refactor: simplify license access (#14)

Author: axadrn

AGENTS.md

@@ -7,7 +7,7 @@ This repository contains the public goilerplate CLI and the shared API contract.
 ## Brand
 
 - Always write the product name as `goilerplate` in lowercase, including at the start of sentences and headings.
-- Keep technical identifiers such as `GOILERPLATE_TOKEN` and `X-Goilerplate-Version` unchanged.
+- Keep technical identifiers such as `X-Goilerplate-Version` unchanged.
 
 ## Engineering
 

README.md

@@ -29,7 +29,7 @@ goilerplate new
 
 `new` opens a small terminal wizard. Choose a project name, module path, database, frontend, and the features you need. Review the command, press Enter, and get an ordinary Go repository on your machine.
 
-Prefer explicit flags for scripts or CI:
+Prefer explicit flags for repeatable commands:
 
 ```text
 goilerplate new --name Acme --module example.com/acme ./acme
@@ -38,7 +38,7 @@ goilerplate new --edition paid --name Acme --module example.com/acme --framework
 
 The Free edition is a fixed htmx, SQLite, and SMTP foundation. Paid generation adds htmx or Datastar, PostgreSQL, payment providers, teams, OAuth, storage, content, and the Projects example.
 
-The website builder produces the same flags. The terminal wizard, copied commands, and CI all use one generation path.
+The website builder produces the same flags. The terminal wizard and copied commands use one generation path.
 
 ## Update a project
 
@@ -65,16 +65,7 @@ goilerplate license invite <license-id> developer@example.com
 goilerplate license remove <license-id> <user-or-invitation-id>
 ```
 
-`whoami` prints the license ID. Owners invite or remove people. A company always keeps at least one Owner.
-
-CI uses a separate generation-only token:
-
-```text
-goilerplate token create <license-id> deploy
-GOILERPLATE_TOKEN="$GOILERPLATE_TOKEN" goilerplate new --module example.com/acme ./acme
-```
-
-Store the token in the CI provider's secret store. It cannot manage people or other tokens.
+`whoami` prints `Access: Free` or `Access: Paid`. Paid users also see their license IDs. Owners invite or remove people. A company always keeps at least one Owner.
 
 ## Useful commands
 

api/api.go

@@ -40,9 +40,8 @@ type ConfirmLicenseClaimRequest struct {
 }
 
 type WhoAmIResponse struct {
-	Account            Account   `json:"account"`
-	Licenses           []License `json:"licenses"`
-	EffectiveLicenseID string    `json:"effective_license_id,omitempty"`
+	Account  Account   `json:"account"`
+	Licenses []License `json:"licenses"`
 }
 
 type Account struct {
@@ -53,23 +52,13 @@ type Account struct {
 
 type License struct {
 	ID     string        `json:"id"`
-	Tier   LicenseTier   `json:"tier"`
 	Status LicenseStatus `json:"status"`
 	Role   LicenseRole   `json:"role"`
 }
 
-type LicenseTier string
-
-const (
-	LicenseTierFree          LicenseTier = "free"
-	LicenseTierPaid          LicenseTier = "paid"
-	LicenseTierGrandfathered LicenseTier = "grandfathered"
-)
-
 type LicenseStatus string
 
 const (
-	LicenseStatusPending LicenseStatus = "pending"
 	LicenseStatusActive  LicenseStatus = "active"
 	LicenseStatusRevoked LicenseStatus = "revoked"
 )
@@ -109,26 +98,6 @@ type InviteLicenseMemberResponse struct {
 	Joined bool `json:"joined"`
 }
 
-type CreateLicenseTokenRequest struct {
-	Name string `json:"name"`
-}
-
-type CreateLicenseTokenResponse struct {
-	Token LicenseToken `json:"token"`
-	Value string       `json:"value"`
-}
-
-type LicenseTokensResponse struct {
-	Tokens []LicenseToken `json:"tokens"`
-}
-
-type LicenseToken struct {
-	ID        string     `json:"id"`
-	Name      string     `json:"name"`
-	RevokedAt *time.Time `json:"revoked_at,omitempty"`
-	CreatedAt time.Time  `json:"created_at"`
-}
-
 type DeleteAccountRequest struct {
 	ConfirmGitHubLogin string `json:"confirm_github_login"`
 }

