02 · license platform
from storefront to activation — software licensing in one building
saas · fullstack platform
statement
The licensing platform behind CP Center — a local-first desktop document suite. Buyers order seats, pay via QRIS, and receive keys that admins can track down to devices and activations. Svelte 5 frontend wired 1:1 to an Elysia API on Bun, with a shared OData query language, silent token refresh, and an order lifecycle that issues licences automatically.
the problem
Selling licensed software means juggling orders, payment proofs, seat counts, device activations and suspensions — usually across spreadsheets and chat threads. Buyers have no self-service, admins have no single source of truth.
the answer
CP Center gives buyers a store, a wallet of licenses and live order tracking; admins get customers, licenses, activations, devices, products and revenue dashboards. Payment proofs upload as AVIF to Cloudinary, approvals issue licences automatically, and every list speaks the same OData dialect.
exhibited artifact
requirements analysis
| code | requirement | description |
|---|---|---|
| FR-01 | Auth & Sessions | JWT access + refresh tokens; single-flight silent refresh on 401 |
| FR-02 | Customer Management | CRUD with archive (soft delete) keeping licence references intact |
| FR-03 | License Registry | Issue, suspend, revoke and archive licenses with per-seat meters |
| FR-04 | Devices & Activations | Track devices per license; deactivate/reactivate from admin or buyer scope |
| FR-05 | Ordering Flow | Store → PENDING order → QRIS payment → proof upload → approve/reject → licences issued |
| FR-06 | Payment Proof | Buyer uploads transaction screenshot (converted to AVIF via Cloudinary); reject carries a reason |
| FR-07 | Dashboards | Summary counters, merged activity feed and revenue buckets (30d/90d/YTD) |
| FR-08 | OData Queries | $top/$skip/$count/$orderby/$filter/$search accepted in both casings, capped server-side |
| FR-09 | Notifications | In-app bell fed by payment submissions, approvals and rejections |
| FR-10 | Role Scoping | BUYERs see only their own licenses/devices/dashboard; registration always yields BUYER |
materials list
notable installations
payments without a gateway
Orders land as PENDING with a live 24-hour countdown. Buyers pay by QRIS, upload the transaction proof (atas nama + screenshot → AVIF on Cloudinary), and every admin gets notified. Approve moves it to PAID and issues a licence per item automatically; reject returns it with a visible reason. Expired orders cancel themselves, lazily.
odata-style lists
A shared ListState owns search, sort, filter and pagination for every table. The UI builds OData options ($filter with eq/ne/gt/contains…, $orderby, $top capped at 200) that both casings satisfy — unknown fields are ignored instead of exploding.
silent refresh
~15-minute access tokens with ~7-day refresh tokens. On any 401, one single-flight refresh call runs (parallel requests share it), the failed request retries, and only a true failure ends the session at /login.
native fetch only
No HTTP client library: one centralised api.ts unwraps { value } envelopes, converts error envelopes into readable messages, and maps snake_case DTOs into camelCase models so components never touch raw API shapes.