hamzcore

Core logic package with license validation. Uses blocklist logic:

• By default: allow (record usage and return allowed)
• Block only when key, domain, or (key, domain) is explicitly in the blocklist

Package (hamzcore)

Install

cd hamzcore
npm install
npm run build

Usage in your app

const { connectDb, validateLicense, assertLicense } = require("hamzcore");

// Database (checks license before connecting; reads LICENSE_KEY from env)
await connectDb(process.env.MONGODB_URI);

// Or license only:
const { allowed } = await validateLicense(process.env.LICENSE_KEY, "your-domain.com");
await assertLicense(process.env.LICENSE_KEY, "your-domain.com");

Exports

• connectDb(uri) – MongoDB connection with license gate (reads LICENSE_KEY, domain from env)
• validateLicense, assertLicense – License validation
• encryptText, decryptText – Crypto utilities
• signAccessToken, signRefreshToken, verifyAccessToken, verifyRefreshToken, sign2FAToken, verify2FAToken – JWT utilities

Environment variables (required by the main app)

• LICENSE_KEY – Your license key (read from env in hamzcore)
• LICENSE_DOMAIN or APP_URL or VERCEL_URL – Domain for validation

The license server URL is hardcoded to https://www.hamzosoft.com. API may return { isActive: true } or { allowed: true }.

License server (/server)

Standalone TypeScript Node.js server that validates licenses using a blocklist.

Run

# From hamzcore root:
npm run server
# Or with hot reload:
npm run server:dev

# Or from server folder:
cd server
npm install && npm run build
node dist/server.js
# Or: PORT=4000 node dist/server.js

API

POST /api/validate

{ "key": "your-license-key", "domain": "example.com" }

Response (default = allowed) – use isActive or allowed:

{ "isActive": true }

or

{ "allowed": true }

Response (when blocked):

{ "isActive": false, "reason": "Blocked by administrator" }

Blocklist

Edit server/blocklist.json:

{
  "blockedKeys": ["revoked-key-1"],
  "blockedDomains": ["unauthorized-site.com"],
  "blockedPairs": [{ "key": "key1", "domain": "bad.com" }]
}

• blockedKeys – Block any use of these keys
• blockedDomains – Block any key on these domains
• blockedPairs – Block specific (key, domain) combinations

Usage log

The server records each validation in server/usage.json (or in-memory if file write fails). Use this to see which domains are using which keys.

Repository structure

hamzcore/                     # NPM package (separate folder & repo)
├── src/
│   ├── index.ts
│   ├── license.ts
│   ├── db.ts
│   ├── crypto.ts
│   └── jwt.ts
├── dist/                     # Package build output
├── server/                   # License validation server (TypeScript)
│   ├── server.ts
│   ├── tsconfig.json
│   ├── blocklist.json
│   └── dist/                 # Server build output
├── package.json
├── tsconfig.json
└── README.md

Where to keep this

Recommended: create a separate GitHub/GitLab repo and push this folder:

cd hamzcore
git init
git add .
git commit -m "Initial hamzcore package"
git remote add origin <your-repo-url>
git push -u origin main

Publish to npm

cd hamzcore
npm run build
npm login
npm publish

For scoped packages (e.g. @hamzosoft/hamzcore): change "name" in package.json to @hamzosoft/hamzcore and run npm publish --access public. For private packages, use npm publish with an npm Pro/Teams account.

Check if name is taken: npm view hamzcore – if 404, the name is available.