Validate license before starting container

cmd/login.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"fmt"
 
+	"github.com/localstack/lstk/internal/api"
 	"github.com/localstack/lstk/internal/auth"
 	"github.com/spf13/cobra"
 )
@@ -12,7 +13,8 @@ var loginCmd = &cobra.Command{
 	Short: "Authenticate with LocalStack",
 	Long:  "Authenticate with LocalStack and store credentials in system keyring",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		a, err := auth.New()
+		platformClient := api.NewPlatformClient()
+		a, err := auth.New(platformClient)
 		if err != nil {
 			return fmt.Errorf("failed to initialize auth: %w", err)
 		}

cmd/logout.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"fmt"
 
+	"github.com/localstack/lstk/internal/api"
 	"github.com/localstack/lstk/internal/auth"
 	"github.com/spf13/cobra"
 )
@@ -11,7 +12,8 @@ var logoutCmd = &cobra.Command{
 	Use:   "logout",
 	Short: "Remove stored authentication token",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		a, err := auth.New()
+		platformClient := api.NewPlatformClient()
+		a, err := auth.New(platformClient)
 		if err != nil {
 			return fmt.Errorf("failed to initialize auth: %w", err)
 		}

cmd/root.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/localstack/lstk/internal/api"
 	"github.com/localstack/lstk/internal/config"
 	"github.com/localstack/lstk/internal/container"
 	"github.com/localstack/lstk/internal/runtime"
@@ -25,11 +26,13 @@ var rootCmd = &cobra.Command{
 			os.Exit(1)
 		}
 
+		platformClient := api.NewPlatformClient()
+
 		onProgress := func(msg string) {
 			fmt.Println(msg)
 		}
 
-		if err := container.Start(cmd.Context(), rt, onProgress); err != nil {
+		if err := container.Start(cmd.Context(), rt, platformClient, onProgress); err != nil {
 			fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 			os.Exit(1)
 		}

cmd/start.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/localstack/lstk/internal/api"
 	"github.com/localstack/lstk/internal/container"
 	"github.com/localstack/lstk/internal/runtime"
 	"github.com/spf13/cobra"
@@ -20,11 +21,13 @@ var startCmd = &cobra.Command{
 			os.Exit(1)
 		}
 
+		platformClient := api.NewPlatformClient()
+
 		onProgress := func(msg string) {
 			fmt.Println(msg)
 		}
 
-		if err := container.Start(cmd.Context(), rt, onProgress); err != nil {
+		if err := container.Start(cmd.Context(), rt, platformClient, onProgress); err != nil {
 			fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 			os.Exit(1)
 		}

env.example

@@ -2,3 +2,6 @@ export LOCALSTACK_AUTH_TOKEN=ls-...
 
 # Force file-based keyring backend (instead of system keychain)
 # export KEYRING=file
+#
+export LOCALSTACK_API_ENDPOINT=https://api.staging.aws.localstack.cloud
+export LOCALSTACK_WEB_APP_URL=https://app.staging.aws.localstack.cloud

internal/api/client.go

@@ -16,6 +16,7 @@ type PlatformAPI interface {
 	CheckAuthRequestConfirmed(ctx context.Context, id, exchangeToken string) (bool, error)
 	ExchangeAuthRequest(ctx context.Context, id, exchangeToken string) (string, error)
 	GetLicenseToken(ctx context.Context, bearerToken string) (string, error)
+	GetLicense(ctx context.Context, req *LicenseRequest) error
 }
 
 type AuthRequest struct {
@@ -37,6 +38,27 @@ type licenseTokenResponse struct {
 	Token string `json:"token"`
 }
 
+type LicenseRequest struct {
+	Product     ProductInfo     `json:"product"`
+	Credentials CredentialsInfo `json:"credentials"`
+	Machine     MachineInfo     `json:"machine"`
+}
+
+type ProductInfo struct {
+	Name    string `json:"name"`
+	Version string `json:"version"`
+}
+
+type CredentialsInfo struct {
+	Token string `json:"token"`
+}
+
+type MachineInfo struct {
+	Hostname        string `json:"hostname,omitempty"`
+	Platform        string `json:"platform,omitempty"`
+	PlatformRelease string `json:"platform_release,omitempty"`
+}
+
 type PlatformClient struct {
 	baseURL    string
 	httpClient *http.Client
@@ -173,3 +195,37 @@ func (c *PlatformClient) GetLicenseToken(ctx context.Context, bearerToken string
 
