feat(hub): enforce license requirement for fleet auto-updates while keeping server upstream check free

src/hub/Server.py

@@ -1497,6 +1497,13 @@ def sync_upstream_packages_api(auth_user: str = Depends(require_admin_auth)):
     """
     Downloads latest client binary packages from upstream release assets to local Hub storage.
     """
+    db_path = SERVER_STATE.get("config", {}).get("db_path", DEFAULT_DB_FILE)
+    if not is_feature_licensed("auto_update", db_path):
+        raise HTTPException(
+            status_code=403,
+            detail="Fleet package acquisition and distribution requires an active license with the 'auto_update' capability."
+        )
+
     mgr: ServerUpdateManager = SERVER_STATE.get("update_manager") or UPDATE_MANAGER
     results = mgr.sync_upstream_packages(force=True)
     return {
@@ -1513,6 +1520,13 @@ def update_server_update_config(req: ServerUpdateConfigRequest, auth_user: str =
     """
     Updates fleet auto-update settings (on/off switch and automatic vs manual acquisition mode).
     """
+    db_path = SERVER_STATE.get("config", {}).get("db_path", DEFAULT_DB_FILE)
+    if not is_feature_licensed("auto_update", db_path):
+        raise HTTPException(
+            status_code=403,
+            detail="Fleet auto-update settings configuration requires an active license with the 'auto_update' capability."
+        )
+
     config = SERVER_STATE.get("config", {})
     mgr: ServerUpdateManager = SERVER_STATE.get("update_manager") or UPDATE_MANAGER
 
@@ -1562,12 +1576,10 @@ def check_client_update(
     """
     Invoked by edge forwarders to check whether a newer client binary package is available.
     """
-    import os as _os
     target_os = os_name or os or "windows"
-    mgr: ServerUpdateManager = SERVER_STATE.get("update_manager") or UPDATE_MANAGER
+    db_path = SERVER_STATE.get("config", {}).get("db_path", DEFAULT_DB_FILE)
     
     # Record check timestamp in database
-    db_path = SERVER_STATE.get("config", {}).get("db_path", DEFAULT_DB_FILE)
     if target_os:
         now_sql = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
         try:
@@ -1581,6 +1593,15 @@ def check_client_update(
         except Exception:
             pass
 
+    if not is_feature_licensed("auto_update", db_path):
+        return {
+            "update_available": False,
+            "latest_version": LOGAR_VERSION,
+            "current_version": current_version,
+            "reason": "Fleet auto-update is not authorized by the server license."
+        }
+
+    mgr: ServerUpdateManager = SERVER_STATE.get("update_manager") or UPDATE_MANAGER
     return mgr.check_client_update(client_id=client_id, os_type=target_os, current_version=current_version, arch=arch)
 
 
@@ -1597,6 +1618,13 @@ def download_client_update_package(
     import os as _os
     import email.utils
     target_os = os_name or os or "windows"
+    db_path = SERVER_STATE.get("config", {}).get("db_path", DEFAULT_DB_FILE)
+    if not is_feature_licensed("auto_update", db_path):
+        raise HTTPException(
+            status_code=403,
+            detail="Client binary package fleet distribution requires an active license with the 'auto_update' capability."
+        )
+
     mgr: ServerUpdateManager = SERVER_STATE.get("update_manager") or UPDATE_MANAGER
     pkg_tuple = mgr.get_client_package_path(os_type=target_os)
     if not pkg_tuple: