feat: migrate to dodopayments

[s0up4200]

Summary by CodeRabbit

• New Features

  • Added Dodo Payments as a second license provider and Dodo portal/checkout links; licenses now show a provider.

• UI/UX Updates

  • Simplified license management flow, updated copy (remove vs release), checkout steps, portal links, and improved toasts/error messages.

• Data & Migrations

  • Added schema migration to store provider and instance IDs; migration normalization added.

• Tests & Stability

  • New tests for provider migrations, validation, and Dodo/Polar integration scenarios.

[coderabbitai]

Walkthrough

Adds Dodo Payments as a second license provider: new Dodo client, DB schema and model fields for provider and instance ID, repo and service changes for provider-aware activate/validate/deactivate flows, API and frontend exposure of provider, tests and migration/rename handling.

Changes

Cohort / File(s)	Summary
Dodo client internal/dodo/client.go	New HTTP client implementing Activate/Validate/Deactivate, request/response types, error mapping, and configurable options.
Service core (multi-provider) internal/services/license/license_service.go, internal/services/license/provider.go, internal/services/license/checker.go	Service now holds a dodoClient; provider-aware activation/validation/deactivation and migration logic added; new helpers and errors; offline grace becomes configurable.
Database & repo internal/database/migrations/057_add_license_provider_dodo.sql, internal/database/db.go, internal/database/license_repo.go, internal/database/db_test.go, internal/database/migration_renames_test.go	Adds provider and dodo_instance_id columns and migration; repo queries/inserts/updates extended to persist these fields; added UpdateLicenseProvider and centralized rollback helper; tests updated.
Models & API surface internal/models/license.go, internal/api/handlers/licenses.go, internal/web/swagger/openapi.yaml	ProductLicense gains Provider and DodoInstanceID; API handler and OpenAPI now expose provider; handler types updated.
CLI/server wiring cmd/qui/main.go	Creates and wires Dodo client into license service; NewLicenseService signature updated at call site.
Polar client internal/polar/client.go	Adds Deactivate support and nuanced response/error handling for deactivation flows.
Tests internal/services/license/license_service_dodo_regression_test.go, internal/services/license/license_service_validation_test.go, internal/api/handlers/licenses_validate_test.go	New and updated tests covering Dodo/Polar flows, migration rename behavior, validation of missing licenses, and constructor/signature adjustments.
Frontend — UI & lib web/src/components/themes/LicenseManager.tsx, web/src/hooks/useLicense.ts, web/src/lib/api.ts, web/src/lib/dodo-constants.ts, web/src/lib/license-errors.ts, web/src/pages/Settings.tsx, web/src/routes/_authenticated/settings.tsx	Adds Dodo constants, exposes provider in API types, updates LicenseManager props and UI/flow to reference Dodo/portal logic, adjusts messages and route search params.
Repo config .gitignore	Removes .envrc from ignore and adds local reference dump ignores (dodopayments.txt, polar.txt).

Sequence Diagram(s)

sequenceDiagram
    participant UI as Frontend
    participant API as API Handler
    participant Svc as License Service
    participant Dodo as Dodo Client
    participant Polar as Polar Client
    participant DB as Database

    rect rgba(100,150,200,0.5)
    note over UI,API: Activation request (provider-aware)
    UI->>API: POST /api/license/activate (licenseKey, username)
    API->>Svc: ActivateAndStoreLicense(licenseKey, username)
    Svc->>DB: GetLicenseByKey(licenseKey)
    alt provider == "dodo"
        Svc->>Dodo: Activate(...)
        Dodo-->>Svc: ActivateResponse / error
    else provider == "polar"
        Svc->>Polar: Activate(...)
        Polar-->>Svc: ActivateResponse / error
    else provider unknown
        Svc->>Dodo: Validate(...)
        alt Dodo valid
            Svc->>DB: UpdateLicenseProvider("dodo", instanceID)
        else
            Svc->>Polar: Validate/Activate(...)
            Polar-->>Svc: response
            Svc->>DB: UpdateLicenseProvider("polar", NULL)
        end
    end
    Svc->>DB: Store/Update license (status, provider, dodo_instance_id)
    DB-->>Svc: commit
    Svc-->>API: ProductLicense
    API-->>UI: {licenseKey, status, provider, ...}
    end

