activation.cpp

Go to the documentation of this file.

/*
 * BastionGuard™ Recovery Data
 * Copyright (C) 2025–2026 Calogero Scarnà. All rights reserved.
 *
 * Proprietary activation support for donation-based distribution.
 *
 * SECURITY NOTE FOR THE OWNER:
 * This is an offline activation system bound to /etc/machine-id and motherboard serial. Before a public release, change
 * kActivationSecret in both this file and tools/bastionguard_keygen.py,
 * keep the keygen private, and ship only the application binary to users.
 */
 
#include "activation.hpp"
 
#include <array>
#include <algorithm>
#include <cctype>
#include <chrono>
#include <cstdint>
#include <cstdlib>
#include <ctime>
#include <filesystem>
#include <fstream>
#include <iomanip>
#include <map>
#include <optional>
#include <sstream>
#include <string_view>
#include <vector>
#include <unistd.h>
 
namespace BastionGuard::Activation {
namespace {
 
// Change this secret before distributing production builds.
// The same value must be used by tools/bastionguard_keygen.py.
constexpr std::string_view kActivationSecret =
    "BastionGuard-Recovery-Data-2026-Calogero-Scarna-Donation-Activation-v1";
 
constexpr std::string_view kProductId = "BastionGuardRecoveryData";
// Fixed shared activation engine ID. Keep this exact value aligned with
// tools/bastionguard_keygen.py. It is intentionally human-readable so the
// app and keygen cannot diverge because of hash truncation or formatting.
constexpr std::string_view kActivationEngineId = "supportterdonation";
constexpr std::string_view kKeyPrefixV1 = "BGRD1";
constexpr std::string_view kKeyPrefixV2 = "BGRD2";
constexpr std::string_view kKeyPrefixV3 = "BGRD3";
constexpr std::string_view kKeyBeginMarker = "-----BEGIN BASTIONGUARD ACTIVATION KEY-----";
constexpr std::string_view kKeyEndMarker = "-----END BASTIONGUARD ACTIVATION KEY-----";
 
uint32_t rotr(uint32_t value, unsigned int count) {
    return (value >> count) | (value << (32U - count));
}
 
std::string sha256_hex(const std::string& input) {
    static constexpr std::array<uint32_t, 64> k = {
        0x428a2f98U, 0x71374491U, 0xb5c0fbcfU, 0xe9b5dba5U,
        0x3956c25bU, 0x59f111f1U, 0x923f82a4U, 0xab1c5ed5U,
        0xd807aa98U, 0x12835b01U, 0x243185beU, 0x550c7dc3U,
        0x72be5d74U, 0x80deb1feU, 0x9bdc06a7U, 0xc19bf174U,
        0xe49b69c1U, 0xefbe4786U, 0x0fc19dc6U, 0x240ca1ccU,
        0x2de92c6fU, 0x4a7484aaU, 0x5cb0a9dcU, 0x76f988daU,
        0x983e5152U, 0xa831c66dU, 0xb00327c8U, 0xbf597fc7U,
        0xc6e00bf3U, 0xd5a79147U, 0x06ca6351U, 0x14292967U,
        0x27b70a85U, 0x2e1b2138U, 0x4d2c6dfcU, 0x53380d13U,
        0x650a7354U, 0x766a0abbU, 0x81c2c92eU, 0x92722c85U,
        0xa2bfe8a1U, 0xa81a664bU, 0xc24b8b70U, 0xc76c51a3U,
        0xd192e819U, 0xd6990624U, 0xf40e3585U, 0x106aa070U,
        0x19a4c116U, 0x1e376c08U, 0x2748774cU, 0x34b0bcb5U,
        0x391c0cb3U, 0x4ed8aa4aU, 0x5b9cca4fU, 0x682e6ff3U,
        0x748f82eeU, 0x78a5636fU, 0x84c87814U, 0x8cc70208U,
        0x90befffaU, 0xa4506cebU, 0xbef9a3f7U, 0xc67178f2U
    };
 
    std::array<uint32_t, 8> h = {
        0x6a09e667U, 0xbb67ae85U, 0x3c6ef372U, 0xa54ff53aU,
        0x510e527fU, 0x9b05688cU, 0x1f83d9abU, 0x5be0cd19U
    };
 
    std::vector<uint8_t> msg(input.begin(), input.end());
    const uint64_t bit_len = static_cast<uint64_t>(msg.size()) * 8ULL;
 
    msg.push_back(0x80U);
    while ((msg.size() % 64U) != 56U) {
        msg.push_back(0x00U);
    }
 
