Harden PKI license verification, database seat reconciliation, and binary packaging

src/Server.py

@@ -1313,8 +1313,10 @@ def enroll_client(req: ClientEnrollRequest, request: Request = None):
         conn.close()
         raise HTTPException(status_code=500, detail="License configuration not initialized")
 
-    expected_secret, max_seats = row[0], row[1]
-    license_status = row[2] if len(row) > 2 and row[2] else ("active" if max_seats > 0 else "unlicensed")
+    expected_secret = row[0]
+    lic_summary = LicenseManager.get_license_summary(SERVER_STATE, db_path=db_path)
+    max_seats = lic_summary.get("max_seats", 0)
+    license_status = lic_summary.get("status", "UNLICENSED").lower()
     if max_seats <= 0 or license_status in ("unlicensed", "revoked", "expired"):
         conn.close()
         raise HTTPException(status_code=403, detail="Server is unlicensed. Import an activated .lic file via the WebUI before enrolling edge clients.")
@@ -1893,9 +1895,20 @@ def import_signed_license(req: LicenseImportRequest, auth_user: str = Depends(re
     cert_dir = SERVER_STATE.get("config", {}).get("cert_dir", "certs")
     ca_file = os.path.join(cert_dir, "ca.crt")
     upstream_file = os.path.join(cert_dir, "upstream_ca.crt")
+    upstream_pem = req.upstream_ca.strip() if req.upstream_ca else None
+    if not upstream_pem and os.path.exists(upstream_file):
+        try:
+            with open(upstream_file, "r", encoding="utf-8") as f:
+                upstream_pem = f.read().strip()
+        except Exception:
+            upstream_pem = None
+
+    if upstream_pem:
+        if not enrollment.verify_certificate_signature(req.ca_cert, upstream_pem):
+            raise HTTPException(status_code=400, detail="Cryptographic verification failed: Sub-CA certificate was not signed by the upstream Master Authority.")
 
     try:
-        info = enrollment.extract_license_info_from_cert(req.ca_cert)
+        info = enrollment.extract_license_info_from_cert(req.ca_cert, upstream_ca_pem=upstream_pem)
     except Exception as e:
         raise HTTPException(status_code=400, detail=f"Failed to parse X.509 certificate: {e}")