domains are not registered or transferred: accepting an order, "Create" on a service or "Register" on a domain answers "New services are not set up until this site's CoreInto licence is in order (...)". What automation would have set up (after a payment) goes into the module queue, staff get the usual "module action failed" email, and it is retried; once the licence is in order, anything left can be run again from Pending Module Actions. Suspending, unsuspending, renewing and terminating keep working.
- In the admin area only Utilities > CoreInto Licence, sign-out, My Account and the Database Update page open; every other page sends you to the licence page, and forms elsewhere are refused with "This site's CoreInto licence is not in order, so only the licence page is open."
- The API answers HTTP 403 "This site's CoreInto licence is not in order, so the API is closed until it is."
- No update is offered or installed.
Nothing is removed or stopped: as soon as the licence is in order again (a check is accepted), everything opens.
Utilities > CoreInto Licence
Every administrator can open the page; entering a key and "Check now" need the permission "Update CoreInto" (system.update). It shows the state with its message, and:
| Item | What it shows |
|---|---|
| Licence key | The key, with its middle hidden. |
| Registered to, Edition | From the licence server's answer. |
| Clients | Clients that are not closed, and the licence's limit (or "no limit"). |
| Valid until | When the saved answer runs out; every successful check moves it on. |
| Next payment due | The due date of the licence's service on the licence server. |
| Last successful check, Last problem | When the licence server last confirmed the licence, and the last error with its time. |
| Licence server, Domain, Install folder, This copy | What the site sends. |
Enter the licence key / Change the licence key: the key is checked with the licence server before it is saved. When the site is licensed (or in its grace period) and the new key cannot be checked or is not accepted, the current licence is kept and the page says why ("The licence server did not accept the new key (...); the current licence is kept."). With no working licence, the key is saved with the answer so the daily check retries it.
The client limit
When the licence has a client limit, adding a client in the admin area or with the API action clients.add is refused once the site has that many clients that are not closed: "The CoreInto licence allows N clients and the site has M; upgrade the licence to add more." Clients who register themselves in the client area, or who place an order, are never turned away. Existing clients are never touched.
The licence server itself
The CoreInto site that is the licence server (it holds the private half of the licence key that is built into CoreInto) needs no licence of its own: the page says "This copy is the licence server; it needs no licence of its own."