Phase 16: Releases & Environments

Goal

Allow software vendors to attach release metadata to licenses so that clients can check for available updates and download new versions in a controlled way.

Files Written

• src/Models/Release.php
• src/Repositories/ReleaseRepository.php
• src/Services/ReleaseService.php
• src/Repositories/EnvironmentRepository.php

Release Model

A Release record represents one version of a software package:

$release->version       // semver string, e.g. "2.1.0"
$release->product_id    // associated WC product (or null)
$release->channel       // stable | beta | rc
$release->download_url  // pre-signed URL or redirect endpoint
$release->checksum      // SHA-256 of the downloadable file
$release->min_license_status // required license status to download
$release->changelog     // plain text or Markdown
$release->released_at   // datetime

Update Check Flow

Clients call GET /wplm/v1/releases/check with their current version and license token:

{
  "product_id": 42,
  "current_version": "2.0.0",
  "license_token": "eyJ..."
}

ReleaseService::check_update():

1. Validates the license token (7-step algorithm).
2. Loads the latest stable release for product_id.
3. Compares current_version against release.version using version_compare().
4. If a newer version exists, returns the release metadata.

Response:

{
  "update_available": true,
  "version": "2.1.0",
  "download_url": "https://...",
  "checksum": "sha256:abc123...",
  "changelog": "- Fixed bug #123\n- Added feature X"
}

Download Endpoint

GET /wplm/v1/releases/{id}/download — requires a valid license token in Authorization: Bearer header. Validates the license before returning a redirect to download_url.

This means the download URL itself can be a private S3 pre-signed URL — WPLM handles the license gate and then redirects.

Environment Tracking

wp_wplm_environments tracks named deployment environments per license:

$env->license_id
$env->name        // "production", "staging", "development"
$env->machine_ids // array of machine IDs in this environment

Environments are optional metadata — they don’t affect seat counting but allow vendors to query “how many production installs does this customer have?”