 	return tokenResp.Token, nil
 }
+
+func (c *PlatformClient) GetLicense(ctx context.Context, licReq *LicenseRequest) error {
+	body, err := json.Marshal(licReq)
+	if err != nil {
+		return fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/v1/license/request", bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to request license: %w", err)
+	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Printf("failed to close response body: %v", err)
+		}
+	}()
+
+	switch resp.StatusCode {
+	case http.StatusOK:
+		return nil
+	case http.StatusBadRequest:
+		return fmt.Errorf("license validation failed: invalid token format, missing license assignment, or missing subscription")
+	case http.StatusForbidden:
+		return fmt.Errorf("license validation failed: invalid, inactive, or expired authentication token or subscription")
+	default:
+		return fmt.Errorf("license request failed with status %d", resp.StatusCode)
+	}
+}

internal/auth/auth.go

@@ -7,21 +7,22 @@ import (
 	"os"
 
 	"github.com/99designs/keyring"
+	"github.com/localstack/lstk/internal/api"
 )
 
 type Auth struct {
 	keyring      Keyring
 	browserLogin LoginProvider
 }
 
-func New() (*Auth, error) {
+func New(platformClient api.PlatformAPI) (*Auth, error) {
 	kr, err := newSystemKeyring()
 	if err != nil {
 		return nil, err
 	}
 	return &Auth{
 		keyring:      kr,
-		browserLogin: newBrowserLogin(),
+		browserLogin: newBrowserLogin(platformClient),
 	}, nil
 }
 

internal/auth/login.go

@@ -26,9 +26,9 @@ type browserLogin struct {
 	platformClient api.PlatformAPI
 }
 
-func newBrowserLogin() *browserLogin {
+func newBrowserLogin(platformClient api.PlatformAPI) *browserLogin {
 	return &browserLogin{
-		platformClient: api.NewPlatformClient(),
+		platformClient: platformClient,
 	}
 }
 

internal/config/config.go

@@ -14,10 +14,12 @@ const (
 	EmulatorAWS       EmulatorType = "aws"
 	EmulatorSnowflake EmulatorType = "snowflake"
 	EmulatorAzure     EmulatorType = "azure"
+
+	dockerRegistry = "localstack"
 )
 
 var emulatorImages = map[EmulatorType]string{
-	EmulatorAWS: "localstack/localstack-pro",
+	EmulatorAWS: "localstack-pro",
 }
 
 var emulatorHealthPaths = map[EmulatorType]string{
@@ -36,15 +38,15 @@ type ContainerConfig struct {
 }
 
 func (c *ContainerConfig) Image() (string, error) {
-	baseImage, ok := emulatorImages[c.Type]
-	if !ok {
-		return "", fmt.Errorf("%s emulator not supported yet by lstk", c.Type)
+	productName, err := c.ProductName()
+	if err != nil {
+		return "", err
 	}
 	tag := c.Tag
 	if tag == "" {
 		tag = "latest"
 	}
-	return fmt.Sprintf("%s:%s", baseImage, tag), nil
+	return fmt.Sprintf("%s/%s:%s", dockerRegistry, productName, tag), nil
 }
 
 // Name returns the container name: "localstack-{type}" or "localstack-{type}-{tag}" if tag != latest
@@ -64,6 +66,14 @@ func (c *ContainerConfig) HealthPath() (string, error) {
 	return path, nil
 }
 
+func (c *ContainerConfig) ProductName() (string, error) {
+	productName, ok := emulatorImages[c.Type]
+	if !ok {
+		return "", fmt.Errorf("%s emulator not supported yet by lstk", c.Type)
+	}
+	return productName, nil
+}
+
 func ConfigDir() (string, error) {
 	configHome, err := os.UserConfigDir()
 	if err != nil {

internal/container/start.go

@@ -5,16 +5,19 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"os"
+	stdruntime "runtime"
 	"time"
 
 	"github.com/containerd/errdefs"
+	"github.com/localstack/lstk/internal/api"
 	"github.com/localstack/lstk/internal/auth"
 	"github.com/localstack/lstk/internal/config"
 	"github.com/localstack/lstk/internal/runtime"
 )
 
-func Start(ctx context.Context, rt runtime.Runtime, onProgress func(string)) error {
-	a, err := auth.New()
+func Start(ctx context.Context, rt runtime.Runtime, platformClient api.PlatformAPI, onProgress func(string)) error {
+	a, err := auth.New(platformClient)
 	if err != nil {
 		return fmt.Errorf("failed to initialize auth: %w", err)
 	}
@@ -50,6 +53,7 @@ func Start(ctx context.Context, rt runtime.Runtime, onProgress func(string)) err
 		}
 	}
 