Loading

sequenceDiagram
    participant Scheduler as Scheduler
    participant Svc as License Service
    participant DB as Database
    participant Dodo as Dodo Client
    participant Polar as Polar Client

    rect rgba(150,100,200,0.5)
    note over Scheduler,Svc: Periodic refresh / validation
    Scheduler->>Svc: RefreshAllLicenses()
    Svc->>DB: GetAllLicenses()
    DB-->>Svc: licenses[]
    loop each license
        alt license.provider == "dodo"
            Svc->>Dodo: Validate(licenseKey, instanceID)
            Dodo-->>Svc: ValidateResponse
        else license.provider == "polar"
            Svc->>Polar: Validate(licenseKey)
            Polar-->>Svc: ValidateResponse
        else provider unknown
            Svc->>Dodo: Validate(licenseKey)
            alt Dodo valid (returns instance_id)
                Svc->>DB: UpdateLicenseProvider("dodo", instance_id)
            else
                Svc->>Polar: Validate(licenseKey)
                alt Polar valid
                    Svc->>DB: UpdateLicenseProvider("polar", NULL)
                end
            end
        end
        Svc->>DB: Update status/fields as needed
    end
    Svc-->>DB: done
    end

Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

• fix(license): cap 7d offline grace, ignore transient errors #617: Changes to offline grace-period and validation/error handling in license service (overlapping logic).
• chore(themes): add crypto instructions in-app #620: Frontend LicenseManager and UI/portal changes overlap with this PR's UI edits.

Suggested labels

enhancement, web, themes

Suggested reviewers

• zze0s

Poem

🐰 I hopped through schemas, fields anew,

Dodo joined Polar in the queue,
Keys now find homes with provider names,
Services chatter with brand-new aims,
The rabbit twitches—deploy and woo!

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 17.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main objective of the pull request: integrating Dodo Payments as a license provider alongside Polar.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/dodopayments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Fix all issues with AI agents

In @.gitignore:
- Line 62: The .gitignore contains a duplicate `.envrc` entry; remove the
redundant occurrence so `.envrc` appears only once (keep the first or the
intended single entry) and delete the duplicate lines (the repeated `.envrc` at
lines referenced in the review) ensuring no extra blank lines remain—update the
`.gitignore` so the only unique symbol `.envrc` is present once.

In `@internal/dodo/client.go`:
- Around line 213-255: Replace the unbounded io.ReadAll in parseError with a
bounded read (e.g., use io.LimitReader or io.ReadAll(io.LimitReader(resp.Body,
maxErrorBodyBytes))) and define a reasonable constant like maxErrorBodyBytes
(e.g., 64*1024). Use the resulting truncated buffer for the json.Unmarshal into
errorResponse and for building the message; if the buffer was truncated, append
a short marker like " (truncated)" to the message before calling wrapError or
returning APIError. Keep wrapError and the APIError logic unchanged, only ensure
parseError uses the size-limited read and the new maxErrorBodyBytes constant.

In `@internal/services/license/license_service.go`:
- Around line 52-81: The fallback logic fails to detect the "dodo client not
configured" case because activateWithDodo returns a plain error string; add a
typed package-level sentinel error (e.g., ErrDodoClientNotConfigured =
errors.New("dodo client not configured")), return that sentinel from
activateWithDodo when the Dodo client is nil, and update isDodoFallbackError to
include errors.Is(err, ErrDodoClientNotConfigured) (in addition to the existing
checks for dodo.ErrLicenseNotFound and dodo.ErrInvalidLicenseKey) so
activateWithPolar is attempted when Dodo is not configured.

