# LicenseHub Phase 2 Implementation Report

Implemented in-place on the Phase 1 foundation.

## Added
AuditService, SecurityService, RateLimitService, PointService, PermissionService, normalized RBAC migration, nonce replay table, API HMAC signing, encrypted HMAC secret material using libsodium, product isolation, heartbeat, entitlements, deactivate API, admin Product/Plan/Customer/License/Device/API Credential/Security foundations, migration runner, production CSS, expanded cron, static security test.

## Security design
Sensitive API requests use Client ID + Timestamp + Nonce + HMAC-SHA256 signature. Canonical string:
METHOD + newline + PATH + newline + TIMESTAMP + newline + NONCE + newline + SHA256(JSON body).
The server stores an encrypted signing secret using libsodium and APP_KEY-derived key. Nonces are persisted and unique for replay prevention.

## Product isolation
DeviceService centrally asserts authenticated credential product_id equals license.product_id for activation, validation, heartbeat, deactivation and entitlements.

## Concurrency
License row is selected FOR UPDATE before device count and insertion. Requests for the same license serialize, preventing two requests from consuming the final device slot.

## Deferred to Phase 3
Real CHIP checkout, verified CHIP webhook provisioning, payment reconciliation, automatic paid-license provisioning, customer checkout/payment portal, recurring CHIP subscriptions, invoices/receipts.

## Test status
`tests/phase2_static.php` verifies critical code/security wiring without a database.
Full DB-backed functional/concurrency tests require a configured MySQL test database and real parallel processes. They are not falsely reported as passed here.