+	// Pull all images first
 	for _, config := range containers {
 		// Remove any existing stopped container with the same name
 		if err := rt.Remove(ctx, config.Name); err != nil && !errdefs.IsNotFound(err) {
@@ -70,7 +74,18 @@ func Start(ctx context.Context, rt runtime.Runtime, onProgress func(string)) err
 		if err := rt.PullImage(ctx, config.Image, progress); err != nil {
 			return fmt.Errorf("failed to pull image %s: %w", config.Image, err)
 		}
+	}
+
+	// TODO validate license for tag "latest" without resolving the actual image version,
+	// and avoid pulling all images first
+	for i, c := range cfg.Containers {
+		if err := validateLicense(ctx, rt, platformClient, containers[i], &c, token, onProgress); err != nil {
+			return err
+		}
+	}
 
+	// Start containers
+	for _, config := range containers {
 		onProgress(fmt.Sprintf("Starting %s...", config.Name))
 		containerID, err := rt.Start(ctx, config)
 		if err != nil {
@@ -89,6 +104,45 @@ func Start(ctx context.Context, rt runtime.Runtime, onProgress func(string)) err
 	return nil
 }
 
+func validateLicense(ctx context.Context, rt runtime.Runtime, platformClient api.PlatformAPI, containerConfig runtime.ContainerConfig, cfgContainer *config.ContainerConfig, token string, onProgress func(string)) error {
+	version := cfgContainer.Tag
+	if version == "" || version == "latest" {
+		actualVersion, err := rt.GetImageVersion(ctx, containerConfig.Image)
+		if err != nil {
+			return fmt.Errorf("could not resolve version from image %s: %w", containerConfig.Image, err)
+		}
+		version = actualVersion
+	}
+
+	productName, err := cfgContainer.ProductName()
+	if err != nil {
+		return err
+	}
+	onProgress(fmt.Sprintf("Validating license for %s:%s...", productName, version))
+
+	hostname, _ := os.Hostname()
+	licenseReq := &api.LicenseRequest{
+		Product: api.ProductInfo{
+			Name:    productName,
+			Version: version,
+		},
+		Credentials: api.CredentialsInfo{
+			Token: token,
+		},
+		Machine: api.MachineInfo{
+			Hostname:        hostname,
+			Platform:        stdruntime.GOOS,
+			PlatformRelease: stdruntime.GOARCH,
+		},
+	}
+
+	if err := platformClient.GetLicense(ctx, licenseReq); err != nil {
+		return fmt.Errorf("license validation failed for %s:%s: %w", productName, version, err)
+	}
+
+	return nil
+}
+
 // awaitStartup polls until one of two outcomes:
 //   - Success: health endpoint returns 200 (license is valid, LocalStack is ready)
 //   - Failure: container stops running (e.g., license activation failed), returns error with container logs

internal/runtime/docker.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"log"
 	"strconv"
+	"strings"
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
@@ -148,3 +149,21 @@ func (d *DockerRuntime) Logs(ctx context.Context, containerID string, tail int)
 
 	return string(logs), nil
 }
+
+func (d *DockerRuntime) GetImageVersion(ctx context.Context, imageName string) (string, error) {
+	inspect, err := d.client.ImageInspect(ctx, imageName)
+	if err != nil {
+		return "", fmt.Errorf("failed to inspect image: %w", err)
+	}
+
+	// Get version from LOCALSTACK_BUILD_VERSION environment variable
+	if inspect.Config != nil && inspect.Config.Env != nil {
+		for _, env := range inspect.Config.Env {
+			if strings.HasPrefix(env, "LOCALSTACK_BUILD_VERSION=") {
+				return strings.TrimPrefix(env, "LOCALSTACK_BUILD_VERSION="), nil
+			}
+		}
+	}
+
+	return "", fmt.Errorf("LOCALSTACK_BUILD_VERSION not found in image environment")
+}

internal/runtime/runtime.go

@@ -25,4 +25,5 @@ type Runtime interface {
 	Remove(ctx context.Context, containerName string) error
 	IsRunning(ctx context.Context, containerID string) (bool, error)
 	Logs(ctx context.Context, containerID string, tail int) (string, error)
+	GetImageVersion(ctx context.Context, imageName string) (string, error)
 }