🧹 Nitpick comments (4)

internal/web/swagger/openapi.yaml (1)

2445-2453: Consider documenting provider as an enum.

This makes the API contract clearer for clients and keeps it aligned with backend provider constants.

♻️ Suggested schema refinement

                     provider:
                       type: string
+                      enum:
+                        - polar
+                        - dodo

web/src/hooks/useLicense.ts (1)

78-88: Keep delete error messaging consistent with other license hooks.

Other license mutations use getLicenseErrorMessage, which likely preserves backend-specific messages; consider reusing it here too.

♻️ Suggested tweak

-    onError: (error: Error) => {
-      toast.error(error.message || "Failed to remove license")
-    },
+    onError: (error: Error) => {
+      toast.error(getLicenseErrorMessage(error))
+    },

internal/models/license.go (1)

50-51: Consider grouping provider constants separately.

The provider constants are placed under the "LicenseStatus constants" comment, but they're conceptually different. Consider either updating the comment to encompass both or creating a separate const block for providers.

♻️ Suggested organization

 // LicenseStatus constants
 const (
 	LicenseStatusActive  = "active"
 	LicenseStatusInvalid = "invalid"
+)
+
+// LicenseProvider constants
+const (
 	LicenseProviderDodo  = "dodo"
 	LicenseProviderPolar = "polar"
 )

web/src/components/themes/LicenseManager.tsx (1)

54-58: Consider guarding for future multi‑license support.

portalUrl/portalLabel are derived from licenses[0]. If multi‑license support is introduced later, consider deriving this from the license being rendered/acted on to avoid provider mismatches.

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@internal/services/license/license_service.go`:
- Around line 582-584: The default branch in RefreshAllLicenses currently
returns ErrDodoClientNotConfigured immediately, which bypasses the fallback
logic used in ValidateLicenses; instead, change the default branch in
RefreshAllLicenses to treat the missing s.dodoClient like a transient/fallback
error so it flows into handleTransient()/isDodoFallbackError() the same way
ValidateLicenses does (i.e., do not return ErrDodoClientNotConfigured
directly—invoke the same fallback/error-path handling used elsewhere so Polar
fallback is attempted).
- Around line 217-221: The switch branch that currently returns
errors.New("activation limit exceeded") discards the sentinel
polar.ErrActivationLimitExceeded; change that branch to wrap and return the
original sentinel (e.g., use errors.Wrap(polar.ErrActivationLimitExceeded,
"activation limit exceeded") or fmt.Errorf("activation limit exceeded: %w",
polar.ErrActivationLimitExceeded)) so callers can still use errors.Is(...,
polar.ErrActivationLimitExceeded); update the switch in the license activation
logic where the code checks errors.Is(err, polar.ErrActivationLimitExceeded) to
return the wrapped sentinel instead of a new error.

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@internal/services/license/license_service.go`:
- Around line 474-478: The loop in Refresh/validation over licenses should not
abort on single-provider failures; replace hard returns (e.g., returning
ErrDodoClientNotConfigured and other `return err` occurrences inside the
for-loop for Dodo/Polar) with a continue plus a logged error or accumulation of
the error so the loop proceeds to subsequent licenses. Specifically, in the
switch handling normalizeProvider(license.Provider) for
models.LicenseProviderDodo and models.LicenseProviderPolar, change checks like
`if s.dodoClient == nil { return ErrDodoClientNotConfigured }` and any `return
err` inside the loop to `log`/record the error and `continue` (mirror how
ErrActivationLimitExceeded branches do), or delegate to the existing
handleTransient pattern used by ValidateLicenses to mark transient failures
without aborting the whole refresh. Ensure you reference
s.dodoClient/s.polarClient, ErrDodoClientNotConfigured, and
handleTransient/ValidateLicenses behavior when making the changes.
- Around line 656-677: ValidateLicenses can dereference a nil s.dodoClient after
ensureDodoActivation returns early; add the same nil-check used in
RefreshAllLicenses before calling s.dodoClient.Validate: inside the switch case
handling models.LicenseProviderDodo (in ValidateLicenses), ensure s.dodoClient
!= nil (and return/handle as transient or mark invalid as appropriate) before
invoking s.dodoClient.Validate(...) so we avoid a nil pointer panic from
s.dodoClient; update error handling to mirror the existing RefreshAllLicenses
guard behavior.