    for (int i = 7; i >= 0; --i) {
        msg.push_back(static_cast<uint8_t>((bit_len >> (i * 8)) & 0xffU));
    }
 
    for (size_t offset = 0; offset < msg.size(); offset += 64) {
        std::array<uint32_t, 64> w{};
        for (size_t i = 0; i < 16; ++i) {
            const size_t j = offset + i * 4;
            w[i] = (static_cast<uint32_t>(msg[j]) << 24U) |
                   (static_cast<uint32_t>(msg[j + 1]) << 16U) |
                   (static_cast<uint32_t>(msg[j + 2]) << 8U) |
                   static_cast<uint32_t>(msg[j + 3]);
        }
 
        for (size_t i = 16; i < 64; ++i) {
            const uint32_t s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >> 3U);
            const uint32_t s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >> 10U);
            w[i] = w[i - 16] + s0 + w[i - 7] + s1;
        }
 
        uint32_t a = h[0];
        uint32_t b = h[1];
        uint32_t c = h[2];
        uint32_t d = h[3];
        uint32_t e = h[4];
        uint32_t f = h[5];
        uint32_t g = h[6];
        uint32_t hh = h[7];
 
        for (size_t i = 0; i < 64; ++i) {
            const uint32_t s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
            const uint32_t ch = (e & f) ^ ((~e) & g);
            const uint32_t temp1 = hh + s1 + ch + k[i] + w[i];
            const uint32_t s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
            const uint32_t maj = (a & b) ^ (a & c) ^ (b & c);
            const uint32_t temp2 = s0 + maj;
 
            hh = g;
            g = f;
            f = e;
            e = d + temp1;
            d = c;
            c = b;
            b = a;
            a = temp1 + temp2;
        }
 
        h[0] += a;
        h[1] += b;
        h[2] += c;
        h[3] += d;
        h[4] += e;
        h[5] += f;
        h[6] += g;
        h[7] += hh;
    }
 
    std::ostringstream out;
    out << std::hex << std::setfill('0');
    for (uint32_t part : h) {
        out << std::setw(8) << part;
    }
    return out.str();
}
 
std::string uppercase(std::string value) {
    std::transform(value.begin(), value.end(), value.begin(), [](unsigned char c) {
        return static_cast<char>(std::toupper(c));
    });
    return value;
}
 
std::string lowercase(std::string value) {
    std::transform(value.begin(), value.end(), value.begin(), [](unsigned char c) {
        return static_cast<char>(std::tolower(c));
    });
    return value;
}
 
std::string trim(const std::string& value) {
    const auto begin = std::find_if_not(value.begin(), value.end(), [](unsigned char c) {
        return std::isspace(c) != 0;
    });
    if (begin == value.end()) return {};
 
    const auto end = std::find_if_not(value.rbegin(), value.rend(), [](unsigned char c) {
        return std::isspace(c) != 0;
    }).base();
 
    return std::string(begin, end);
}
 
std::string normalize_engine_id(const std::string& value) {
    return lowercase(trim(value));
}
 
std::string compact_key(const std::string& raw) {
    std::string out;
    out.reserve(raw.size());
    for (unsigned char c : raw) {
        if (!std::isspace(c)) out.push_back(static_cast<char>(c));
    }
    return out;
}
 
std::string extract_activation_key(const std::string& raw) {
    const std::string text = trim(raw);
    if (text.empty()) return {};
 
    const std::string begin_marker(kKeyBeginMarker);
    const std::string end_marker(kKeyEndMarker);
    const auto begin = text.find(begin_marker);
    if (begin != std::string::npos) {
        const auto end = text.find(end_marker, begin + begin_marker.size());
        if (end != std::string::npos) {
            return trim(text.substr(begin, end + end_marker.size() - begin));
        }
        return trim(text.substr(begin));
    }
 
    // BGRD2/BGRD3 can also be pasted without BEGIN/END markers. Keep the
    // multiline field block intact because validation is calculated from
    // field values, not from a compact one-line token.
    if (((text.find(std::string(kKeyPrefixV2)) != std::string::npos &&
          text.find("SIGNATURE=") != std::string::npos) ||
         (text.find(std::string(kKeyPrefixV3)) != std::string::npos &&
          text.find("CODE=") != std::string::npos))) {
        return text;
    }
 
