oubliette-commerce 0.2.0

Shared revenue SDK for the Oubliette product suite — config-driven licensing, metering, key issuance, and sale webhooks

Oubliette Commerce

Shared revenue SDK for the Oubliette product suite — config-driven licensing, usage metering, signed key issuance, and merchant-of-record (Gumroad/Paddle) sale webhooks.

This is internal infrastructure: the single source of truth so Shield, Dungeon, Trap, and Warden don't each carry a copy of the commercial layer. The engine is product-neutral — each product supplies its own pro_features and pricing/quota tables.

Usage

from oubliette_commerce import LicenseManager, issue_license, license_for_sale

PRO_FEATURES = frozenset({"scheduler", "reports", "api"})

# Validate a customer's license, gating this product's Pro features
mgr = LicenseManager(signing_key=SIGNING_KEY, pro_features=PRO_FEATURES)
if mgr.check_feature("scheduler"):
    ...

# Server-side: mint a signed key (e.g. from a Gumroad sale webhook)
key = issue_license(org="Acme", tier="pro", features=["scheduler", "reports"],
                    signing_key=SIGNING_KEY)

# Gumroad/Paddle webhook -> license
result = license_for_sale(payload, {"acme-pro": {"tier": "pro", "features": [...]}},
                          SIGNING_KEY, seller_id=SELLER_ID)

What's inside

• LicenseManager / FeatureGate — config-driven feature gating (HMAC-signed keys).
• issue_license — server-side signed key minting.
• license_for_sale / create_license_webhook_blueprint — Gumroad/Paddle sale → key.
• UsageTracker — usage metering with optional SQLite persistence + per-product quota/pricing.
• auth_middleware, rbac, tenant — API-key auth, RBAC, multi-tenancy.

The signing key (OUBLIETTE_LICENSE_SIGNING_KEY) stays server-side; gating is soft-enforce.

License

Apache-2.0.