cmd/goilerplate/main.go

@@ -50,7 +50,6 @@ func run(ctx context.Context) error {
 		GitHubClientID: githubClientID,
 		DefaultAPIURL:  "https://goilerplate.com",
 		APIURLOverride: strings.TrimSpace(os.Getenv("GOILERPLATE_API_URL")),
-		MachineToken:   strings.TrimSpace(os.Getenv("GOILERPLATE_TOKEN")),
 		Version:        buildVersion(),
 		FetchReleases: func(ctx context.Context) ([]github.Release, error) {
 			return github.ListReleases(ctx, httpClient)

internal/cli/app.go

@@ -32,9 +32,6 @@ type ServiceClient interface {
 	LicenseMembers(context.Context, string, string) (api.LicenseMembersResponse, error)
 	InviteLicenseMember(context.Context, string, string, api.InviteLicenseMemberRequest) (api.InviteLicenseMemberResponse, error)
 	RemoveLicenseMember(context.Context, string, string, string) error
-	CreateLicenseToken(context.Context, string, string, string) (api.CreateLicenseTokenResponse, error)
-	LicenseTokens(context.Context, string, string) (api.LicenseTokensResponse, error)
-	RevokeLicenseToken(context.Context, string, string, string) error
 	DeleteAccount(context.Context, string, string) error
 	Generate(context.Context, string, api.GenerateRequest, io.Writer) (string, error)
 	UpdateTree(context.Context, string, api.GenerateRequest, io.Writer) (string, error)
@@ -50,7 +47,6 @@ type App struct {
 	GitHubClientID      string
 	DefaultAPIURL       string
 	APIURLOverride      string
-	MachineToken        string
 	Version             string
 	WorkingDirectory    string
 	RunNewProjectWizard func(context.Context) ([]string, error)
@@ -103,8 +99,6 @@ func (a *App) Run(ctx context.Context, arguments []string) error {
 		return a.claim(ctx, arguments[1:])
 	case "license":
 		return a.license(ctx, arguments[1:])
-	case "token":
-		return a.token(ctx, arguments[1:])
 	case "account":
 		return a.account(ctx, arguments[1:])
 	case "changelog":
@@ -139,7 +133,6 @@ func (a *App) help(arguments []string) error {
 		"logout":    {"goilerplate logout", "Revoke the current goilerplate session."},
 		"claim":     {"goilerplate claim <purchase-email>", "goilerplate claim --code <code>"},
 		"license":   {"goilerplate license members|invite|remove ...", "Manage people on a company license."},
-		"token":     {"goilerplate token create|list|revoke ...", "Manage generation-only CI keys."},
 		"account":   {"goilerplate account delete --confirm <github-login>", "Delete the current account."},
 		"changelog": {"goilerplate changelog", "Show published GitHub release notes."},
 		"doctor":    {"goilerplate doctor", "Check tools and configuration for a generated project."},
@@ -228,13 +221,20 @@ func (a *App) whoAmI(ctx context.Context, arguments []string) error {
 		return err
 	}
 	fmt.Fprintf(a.Out, "@%s <%s>\n", identity.Account.GitHubLogin, identity.Account.Email)
-	fmt.Fprintln(a.Out, "  LICENSE ID  TIER  STATUS  ROLE")
+	access := "Free"
 	for _, license := range identity.Licenses {
-		marker := " "
-		if license.ID == identity.EffectiveLicenseID {
-			marker = "*"
+		if license.Status == api.LicenseStatusActive {
+			access = "Paid"
+			break
 		}
-		fmt.Fprintf(a.Out, "%s %s  %s  %s  %s\n", marker, license.ID, license.Tier, license.Status, license.Role)
+	}
+	fmt.Fprintf(a.Out, "Access: %s\n", access)
+	if len(identity.Licenses) == 0 {
+		return nil
+	}
+	fmt.Fprintln(a.Out, "  LICENSE ID  STATUS  ROLE")
+	for _, license := range identity.Licenses {
+		fmt.Fprintf(a.Out, "  %s  %s  %s\n", license.ID, license.Status, license.Role)
 	}
 	return nil
 }
@@ -286,7 +286,6 @@ func (a *App) printUsage() {
 	fmt.Fprintln(a.Out, "  claim    Connect a purchase made with another email")
 	fmt.Fprintln(a.Out, "  whoami   Show the current account and licenses")
 	fmt.Fprintln(a.Out, "  license  Invite, list, or remove license members")
-	fmt.Fprintln(a.Out, "  token    Create, list, or revoke CI keys")
 	fmt.Fprintln(a.Out, "  account delete  Delete the current account")
 	fmt.Fprintln(a.Out, "  changelog  Show published release notes")
 	fmt.Fprintln(a.Out, "  doctor   Check a generated project's local tools")

internal/cli/app_test.go

@@ -160,23 +160,21 @@ func TestLoginRevokesNewSessionWhenSavingFails(t *testing.T) {
 	}
 }
 