    // Legacy BGRD1 support. Paste operations from GUI toolkits can include
    // invisible Unicode bytes or labels around the key. Keep only characters
    // valid in the BGRD1 token and extract exactly one
    // BGRD1.<payload>.<40-hex-signature> token.
    std::string filtered;
    filtered.reserve(raw.size());
    for (unsigned char c : raw) {
        if (std::isalnum(c) != 0 || c == '.' || c == '-' || c == '_') {
            filtered.push_back(static_cast<char>(c));
        }
    }
 
    const std::string prefix = std::string(kKeyPrefixV1) + ".";
    const auto start = filtered.find(prefix);
    if (start == std::string::npos) {
        return compact_key(raw);
    }
 
    const auto payload_dot = filtered.find('.', start + prefix.size());
    if (payload_dot == std::string::npos) {
        return filtered.substr(start);
    }
 
    const size_t sig_start = payload_dot + 1;
    size_t sig_end = sig_start;
    while (sig_end < filtered.size() && sig_end - sig_start < 40 &&
           std::isxdigit(static_cast<unsigned char>(filtered[sig_end])) != 0) {
        ++sig_end;
    }
 
    if (sig_end - sig_start == 40) {
        return filtered.substr(start, sig_end - start);
    }
 
    return filtered.substr(start);
}
 
std::string compact_hex_machine_id(const std::string& raw) {
    std::string out;
    out.reserve(raw.size());
    for (unsigned char c : raw) {
        if (std::isxdigit(c)) {
            out.push_back(static_cast<char>(std::toupper(c)));
        }
    }
    return out;
}
 
std::string collapse_spaces(const std::string& value) {
    std::string out;
    out.reserve(value.size());
    bool last_space = false;
 
    for (unsigned char c : value) {
        if (c == '\0') continue;
        if (std::isspace(c) != 0) {
            if (!last_space && !out.empty()) {
                out.push_back(' ');
            }
            last_space = true;
        } else {
            out.push_back(static_cast<char>(c));
            last_space = false;
        }
    }
 
    while (!out.empty() && out.back() == ' ') {
        out.pop_back();
    }
    return out;
}
 
std::string canonical_serial(std::string value) {
    value = trim(value);
    value = collapse_spaces(value);
    return uppercase(value);
}
 
bool all_zero_like(const std::string& value) {
    bool has_alnum = false;
    for (unsigned char c : value) {
        if (std::isalnum(c) == 0) continue;
        has_alnum = true;
        if (c != '0') return false;
    }
    return has_alnum;
}
 
bool is_placeholder_serial(const std::string& value) {
    const std::string serial = canonical_serial(value);
    if (serial.empty()) return true;
    if (all_zero_like(serial)) return true;
 
    static constexpr std::string_view placeholders[] = {
        "0",
        "00",
        "00000000",
        "0000000000000000",
        "00000000000000000000000000000000",
        "NONE",
        "UNKNOWN",
        "UNKNOWN SERIAL",
        "UNKNOWN SERIAL NUMBER",
        "NOT SPECIFIED",
        "NOT APPLICABLE",
        "N/A",
        "NA",
        "DEFAULT STRING",
        "SYSTEM SERIAL NUMBER",
        "BASE BOARD SERIAL NUMBER",
        "TO BE FILLED BY O.E.M.",
        "TO BE FILLED BY OEM"
    };
 
    for (std::string_view placeholder : placeholders) {
        if (serial == placeholder) return true;
    }
    return false;
}
 
std::string read_first_valid_serial(const std::vector<std::string>& paths) {
    for (const auto& path : paths) {
        std::ifstream input(path);
        if (!input.is_open()) continue;
        std::string line;
        std::getline(input, line);
        line = canonical_serial(line);
        if (!is_placeholder_serial(line)) return line;
    }
    return {};
}
 
std::string read_first_existing_file(const std::vector<std::string>& paths);
 
std::string legacy_application_machine_id() {
    std::string seed = read_first_existing_file({
        "/etc/machine-id",
        "/var/lib/dbus/machine-id"
    });
 
    if (seed.empty()) {
        char hostname[256] = {};
        if (gethostname(hostname, sizeof(hostname) - 1) == 0) {
            seed = hostname;
        }
    }
 
    if (seed.empty()) {
        seed = "unknown-machine";
    }
 
    seed += "|";
    seed += kProductId;
 
    return uppercase(sha256_hex(seed)).substr(0, 16);
}
 
int b64url_value(char c) {
    if (c >= 'A' && c <= 'Z') return c - 'A';
    if (c >= 'a' && c <= 'z') return c - 'a' + 26;
    if (c >= '0' && c <= '9') return c - '0' + 52;
    if (c == '-' || c == '+') return 62;
    if (c == '_' || c == '/') return 63;
    return -1;
}
 
std::optional<std::string> base64url_decode(const std::string& input) {
    std::string output;
    int val = 0;
    int valb = -8;
 