🧹 Nitpick comments (1)

internal/services/license/license_service.go (1)

639-642: Commented-out code: remove or restore the recently-validated skip.

The time.Since(license.LastValidated) < time.Hour guard is active in RefreshAllLicenses (line 458) but commented out here. If the skip is intentionally disabled for ValidateLicenses, a brief comment explaining why would help; otherwise, clean it up.

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

internal/services/license/license_service.go (2)

20-22: ⚠️ Potential issue | 🟠 Major

Remove duplicate ErrLicenseNotFound sentinel — use models.ErrLicenseNotFound consistently.

This package declares its own ErrLicenseNotFound at line 21 while models.ErrLicenseNotFound already exists (internal/models/license.go line 13), both with identical error text. Since errors.New creates distinct sentinel objects, they cannot be matched by a single errors.Is() call. The handler in internal/api/handlers/licenses.go line 177 must check both sentinels separately, which is unnecessary duplication. Delete the declaration at line 21 and use models.ErrLicenseNotFound throughout this package.

---

27-43: ⚠️ Potential issue | 🟡 Minor

Remove unused db field from Service struct.

The db *database.DB field (line 28) is declared but never initialized in the constructor (lines 36-43) and is not used anywhere in the service. Remove it to avoid confusion.

🤖 Fix all issues with AI agents

In `@internal/services/license/license_service.go`:
- Around line 884-911: The Dodo branch in DeleteLicense enforces stricter
behavior than the Polar branch by returning ErrDodoClientNotConfigured when
s.dodoClient is nil, preventing local DB deletion; make the behaviors consistent
by changing the Dodo handling in DeleteLicense (the switch on normalizeProvider
and the block referencing s.dodoClient, DodoInstanceID, and
ErrDodoClientNotConfigured) so that if s.dodoClient is nil you log a warning and
skip remote deactivation (similar to the Polar path) instead of returning an
error—keep existing error handling for actual Deactivate() failures but do not
block local deletion when the client is unavailable.

🧹 Nitpick comments (5)

internal/services/license/license_service_dodo_regression_test.go (1)

221-282: Solid multi-license continuation test.

Verifies that a Dodo client error for one license doesn't block processing of a subsequent Polar license. The assertion that the Polar license remains active after the Dodo error confirms the recordRefreshErr + continue pattern works correctly.

One observation: the test doesn't assert the Dodo license's final status. If you want full coverage, consider also fetching and checking the Dodo license to confirm it wasn't inadvertently modified.

internal/services/license/license_service.go (4)

532-536: Asymmetric nil-client handling: Polar configuration errors are silently swallowed.

When dodoClient is nil (lines 483-488), the error is recorded via recordRefreshErr and eventually returned to the caller. When polarClient is nil (lines 533-536), the license is silently skipped with only a log warning — recordRefreshErr is not called. The same asymmetry exists in ValidateLicenses (line 740-744 vs 680-683).

If this is intentional (Polar is legacy, Dodo is primary), a brief comment explaining the difference would help future maintainers. Otherwise, consider recording the error consistently.

---

661-664: Remove or restore the commented-out time-check block.

This 1-hour skip is active in RefreshAllLicenses (line 465) but commented out here. If intentionally disabled for ValidateLicenses, add a brief comment explaining why. If this is leftover debug code, remove it to avoid confusion.

---

863-868: Return logic is subtle but correct — consider a clarifying comment.

