windows installer fixes

tests/test_pipeline.py

@@ -8,6 +8,7 @@ import struct
 import sqlite3
 import urllib.request
 import urllib.error
+import shutil
 import warnings
 from datetime import datetime, timezone, timedelta
 
@@ -51,9 +52,84 @@ def run_tests():
     print(f"[OK] Fingerprint verified: {client_conf['server_fingerprint']}")
 
     cert_dir = os.path.join(ROOT_DIR, "test_pipeline_certs")
+    shutil.rmtree(cert_dir, ignore_errors=True)
     os.makedirs(cert_dir, exist_ok=True)
     client_id = "test-edge-node.corp.internal"
     enrollment_secret = server_conf.get("enrollment_secret") or client_conf.get("enrollment_secret")
+    auth_token = server_conf.get("auth_token", "")
+
+    print("\n=== [1.5] Testing Server License Activation via Web API (/api/license/import) ===")
+    import server_enrollment
+    
+    # 1. Check current license status
+    req_status_init = urllib.request.Request(f"http://{HERMES_HOST}:{HERMES_PORT}/api/license/status")
+    with urllib.request.urlopen(req_status_init, timeout=5) as resp:
+        init_lic_stat = json.loads(resp.read().decode("utf-8"))
+    
+    if init_lic_stat.get("status") == "UNLICENSED":
+        unlicensed_enroll_payload = {
+            "client_id": client_id,
+            "hostname": client_id,
+            "os": "linux",
+            "enrollment_secret": enrollment_secret
+        }
+        req_unlicensed = urllib.request.Request(
+            f"http://{HERMES_HOST}:{HERMES_PORT}/api/client/enroll",
+            data=json.dumps(unlicensed_enroll_payload).encode("utf-8"),
+            headers={"Content-Type": "application/json"}
+        )
+        try:
+            with urllib.request.urlopen(req_unlicensed, timeout=5):
+                assert False, "Expected HTTP 403 on unlicensed server enrollment"
+        except urllib.error.HTTPError as e:
+            assert e.code == 403, f"Expected HTTP 403 on unlicensed server, got {e.code}"
+            print("[OK] Unlicensed server correctly rejected edge client enrollment.")
+
+    # 2. Fetch CA CSR from Server
+    req_csr = urllib.request.Request(
+        f"http://{HERMES_HOST}:{HERMES_PORT}/api/license/csr",
+        headers={"Authorization": f"Bearer {auth_token}"}
+    )
+    with urllib.request.urlopen(req_csr, timeout=5) as resp:
+        assert resp.status == 200
+        csr_data = json.loads(resp.read().decode("utf-8"))
+        csr_pem = csr_data["csr"]
+    print("[OK] Fetched subordinate CA CSR from server.")
+
+    # 3. Generate test master CA and sign subordinate CA with 10 seats
+    master_ca_dir = os.path.join(ROOT_DIR, "test_pipeline_master_ca")
+    master_cert, master_key, master_pem, master_key_pem = server_enrollment.generate_ca_if_needed(cert_dir=master_ca_dir, common_name="LOGAR-Master-Root-CA")
+    sub_pem = server_enrollment.sign_ca_csr_with_seats(
+        csr_pem=csr_pem,
+        master_ca_cert_pem=master_pem,
+        master_ca_key_pem=master_key_pem,
+        license_id="LIC-TEST-PIPELINE-10",
+        seats=10,
+        days_valid=365
+    )
+
+    # 4. Import signed license package to server
+    import_payload = {"ca_cert": sub_pem, "master_root_ca": master_pem}
+    req_import = urllib.request.Request(
+        f"http://{HERMES_HOST}:{HERMES_PORT}/api/license/import",
+        data=json.dumps(import_payload).encode("utf-8"),
+        headers={"Content-Type": "application/json", "Authorization": f"Bearer {auth_token}"}
+    )
+    with urllib.request.urlopen(req_import, timeout=5) as resp:
+        assert resp.status == 200
+        import_res = json.loads(resp.read().decode("utf-8"))
+        assert import_res["status"] == "success"
+        assert import_res["seats"] == 10
+    print("[OK] Successfully imported signed license (.lic). Server activated with 10 seats.")
+
+    # 5. Verify license status
+    req_status = urllib.request.Request(f"http://{HERMES_HOST}:{HERMES_PORT}/api/license/status")
+    with urllib.request.urlopen(req_status, timeout=5) as resp:
+        assert resp.status == 200
+        lic_stat = json.loads(resp.read().decode("utf-8"))
+        assert lic_stat["status"] == "ACTIVE"
+        assert lic_stat["max_seats"] == 10
+    print("[OK] Verified server license status is ACTIVE.")
 
     print("\n=== [2] Testing Client Dynamic PKI Enrollment API (/api/client/enroll) ===")
     enroll_url = f"http://{HERMES_HOST}:{HERMES_PORT}/api/client/enroll"
@@ -244,7 +320,6 @@ def run_tests():
     linux_logs = get_recent_linux_logs(hours=24)
     print(f"[Linux_Client] Successfully queried Linux logs: {len(linux_logs)} candidate entries.")
 
-    import shutil
     if os.path.exists(cert_dir):
         shutil.rmtree(cert_dir, ignore_errors=True)
 

tests/test_server.py

@@ -220,7 +220,7 @@ class TestServerComponent(unittest.TestCase):
         test_cert_dir = "test_certs_enroll"
         try:
             ca_cert, ca_key, ca_pem, _ = Server.enrollment.generate_ca_if_needed(cert_dir=test_cert_dir)
-            Server.SERVER_STATE["config"] = {"db_path": self.test_db}
+            Server.SERVER_STATE["config"] = {"db_path": self.test_db, "cert_dir": test_cert_dir}
             Server.SERVER_STATE["ca_cert"] = ca_cert
             Server.SERVER_STATE["ca_key"] = ca_key
             Server.SERVER_STATE["ca_cert_pem"] = ca_pem
@@ -246,7 +246,7 @@ class TestServerComponent(unittest.TestCase):
             resp1 = Server.enroll_client(req1)
             self.assertIn("client_cert", resp1)
             self.assertIn("client_key", resp1)
-            self.assertEqual(resp1["ca_cert"], ca_pem)
+            self.assertTrue(resp1["ca_cert"].strip().startswith(ca_pem.strip()))
 
             # 3. Valid enrollment for client 2
             req2 = Server.ClientEnrollRequest(