    for (char c : input) {
        if (c == '=') break;
        const int decoded = b64url_value(c);
        if (decoded < 0) return std::nullopt;
        val = (val << 6) + decoded;
        valb += 6;
        if (valb >= 0) {
            output.push_back(static_cast<char>((val >> valb) & 0xff));
            valb -= 8;
        }
    }
 
    return output;
}
 
std::string percent_decode(const std::string& value) {
    std::string out;
    out.reserve(value.size());
 
    for (size_t i = 0; i < value.size(); ++i) {
        if (value[i] == '%' && i + 2 < value.size()) {
            const char h1 = value[i + 1];
            const char h2 = value[i + 2];
            if (std::isxdigit(static_cast<unsigned char>(h1)) &&
                std::isxdigit(static_cast<unsigned char>(h2))) {
                const std::string hex{h1, h2};
                const char ch = static_cast<char>(std::strtol(hex.c_str(), nullptr, 16));
                out.push_back(ch);
                i += 2;
                continue;
            }
        }
        if (value[i] == '+') out.push_back(' ');
        else out.push_back(value[i]);
    }
 
    return out;
}
 
std::map<std::string, std::string> parse_payload(const std::string& payload) {
    std::map<std::string, std::string> fields;
    std::stringstream ss(payload);
    std::string item;
 
    while (std::getline(ss, item, ';')) {
        const auto eq = item.find('=');
        if (eq == std::string::npos) continue;
        const std::string key = item.substr(0, eq);
        const std::string value = item.substr(eq + 1);
        fields[key] = percent_decode(value);
    }
 
    return fields;
}
 
std::string read_first_existing_file(const std::vector<std::string>& paths) {
    for (const auto& path : paths) {
        std::ifstream input(path);
        if (!input.is_open()) continue;
        std::string line;
        std::getline(input, line);
        line = trim(line);
        if (!line.empty()) return line;
    }
    return {};
}
 
std::string today_ymd() {
    const std::time_t now = std::time(nullptr);
    std::tm tm{};
#if defined(_POSIX_VERSION)
    localtime_r(&now, &tm);
#else
    tm = *std::localtime(&now);
#endif
    char buffer[16] = {};
    std::strftime(buffer, sizeof(buffer), "%Y-%m-%d", &tm);
    return buffer;
}
 
bool is_valid_expiry(const std::string& expires) {
    if (expires == "never") return true;
    if (expires.size() != 10) return false;
    return std::isdigit(static_cast<unsigned char>(expires[0])) &&
           std::isdigit(static_cast<unsigned char>(expires[1])) &&
           std::isdigit(static_cast<unsigned char>(expires[2])) &&
           std::isdigit(static_cast<unsigned char>(expires[3])) &&
           expires[4] == '-' &&
           std::isdigit(static_cast<unsigned char>(expires[5])) &&
           std::isdigit(static_cast<unsigned char>(expires[6])) &&
           expires[7] == '-' &&
           std::isdigit(static_cast<unsigned char>(expires[8])) &&
           std::isdigit(static_cast<unsigned char>(expires[9]));
}
 
bool has_expired(const std::string& expires) {
    if (expires == "never") return false;
    if (!is_valid_expiry(expires)) return true;
    return expires < today_ymd();
}
 
bool is_running_as_root() {
    return ::geteuid() == 0;
}
 
std::string user_config_dir() {
    if (const char* xdg = std::getenv("XDG_CONFIG_HOME"); xdg && *xdg) {
        return (std::filesystem::path(xdg) / "bastionguard-recovery-data").string();
    }
    if (const char* home = std::getenv("HOME"); home && *home) {
        return (std::filesystem::path(home) / ".config" / "bastionguard-recovery-data").string();
    }
    return ".";
}
 
std::string system_config_dir() {
    return "/etc/bastionguard-recovery-data";
}
 
std::string user_activation_key_path() {
    return (std::filesystem::path(user_config_dir()) / "activation.key").string();
}
 
std::string system_activation_key_path() {
    return (std::filesystem::path(system_config_dir()) / "activation.key").string();
}
 
std::string preferred_activation_key_path_for_save() {
    // When the GUI is launched through pkexec/root, save a system-wide key so
    // the activation is not tied to /root/.config and survives future root runs.
    if (is_running_as_root()) {
        return system_activation_key_path();
    }
    return user_activation_key_path();
}
 
std::string read_file_all(const std::string& path) {
    std::ifstream input(path, std::ios::binary);
    if (!input.is_open()) return {};
    std::ostringstream content;
    content << input.rdbuf();
    return content.str();
}
 
