Add /api/license/csr endpoint and support master_root_ca in LicenseImportRequest

.gitignore

@@ -41,6 +41,7 @@ master_ca_certs/
 .env
 *.env
 runner/.env
+updates/
 
 # IDE & OS files
 .vscode/

src/hub/Server.py

@@ -1930,6 +1930,17 @@ def export_lic_file(auth_user: str = Depends(require_admin_auth)):
     )
 
 
+@app.get("/api/license/csr")
+def get_ca_csr_json(auth_user: str = Depends(require_admin_auth)):
+    cert_dir = SERVER_STATE.get("config", {}).get("cert_dir", "certs")
+    csr_path = os.path.join(cert_dir, "ca.csr")
+    if not os.path.exists(csr_path):
+        enrollment.generate_ca_csr(cert_dir=cert_dir)
+    with open(csr_path, "r", encoding="utf-8") as f:
+        csr_content = f.read()
+    return {"status": "success", "csr": csr_content, "format": "LOGAR_LICENSE_CSR"}
+
+
 @app.get("/api/license/ca-csr")
 def get_ca_csr(auth_user: str = Depends(require_admin_auth)):
     cert_dir = SERVER_STATE.get("config", {}).get("cert_dir", "certs")
@@ -1950,7 +1961,8 @@ def import_signed_license(req: LicenseImportRequest, auth_user: str = Depends(re
     cert_dir = SERVER_STATE.get("config", {}).get("cert_dir", "certs")
     ca_file = os.path.join(cert_dir, "ca.crt")
     upstream_file = os.path.join(cert_dir, "upstream_ca.crt")
-    upstream_pem = req.upstream_ca.strip() if req.upstream_ca else None
+    provided_upstream = req.upstream_ca or req.master_root_ca
+    upstream_pem = provided_upstream.strip() if provided_upstream else None
     if not upstream_pem and os.path.exists(upstream_file):
         try:
             with open(upstream_file, "r", encoding="utf-8") as f:
@@ -1970,9 +1982,9 @@ def import_signed_license(req: LicenseImportRequest, auth_user: str = Depends(re
     with open(ca_file, "w", encoding="utf-8") as f:
         f.write(req.ca_cert.strip() + "\n")
 
-    if req.upstream_ca:
+    if provided_upstream:
         with open(upstream_file, "w", encoding="utf-8") as f:
-            f.write(req.upstream_ca.strip() + "\n")
+            f.write(provided_upstream.strip() + "\n")
 
     new_seats = info.get("seats")
     license_id = info.get("license_id")

src/hub/server_models.py

@@ -33,6 +33,7 @@ class ClientActionRequest(BaseModel):
 class LicenseImportRequest(BaseModel):
     ca_cert: str
     upstream_ca: Optional[str] = None
+    master_root_ca: Optional[str] = None
 
 
 class HermesTokenCreateRequest(BaseModel):