feat(storage): implement in-memory ingestion queue, PostgreSQL enterprise backend, and gated DB WebUI tab

src/server_enrollment.py

@@ -17,6 +17,7 @@ from cryptography.hazmat.primitives.asymmetric import rsa
 OID_LOGAR_SEATS = x509.ObjectIdentifier("1.3.6.1.4.1.59999.1.1")
 OID_LOGAR_LICENSE_ID = x509.ObjectIdentifier("1.3.6.1.4.1.59999.1.2")
 OID_LOGAR_ISSUER_URL = x509.ObjectIdentifier("1.3.6.1.4.1.59999.1.3")
+OID_LOGAR_FEATURES = x509.ObjectIdentifier("1.3.6.1.4.1.59999.1.4")
 
 
 
@@ -448,6 +449,19 @@ def extract_license_info_from_cert(cert_pem: str) -> Dict[str, Any]:
     except (x509.ExtensionNotFound, Exception):
         issuer_url = None
 
+    features = []
+    try:
+        ext_feat = cert.extensions.get_extension_for_oid(OID_LOGAR_FEATURES)
+        if ext_feat and ext_feat.value:
+            raw_val = ext_feat.value.value if hasattr(ext_feat.value, "value") else str(ext_feat.value)
+            feat_str = raw_val.decode("utf-8").strip() if isinstance(raw_val, bytes) else str(raw_val).strip()
+            if feat_str.startswith("["):
+                features = json.loads(feat_str)
+            else:
+                features = [f.strip() for f in feat_str.split(",") if f.strip()]
+    except Exception:
+        features = []
+
     not_before = getattr(cert, "not_valid_before_utc", None) or cert.not_valid_before.replace(tzinfo=datetime.timezone.utc)
     not_after = getattr(cert, "not_valid_after_utc", None) or cert.not_valid_after.replace(tzinfo=datetime.timezone.utc)
     now = datetime.datetime.now(datetime.timezone.utc)
@@ -482,6 +496,7 @@ def extract_license_info_from_cert(cert_pem: str) -> Dict[str, Any]:
         "seats": seats,
         "license_id": license_id,
         "issuer_url": issuer_url,
+        "features": features,
         "subject_cn": subject_cn,
         "issuer_cn": issuer_cn,
         "is_ca": is_ca,
@@ -603,11 +618,12 @@ def sign_ca_csr_with_seats(
     seats: int,
     days_valid: int = 365,
     license_id: Optional[str] = None,
-    license_server_url: str = "https://logar.eibl.tech"
+    license_server_url: str = "https://logar.eibl.tech",
+    features: Optional[List[str]] = None
 ) -> str:
     """
     Signs a subordinate CA CSR using the master license authority Root CA.
-    Embeds the approved seat count and license ID via custom X.509 extensions.
+    Embeds the approved seat count, license ID, and optional enterprise features via custom X.509 extensions.
     Returns the signed PEM certificate.
     """
     csr = x509.load_pem_x509_csr(csr_pem.encode("utf-8"))
@@ -666,6 +682,13 @@ def sign_ca_csr_with_seats(
         )
     )
 
+    if features:
+        feat_str = json.dumps(features) if isinstance(features, list) else str(features)
+        builder = builder.add_extension(
+            x509.UnrecognizedExtension(OID_LOGAR_FEATURES, feat_str.encode("utf-8")),
+            critical=False
+        )
+
     signed_cert = builder.sign(master_ca_key, hashes.SHA256())
     return signed_cert.public_bytes(serialization.Encoding.PEM).decode("utf-8")
 
@@ -903,6 +926,7 @@ def import_license_package(
         "master_root_ca_pem": master_root_ca_pem,
         "license_info": info,
         "seats": info.get("seats"),
+        "features": info.get("features", []),
         "license_id": info.get("license_id"),
         "issuer_url": info.get("issuer_url"),
         "fingerprint": info.get("fingerprint"),