std::string sign_payload_v1(const std::string& payload) {
    const std::string input = std::string(kKeyPrefixV1) + "|" + payload + "|" + std::string(kActivationSecret);
    return uppercase(sha256_hex(input)).substr(0, 40);
}
 
std::string sign_payload_v2(const std::string& canonical_payload) {
    const std::string input = std::string(kKeyPrefixV2) + "\n" + canonical_payload + "\n" + std::string(kActivationSecret);
    return uppercase(sha256_hex(input)).substr(0, 40);
}
 
uint64_t fnv1a64(const std::string& input) {
    uint64_t hash = 14695981039346656037ULL;
    for (unsigned char c : input) {
        hash ^= static_cast<uint64_t>(c);
        hash *= 1099511628211ULL;
    }
    return hash;
}
 
std::string normalize_activation_code(std::string value) {
    value = uppercase(value);
    std::string out;
    out.reserve(value.size());
    for (unsigned char c : value) {
        if (std::isalnum(c) != 0) {
            out.push_back(static_cast<char>(c));
        }
    }
    return out;
}
 
std::string group_activation_code(const std::string& compact) {
    std::string out;
    for (size_t i = 0; i < compact.size(); ++i) {
        if (i > 0 && i % 5 == 0) out.push_back('-');
        out.push_back(compact[i]);
    }
    return out;
}
 
std::string field_or_empty(const std::map<std::string, std::string>& fields, const std::string& name) {
    const auto it = fields.find(name);
    return it == fields.end() ? std::string{} : it->second;
}
 
std::string code_payload_v3(const std::map<std::string, std::string>& fields) {
    const std::string product = trim(field_or_empty(fields, "PRODUCT"));
    const std::string engine = normalize_engine_id(field_or_empty(fields, "ENGINE"));
    const std::string machine = compact_hex_machine_id(field_or_empty(fields, "MACHINE"));
    const std::string motherboard = canonical_serial(field_or_empty(fields, "MOTHERBOARD"));
    const std::string key_id = trim(field_or_empty(fields, "KEYID"));
    std::string edition = trim(field_or_empty(fields, "EDITION"));
    std::string expires = lowercase(trim(field_or_empty(fields, "EXPIRES")));
 
    if (edition.empty()) edition = "Donation";
    if (expires.empty()) expires = "never";
 
    std::ostringstream out;
    out << "product=" << product << "\n"
        << "engine=" << engine << "\n"
        << "machine=" << machine << "\n"
        << "motherboard=" << motherboard << "\n"
        << "edition=" << edition << "\n"
        << "expires=" << expires;
 
    // BGRD3.1: optional random KEYID. When present, it is part of the
    // activation code calculation so the same hardware can receive different
    // valid keys without making the readable BGRD3 block fragile.
    if (!key_id.empty()) {
        out << "\nkeyid=" << key_id;
    }
 
    return out.str();
}
 
std::string generate_activation_code_v3(const std::string& canonical_payload) {
    static constexpr std::string_view alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
    const std::string material = std::string(kKeyPrefixV3) + "\n" + canonical_payload + "\n" + std::string(kActivationSecret);
 
    std::string compact;
    compact.reserve(25);
    for (int block = 0; block < 5; ++block) {
        uint64_t h = fnv1a64(material + "\nblock=" + std::to_string(block));
        for (int i = 0; i < 5; ++i) {
            const uint64_t mixed = h ^ (h >> 29U) ^ (h >> 47U);
            compact.push_back(alphabet[static_cast<size_t>(mixed & 31ULL)]);
            h = (h >> 5U) ^ (h << 17U) ^ (0x9E3779B97F4A7C15ULL + static_cast<uint64_t>(block * 131 + i));
        }
    }
 
    return group_activation_code(compact);
}
 
std::map<std::string, std::string> parse_key_block(const std::string& key) {
    std::map<std::string, std::string> fields;
    std::stringstream ss(key);
    std::string line;
 
    while (std::getline(ss, line)) {
        line = trim(line);
        if (line.empty()) continue;
        if (line == kKeyBeginMarker || line == kKeyEndMarker) continue;
        if (line == kKeyPrefixV2 || line == kKeyPrefixV3) {
            fields["FORMAT"] = line;
            continue;
        }
 
        const auto eq = line.find('=');
        if (eq == std::string::npos) continue;
        std::string name = uppercase(trim(line.substr(0, eq)));
        std::string value = trim(line.substr(eq + 1));
        fields[name] = value;
    }
 
