Research WHMCS Licensing & Addons

[bobbravo2]

Test variable ways of managing addons with licensing. See #15

Paths to research

Trust the client directory

Cons They could have a nulled / illegal copy of the module, but wouldn't be able to get updates
Pros No need to refresh the remote license after a purchase / install.

Lazy Install Method

Pros Validate periodically that the client actually purchased the code
Cons Have to refresh the license after purchase.
Solution Use a lazy install method:

• After a client clicks "Buy", set a timeout on their site of ~5-15 seconds
• After timeout expires, hide the "Buy" button, and show an "Install Now" button
• Install now will pass necessary validation variables to our site, which will either:
  • Send back a ZIP file
  • Install this module, then revalidate remote license
  • Error out with a header (402 - payment required)
  • Send the client back to the addons page
• Now that the module is installed, and we have refreshed the license, the validation will pass if valid!

the WHMCS method

1. Buy an addon
2. Either/or: Upload via FTP && Refresh the license
3. Bad UX because the license may be stale after FTP'ing, requiring a manual refresh
   • Possible security implications ???
     I think we're good — because we're developing a framework for sending the code after the purchase has been validated, WHMCS sometimes already has the code in the ZIP file, which means they have no other way to validate it than their addons system.

Installation Flow

1. Client goes to our cart, cart.php?gid=addons&pid={need_the_product_ID_from_client_license}
2. Client is able to see new addons, purchasing them
3. After purchase, client will need to refresh license OR just have an install link that tries our server. Obviously, we'll validate the addon, license, and product_id on our side. If it's valid (IE- they just bought a license, we can send the file over the wire, if not, we can redirect to the addons cart page add a message to the redirection about not having that addon on this product )
   • Perhaps have a click listener on the buy now button that will change it to an install now button, which will not work if the client hasn't actually paid.
4. this gives a much more responsive feel.
   1. From there, after the app store has the ZIP file, it'll run the installation
   2. Create a post_module_installed action to refresh the license, which will re-validate that they are able to access this module.

Problems

• Need to define a addon definition schema
  • Either json/xml
  • Used to define dependencies, required modules, etc
  • eNom PRO will use this file to test requirements before installing / updating any addons
  • prevents breaking a site due to a missing module, incompatible main version, etc.