v0.1.0:25–40 — tier model, edit forms, force-delete, license counts, migration 0009 (and hotfix); KEYSAT_INTEGRATION.md merged with downstream-LLM revisions

licensing-service/src/api/issuer_key.rs

@@ -1,4 +1,4 @@
-//! Admin-only issuer-key import endpoint.
+//! Issuer-key endpoints — public read of the public key, admin-only import.
 //!
 //! Used exactly once, by exactly one operator: when bootstrapping a
 //! "master Keysat" instance (the one that issues licenses for the Keysat
@@ -148,3 +148,18 @@ pub async fn import(
                     the previous keypair."
     })))
 }
+
+
+/// PUBLIC: GET /v1/issuer/public-key — returns the daemon's signing
+/// public key in PEM and a couple of conveniences. No auth required —
+/// the public key is, by definition, public. Used by SDK consumers and
+/// by the admin Overview's "Embed your public key" tip card.
+pub async fn public(
+    axum::extract::State(state): axum::extract::State<crate::api::AppState>,
+) -> Json<serde_json::Value> {
+    Json(json!({
+        "public_key_pem": state.keypair.public_key_pem,
+        "key_algorithm": "ed25519",
+        "key_format_version": crate::crypto::KEY_VERSION,
+    }))
+}