Detects when a pasted/uploaded licence key was generated for the wrong connection type (HTTP vs HTTPS) and warns the user before they submit it, instead of letting it fail with a generic "invalid key" error.
Intent
A licence key generated for one connection type always fails to decrypt when applied on the other - the failure currently surfaces only after a round trip to the backend, as a generic "Licence key is invalid" message with no indication of the actual cause. Catching this client-side, from the raw key text, gives the user an accurate reason immediately and prevents a guaranteed-to-fail submission.
Changes
New detectLicenceKeyProtocolMismatch utility (licensing/utils/): compares the pasted licence key and activation key text against whether this browsing context can actually decrypt a secure-connection key, returning which protocol the key requires (if any). Checks actual decrypt capability rather than location.protocol directly, since browsers treat localhost as a secure connection even over plain HTTP.
LicensingComponent: exposes a protocolMismatch getter wired to both the "Upload licence" and "Paste licence" tabs (they share the same underlying fields), and disables the "Apply licence keys" button while a mismatch is showing.
Template: shows a specific warning message for each mismatch direction, in the same position as the page's other licence-error messages.
Test coverage: unit tests for detectLicenceKeyProtocolMismatch covering both mismatch directions, the no-mismatch cases, empty input, and whitespace trimming; a Cypress test covering the browser-reachable direction (pasting a same-text key pair on a secure connection).
# Issue
Closes #133
# Summary
Detects when a pasted/uploaded licence key was generated for the wrong connection type (HTTP vs HTTPS) and warns the user before they submit it, instead of letting it fail with a generic "invalid key" error.
# Intent
A licence key generated for one connection type always fails to decrypt when applied on the other - the failure currently surfaces only after a round trip to the backend, as a generic "Licence key is invalid" message with no indication of the actual cause. Catching this client-side, from the raw key text, gives the user an accurate reason immediately and prevents a guaranteed-to-fail submission.
# Changes
- **New `detectLicenceKeyProtocolMismatch` utility** (`licensing/utils/`): compares the pasted licence key and activation key text against whether this browsing context can actually decrypt a secure-connection key, returning which protocol the key requires (if any). Checks actual decrypt capability rather than `location.protocol` directly, since browsers treat `localhost` as a secure connection even over plain HTTP.
- **`LicensingComponent`**: exposes a `protocolMismatch` getter wired to both the "Upload licence" and "Paste licence" tabs (they share the same underlying fields), and disables the "Apply licence keys" button while a mismatch is showing.
- **Template**: shows a specific warning message for each mismatch direction, in the same position as the page's other licence-error messages.
- **Test coverage**: unit tests for `detectLicenceKeyProtocolMismatch` covering both mismatch directions, the no-mismatch cases, empty input, and whitespace trimming; a Cypress test covering the browser-reachable direction (pasting a same-text key pair on a secure connection).
A key generated for one connection type (http/https) always fails to
decrypt on the other, surfacing only as a generic "invalid key" error
after a round trip to the backend. Detects the mismatch client-side
from the raw key text before the user submits, and disables the apply
button while it's showing.
Yury
marked the pull request as work in progress 2026-08-11 14:04:40 +00:00
Yury
marked the pull request as ready for review 2026-08-11 14:35:19 +00:00
allan
merged commit c0fec25c4d into version7-132026-08-11 17:33:04 +00:00
allan
deleted branch issue-1332026-08-11 17:33:04 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Issue
Closes #133
Summary
Detects when a pasted/uploaded licence key was generated for the wrong connection type (HTTP vs HTTPS) and warns the user before they submit it, instead of letting it fail with a generic "invalid key" error.
Intent
A licence key generated for one connection type always fails to decrypt when applied on the other - the failure currently surfaces only after a round trip to the backend, as a generic "Licence key is invalid" message with no indication of the actual cause. Catching this client-side, from the raw key text, gives the user an accurate reason immediately and prevents a guaranteed-to-fail submission.
Changes
detectLicenceKeyProtocolMismatchutility (licensing/utils/): compares the pasted licence key and activation key text against whether this browsing context can actually decrypt a secure-connection key, returning which protocol the key requires (if any). Checks actual decrypt capability rather thanlocation.protocoldirectly, since browsers treatlocalhostas a secure connection even over plain HTTP.LicensingComponent: exposes aprotocolMismatchgetter wired to both the "Upload licence" and "Paste licence" tabs (they share the same underlying fields), and disables the "Apply licence keys" button while a mismatch is showing.detectLicenceKeyProtocolMismatchcovering both mismatch directions, the no-mismatch cases, empty input, and whitespace trimming; a Cypress test covering the browser-reachable direction (pasting a same-text key pair on a secure connection).