    return fields;
}
 
std::string canonical_v2_payload(const std::map<std::string, std::string>& fields) {
    const std::string product = trim(field_or_empty(fields, "PRODUCT"));
    const std::string engine = normalize_engine_id(field_or_empty(fields, "ENGINE"));
    const std::string machine = compact_hex_machine_id(field_or_empty(fields, "MACHINE"));
    const std::string motherboard = canonical_serial(field_or_empty(fields, "MOTHERBOARD"));
    const std::string owner = trim(field_or_empty(fields, "OWNER"));
    std::string edition = trim(field_or_empty(fields, "EDITION"));
    std::string expires = lowercase(trim(field_or_empty(fields, "EXPIRES")));
 
    if (edition.empty()) edition = "Donation";
    if (expires.empty()) expires = "never";
 
    std::ostringstream out;
    out << "product=" << product << "\n"
        << "engine=" << engine << "\n"
        << "machine=" << machine << "\n"
        << "motherboard=" << motherboard << "\n"
        << "owner=" << owner << "\n"
        << "edition=" << edition << "\n"
        << "expires=" << expires;
    return out.str();
}
 
} // namespace
 
std::string activation_engine_id() {
    return std::string(kActivationEngineId);
}
 
std::string machine_id() {
    const std::string raw_machine_id = read_first_existing_file({
        "/etc/machine-id",
        "/var/lib/dbus/machine-id"
    });
 
    const std::string cleaned = compact_hex_machine_id(raw_machine_id);
    if (cleaned.size() == 32) {
        // Use the real Linux machine-id exactly as requested: this is the
        // identifier shown in About → Activation and stored inside keys.
        return cleaned;
    }
 
    // Fallback only for unusual systems where /etc/machine-id is unavailable
    // or malformed. This keeps activation usable without changing the public UI.
    return legacy_application_machine_id();
}
 
std::string motherboard_serial() {
    const std::string serial = read_first_valid_serial({
        "/sys/class/dmi/id/board_serial",
        "/sys/devices/virtual/dmi/id/board_serial",
        "/sys/class/dmi/id/product_serial",
        "/sys/devices/virtual/dmi/id/product_serial",
        "/sys/class/dmi/id/product_uuid",
        "/sys/devices/virtual/dmi/id/product_uuid"
    });
 
    return serial;
}
 
std::string activation_key_path() {
    const std::string system_path = system_activation_key_path();
    std::error_code ec;
    if (std::filesystem::exists(system_path, ec) && !ec) {
        return system_path;
    }
 
    if (is_running_as_root()) {
        return system_path;
    }
 
    return user_activation_key_path();
}
 
ActivationStatus validate_key(const std::string& raw_key) {
    ActivationStatus status;
    status.machine_id = machine_id();
    status.motherboard_serial = motherboard_serial();
 
    const std::string key = extract_activation_key(raw_key);
    if (key.empty()) {
        status.message = "No activation key installed.";
        return status;
    }
 
    const auto apply_common_field_checks = [&](const std::string& product,
                                               const std::string& key_machine_raw,
                                               const std::string& key_motherboard_raw,
                                               const std::string& owner,
                                               const std::string& edition,
                                               const std::string& expires) -> bool {
        if (product != kProductId) {
            status.message = "Activation key is for a different product.";
            return false;
        }
 
        if (key_machine_raw.empty()) {
            status.message = "Activation key does not contain a Machine ID.";
            return false;
        }
 
        if (key_motherboard_raw.empty()) {
            status.message = "Activation key does not contain a motherboard serial.";
            return false;
        }
 
        if (status.motherboard_serial.empty()) {
            status.message = "Motherboard serial could not be read on this computer.";
            return false;
        }
 
        const std::string key_machine = compact_hex_machine_id(key_machine_raw);
        const std::string current_machine = compact_hex_machine_id(status.machine_id);
        const std::string legacy_machine = compact_hex_machine_id(legacy_application_machine_id());
 
        if (key_machine != current_machine && key_machine != legacy_machine) {
            status.message = "Activation key is for a different machine-id.";
            return false;
        }
 
        const std::string key_motherboard = canonical_serial(key_motherboard_raw);
        const std::string current_motherboard = canonical_serial(status.motherboard_serial);
 
        if (key_motherboard != current_motherboard) {
            status.message = "Activation key is for a different motherboard serial.";
            return false;
        }
 
        status.owner = owner.empty() ? "Donation supporter" : owner;
        status.edition = edition.empty() ? "Donation" : edition;
        status.expires = expires.empty() ? "never" : lowercase(expires);
 
        if (!is_valid_expiry(status.expires)) {
            status.expired = true;
            status.message = "Activation key contains an invalid expiry date.";
            return false;
        }
 
        if (has_expired(status.expires)) {
            status.expired = true;
            status.message = "Activation key has expired.";
            return false;
        }
 
        status.active = true;
        status.message = "Activation is valid.";
        return true;
    };
 