-func TestWhoAmIShowsEffectiveLicense(t *testing.T) {
+func TestWhoAmIShowsPaidAccessAndLicenses(t *testing.T) {
 	output := &bytes.Buffer{}
 	store := &memoryStore{configuration: config.Config{APIURL: "https://goilerplate.com", SessionToken: "session"}}
 	service := &fakeService{who: api.WhoAmIResponse{
 		Account: api.Account{GitHubLogin: "axadrn", Email: "hello@example.com"},
 		Licenses: []api.License{
-			{ID: "free", Tier: api.LicenseTierFree, Status: api.LicenseStatusActive, Role: api.LicenseRoleOwner},
-			{ID: "paid", Tier: api.LicenseTierPaid, Status: api.LicenseStatusActive, Role: api.LicenseRoleMember},
+			{ID: "paid", Status: api.LicenseStatusActive, Role: api.LicenseRoleMember},
 		},
-		EffectiveLicenseID: "paid",
 	}}
 	app := testApp(output, store, &fakeDevice{}, service)
 
 	if err := app.Run(context.Background(), []string{"whoami"}); err != nil {
 		t.Fatal(err)
 	}
-	if !strings.Contains(output.String(), "* paid  paid  active  member") {
+	if !strings.Contains(output.String(), "Access: Paid") || !strings.Contains(output.String(), "paid  active  member") {
 		t.Fatalf("output = %q", output.String())
 	}
 }
@@ -208,25 +206,19 @@ func TestLogoutPreservesTokenWhenRevocationFails(t *testing.T) {
 	}
 }
 
-func TestLicenseAndTokenCommandsUseExplicitLicenseIDs(t *testing.T) {
+func TestLicenseCommandsUseExplicitLicenseIDs(t *testing.T) {
 	output := &bytes.Buffer{}
 	store := &memoryStore{configuration: config.Config{APIURL: "https://goilerplate.com", SessionToken: "session"}}
 	service := &fakeService{
 		members: api.LicenseMembersResponse{Members: []api.LicenseMember{{
 			UserID: "user-1", GitHubLogin: "developer", Email: "developer@example.com", Role: api.LicenseRoleMember,
 		}}},
-		createdToken: api.CreateLicenseTokenResponse{
-			Token: api.LicenseToken{ID: "token-1", Name: "deploy"}, Value: "gok_secret",
-		},
 	}
 	app := testApp(output, store, &fakeDevice{}, service)
 	if err := app.Run(context.Background(), []string{"license", "members", "license-1"}); err != nil {
 		t.Fatal(err)
 	}
-	if err := app.Run(context.Background(), []string{"token", "create", "license-1", "deploy"}); err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(output.String(), "@developer") || !strings.Contains(output.String(), "gok_secret") || !strings.Contains(output.String(), "shown only once") {
+	if !strings.Contains(output.String(), "@developer") {
 		t.Fatalf("output = %q", output.String())
 	}
 }
@@ -274,7 +266,7 @@ func TestClaimValidatesArgumentsBeforeLogin(t *testing.T) {
 }
 
 func TestHelpCoversEveryCommand(t *testing.T) {
-	for _, command := range []string{"new", "update", "login", "whoami", "logout", "claim", "license", "token", "account", "changelog", "doctor", "version"} {
+	for _, command := range []string{"new", "update", "login", "whoami", "logout", "claim", "license", "account", "changelog", "doctor", "version"} {
 		t.Run(command, func(t *testing.T) {
 			output := &bytes.Buffer{}
 			app := testApp(output, &memoryStore{}, &fakeDevice{}, &fakeService{})
@@ -433,21 +425,6 @@ func TestNewWithoutArgumentsRequiresInteractiveTerminal(t *testing.T) {
 	}
 }
 