The intent: when a license is definitively invalid (!allValid), suppress any transient error so the caller can cleanly distinguish "invalid" from "transient failure". When everything appears valid but a transient error occurred, surface it so the caller knows validation was incomplete.

A brief inline comment would help future readers understand the priority-based error suppression.

---

385-430: ensurePolarActivation does not set license.Status = Active unlike ensureDodoActivation.

ensureDodoActivation (line 371) explicitly sets license.Status = models.LicenseStatusActive, but ensurePolarActivation omits this. Currently safe because callers pre-filter for active licenses, but this inconsistency could bite if the method is reused in a broader context later.

Proposed fix

 	license.Provider = models.LicenseProviderPolar
 	license.DodoInstanceID = ""
 	license.PolarActivationID = activateResp.Id
 	license.PolarCustomerID = &activateResp.LicenseKey.CustomerID
 	license.PolarProductID = &activateResp.LicenseKey.BenefitID
 	license.ActivatedAt = time.Now()
 	license.ExpiresAt = activateResp.LicenseKey.ExpiresAt
+	license.Status = models.LicenseStatusActive

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

internal/api/handlers/licenses.go (1)

177-183: ⚠️ Potential issue | 🟠 Major

Add check for dodo.ErrLicenseNotFound in the error handling.

The handler checks errors.Is(err, models.ErrLicenseNotFound) which will match repository errors, but validateExistingDodoLicense wraps dodo client errors with fmt.Errorf, allowing dodo.ErrLicenseNotFound to propagate unwrapped in the error chain. Since dodo.ErrLicenseNotFound is a distinct sentinel from models.ErrLicenseNotFound, it will not match the check and will fall through to the generic 403 Forbidden response instead of 404 Not Found. Consider also checking errors.Is(err, dodo.ErrLicenseNotFound) or normalize the error in the service layer.

🧹 Nitpick comments (4)

internal/services/license/license_service_dodo_regression_test.go (1)

1-1: Copyright year inconsistency.

This file uses 2025 while licenses.go and license_service.go use 2025-2026. Consider updating for consistency.

internal/services/license/license_service.go (3)

528-532: Asymmetric error recording: Polar nil-client skips recordRefreshErr, Dodo does not.

When dodoClient is nil (lines 479-484), the error is captured via recordRefreshErr(ErrDodoClientNotConfigured) and surfaces to the caller. When polarClient is nil (lines 529-532), it silently skips without recording. This means RefreshAllLicenses returns nil if only Polar licenses couldn't be refreshed due to a missing client, but returns an error if only Dodo licenses couldn't.

If this asymmetry is intentional (e.g., Polar is being phased out), a brief comment would clarify intent.

---

446-451: recordRefreshErr only captures the first error — consider errors.Join for richer diagnostics.

If multiple licenses fail for different reasons, only the first error is preserved. With Go 1.20+ errors.Join, you could accumulate all errors while still letting callers use errors.Is against any of them. This is optional and low priority.

---

130-142: Multiple time.Now() calls per activation create slight timestamp drift between fields.

In both activateWithDodo and activateWithPolar, ActivatedAt, LastValidated, CreatedAt, and UpdatedAt each call time.Now() separately, which could produce slightly different timestamps. Consider capturing now := time.Now() once and reusing it.

Example for activateWithDodo

+	now := time.Now()
 	if existingLicense != nil {
 		existingLicense.ProductName = productName
 		existingLicense.Status = models.LicenseStatusActive
-		existingLicense.ActivatedAt = time.Now()
+		existingLicense.ActivatedAt = now
 		existingLicense.ExpiresAt = activateResp.ExpiresAt
-		existingLicense.LastValidated = time.Now()
+		existingLicense.LastValidated = now
 		// ...
-		existingLicense.UpdatedAt = time.Now()
+		existingLicense.UpdatedAt = now

Also applies to: 156-167, 205-217, 231-244