    // Preferred clean key format: BGRD3. This avoids SHA-based signing and uses
    // a simple owner-only donation code calculated from product, engine,
    // /etc/machine-id, motherboard serial, edition, expiry, and the private
    // owner secret. The visible owner name is informational and does not affect
    // the code, which avoids UTF-8/locale copy-paste mismatches.
    if (key.find(std::string(kKeyPrefixV3)) != std::string::npos) {
        const auto fields = parse_key_block(key);
        const std::string code = normalize_activation_code(field_or_empty(fields, "CODE"));
        const std::string product = trim(field_or_empty(fields, "PRODUCT"));
        const std::string engine = normalize_engine_id(field_or_empty(fields, "ENGINE"));
        const std::string machine = compact_hex_machine_id(field_or_empty(fields, "MACHINE"));
        const std::string motherboard = canonical_serial(field_or_empty(fields, "MOTHERBOARD"));
        const std::string owner = trim(field_or_empty(fields, "OWNER"));
        const std::string edition = trim(field_or_empty(fields, "EDITION"));
        const std::string expires = lowercase(trim(field_or_empty(fields, "EXPIRES")));
 
        if (field_or_empty(fields, "FORMAT") != std::string(kKeyPrefixV3)) {
            status.message = "Invalid BGRD3 activation key: BGRD3 format line is missing.";
            return status;
        }
 
        if (code.size() != 25) {
            status.message = "Invalid BGRD3 activation key: CODE must contain 25 letters/numbers.";
            return status;
        }
 
        if (engine.empty()) {
            status.message = "Invalid BGRD3 activation key: ENGINE field is missing.";
            return status;
        }
 
        const std::string current_engine = normalize_engine_id(activation_engine_id());
        if (normalize_engine_id(engine) != current_engine) {
            status.message = "Activation engine mismatch. App engine is " + current_engine +
                " but key engine is " + engine +
                ". Rebuild and reinstall the app and generate the keygen from the same package.";
            return status;
        }
 
        const std::string canonical_payload = code_payload_v3(fields);
        const std::string expected_code = normalize_activation_code(generate_activation_code_v3(canonical_payload));
        if (code != expected_code) {
            status.message = "BGRD3 activation code is not valid. The key was not saved. Generate the key again with the matching keygen and copy the whole BEGIN/END block.";
            return status;
        }
 
        apply_common_field_checks(product, machine, motherboard, owner, edition, expires);
        return status;
    }
 
    // Legacy clean key format: multiline BGRD2 block. The key explicitly
    // carries the activation engine so mismatched app/keygen builds are
    // diagnosed before signature validation.
    if (key.find(std::string(kKeyPrefixV2)) != std::string::npos) {
        const auto fields = parse_key_block(key);
        const std::string signature = uppercase(trim(field_or_empty(fields, "SIGNATURE")));
        const std::string product = trim(field_or_empty(fields, "PRODUCT"));
        const std::string engine = normalize_engine_id(field_or_empty(fields, "ENGINE"));
        const std::string machine = compact_hex_machine_id(field_or_empty(fields, "MACHINE"));
        const std::string motherboard = canonical_serial(field_or_empty(fields, "MOTHERBOARD"));
        const std::string owner = trim(field_or_empty(fields, "OWNER"));
        const std::string edition = trim(field_or_empty(fields, "EDITION"));
        const std::string expires = lowercase(trim(field_or_empty(fields, "EXPIRES")));
 
        if (signature.size() != 40) {
            status.message = "Invalid BGRD2 activation key: SIGNATURE must contain 40 hexadecimal characters.";
            return status;
        }
        for (unsigned char c : signature) {
            if (std::isxdigit(c) == 0) {
                status.message = "Invalid BGRD2 activation key: SIGNATURE contains a non-hexadecimal character.";
                return status;
            }
        }
 
        if (engine.empty()) {
            status.message = "Invalid BGRD2 activation key: ENGINE field is missing.";
            return status;
        }
 
        const std::string current_engine = normalize_engine_id(activation_engine_id());
        if (normalize_engine_id(engine) != current_engine) {
            status.message = "Activation engine mismatch. App engine is " + current_engine +
                " but key engine is " + engine +
                ". Rebuild and reinstall the app and generate the keygen from the same package.";
            return status;
        }
 
        const std::string canonical_payload = canonical_v2_payload(fields);
        const std::string expected_signature = sign_payload_v2(canonical_payload);
        if (signature != expected_signature) {
            status.message = "BGRD2 activation key signature is not valid. The key was not saved. Generate the key again with the matching keygen and copy the whole BEGIN/END block.";
            return status;
        }
 
        apply_common_field_checks(product, machine, motherboard, owner, edition, expires);
        return status;
    }
 