-func TestNewUsesMachineTokenWithoutPersonalLogin(t *testing.T) {
-	store := &memoryStore{}
-	service := &fakeService{generatedVersion: "v3.0.0", archive: cliTestArchive(t, "go.mod", "module example.com/acme")}
-	app := testApp(&bytes.Buffer{}, store, &fakeDevice{}, service)
-	app.MachineToken = "gok_machine"
-	if err := app.Run(context.Background(), []string{
-		"new", "--module", "example.com/acme", filepath.Join(t.TempDir(), "acme"),
-	}); err != nil {
-		t.Fatal(err)
-	}
-	if service.generateToken != "gok_machine" || service.receivedGitHubToken != "" {
-		t.Fatalf("generate token = %q, GitHub token = %q", service.generateToken, service.receivedGitHubToken)
-	}
-}
-
 func TestNewRejectsPaidModulesForFreeBeforeCallingService(t *testing.T) {
 	service := &fakeService{}
 	app := testApp(&bytes.Buffer{}, &memoryStore{}, &fakeDevice{}, service)
@@ -591,11 +568,8 @@ type fakeService struct {
 	updateRequests      []api.GenerateRequest
 	generateCalled      bool
 	members             api.LicenseMembersResponse
-	tokens              api.LicenseTokensResponse
-	createdToken        api.CreateLicenseTokenResponse
 	invited             api.InviteLicenseMemberResponse
 	removedMember       string
-	revokedToken        string
 	deletedAccount      string
 	claimEmail          string
 	claimCode           string
@@ -663,19 +637,6 @@ func (s *fakeService) RemoveLicenseMember(_ context.Context, _ string, _ string,
 	return nil
 }
 
-func (s *fakeService) CreateLicenseToken(context.Context, string, string, string) (api.CreateLicenseTokenResponse, error) {
-	return s.createdToken, nil
-}
-
-func (s *fakeService) LicenseTokens(context.Context, string, string) (api.LicenseTokensResponse, error) {
-	return s.tokens, nil
-}
-
-func (s *fakeService) RevokeLicenseToken(_ context.Context, _ string, _ string, tokenID string) error {
-	s.revokedToken = tokenID
-	return nil
-}
-
 func (s *fakeService) DeleteAccount(_ context.Context, _ string, confirmation string) error {
 	s.deletedAccount = confirmation
 	return nil

internal/cli/license.go

@@ -70,7 +70,7 @@ func (a *App) license(ctx context.Context, arguments []string) error {
 		if err := client.RemoveLicenseMember(ctx, token, arguments[1], arguments[2]); err != nil {
 			return err
 		}
-		fmt.Fprintln(a.Out, "Access removed. Company CI keys were revoked when an active member was removed.")
+		fmt.Fprintln(a.Out, "Access removed")
 		return nil
 	default:
 		return fmt.Errorf("unknown license command %q", arguments[0])

internal/cli/new.go

@@ -79,18 +79,14 @@ func (a *App) newProject(ctx context.Context, arguments []string) error {
 	if err != nil {
 		return err
 	}
-	authorizationToken := strings.TrimSpace(a.MachineToken)
-	if authorizationToken == "" {
-		if configuration.SessionToken == "" {
-			if err := a.login(ctx, nil); err != nil {
-				return err
-			}
-			configuration, err = a.Store.Load()
-			if err != nil {
-				return err
-			}
+	if configuration.SessionToken == "" {
+		if err := a.login(ctx, nil); err != nil {
+			return err
+		}
+		configuration, err = a.Store.Load()
+		if err != nil {
+			return err
 		}
-		authorizationToken = configuration.SessionToken
 	}
 	client, err := a.NewService(a.apiURL(configuration))
 	if err != nil {
@@ -108,7 +104,7 @@ func (a *App) newProject(ctx context.Context, arguments []string) error {
 	if a.Version != "" && a.Version != "dev" {
 		templateVersion = a.Version
 	}
-	generatedVersion, err := client.Generate(ctx, authorizationToken, api.GenerateRequest{
+	generatedVersion, err := client.Generate(ctx, configuration.SessionToken, api.GenerateRequest{
 		TemplateVersion: templateVersion,
 		Answers:         answers,
 	}, archive)