    // Legacy BGRD1 one-line key support.
    const std::string prefix = std::string(kKeyPrefixV1) + ".";
    if (key.rfind(prefix, 0) != 0) {
        status.message = "Invalid activation key prefix. Paste a BGRD3 activation block generated by the matching keygen.";
        return status;
    }
 
    const auto first_dot = key.find('.', prefix.size());
    if (first_dot == std::string::npos) {
        status.message = "Malformed legacy activation key.";
        return status;
    }
 
    const std::string payload_b64 = key.substr(prefix.size(), first_dot - prefix.size());
    const std::string signature = uppercase(key.substr(first_dot + 1));
 
    if (signature.size() != 40) {
        status.message = "Invalid legacy activation key signature length.";
        return status;
    }
 
    const auto decoded_payload = base64url_decode(payload_b64);
    if (!decoded_payload.has_value()) {
        status.message = "Legacy activation key payload is not valid base64url.";
        return status;
    }
 
    const std::string expected_signature = sign_payload_v1(*decoded_payload);
    if (signature != expected_signature) {
        status.message = "Legacy activation key signature is not valid. Generate a new BGRD3 key with the matching keygen.";
        return status;
    }
 
    const auto fields = parse_payload(*decoded_payload);
    const auto product_it = fields.find("product");
    const auto machine_it = fields.find("machine");
    const auto motherboard_it = fields.find("motherboard");
    const auto owner_it = fields.find("owner");
    const auto edition_it = fields.find("edition");
    const auto expires_it = fields.find("expires");
 
    apply_common_field_checks(
        product_it != fields.end() ? product_it->second : std::string{},
        machine_it != fields.end() ? machine_it->second : std::string{},
        motherboard_it != fields.end() ? motherboard_it->second : std::string{},
        owner_it != fields.end() ? owner_it->second : std::string{},
        edition_it != fields.end() ? edition_it->second : std::string{},
        expires_it != fields.end() ? expires_it->second : std::string{}
    );
    return status;
}
 
ActivationStatus validate_installed_key() {
    const std::string system_path = system_activation_key_path();
    const std::string user_path = user_activation_key_path();
 
    std::error_code ec;
    if (std::filesystem::exists(system_path, ec) && !ec) {
        ActivationStatus system_status = validate_key(read_file_all(system_path));
        if (system_status.active) {
            return system_status;
        }
 
        if (std::filesystem::exists(user_path, ec) && !ec) {
            ActivationStatus user_status = validate_key(read_file_all(user_path));
            if (user_status.active) {
                return user_status;
            }
        }
 
        return system_status;
    }
 
    return validate_key(read_file_all(user_path));
}
 
bool save_key_if_valid(const std::string& raw_key, std::string& error_message) {
    const ActivationStatus status = validate_key(raw_key);
    if (!status.active) {
        error_message = status.message;
        return false;
    }
 
    const std::string target_path = preferred_activation_key_path_for_save();
    const std::string dir = std::filesystem::path(target_path).parent_path().string();
 
    std::error_code ec;
    std::filesystem::create_directories(dir, ec);
    if (ec) {
        error_message = "Cannot create activation directory '" + dir + "': " + ec.message();
        return false;
    }
 
    std::ofstream output(target_path, std::ios::binary | std::ios::trunc);
    if (!output.is_open()) {
        error_message = "Cannot write activation key file: " + target_path;
        if (!is_running_as_root() && target_path.rfind("/etc/", 0) == 0) {
            error_message += " Run the application as root/pkexec.";
        }
        return false;
    }
 
    output << extract_activation_key(raw_key) << "\n";
    output.close();
 
    if (!output) {
        error_message = "Activation key file was opened but could not be written completely: " + target_path;
        return false;
    }
 
    std::error_code verify_ec;
    if (!std::filesystem::exists(target_path, verify_ec) || verify_ec) {
        error_message = "Activation key was not created at: " + target_path;
        if (verify_ec) error_message += " (" + verify_ec.message() + ")";
        return false;
    }
 
    const ActivationStatus saved_status = validate_key(read_file_all(target_path));
    if (!saved_status.active) {
        error_message = "Activation key was written but could not be read back as valid: " + saved_status.message;
        return false;
    }
 
    error_message.clear();
    return true;
}
 
} // namespace BastionGuard::Activation