Add blockFilesWithExpiredLicense option to DamConfig

[VPS-thodax]

Motivation

The license duration of a DAM file is purely informational. An expired license is surfaced as a fileLicenseExpired warning in the Admin and as hasExpired on the GraphQL API, but the public DAM routes never look at it — they only validate the URL hash and the content hash. A site therefore keeps delivering an image whose rights have run out, and nothing but an editor noticing the warning stops it.

Solution

DamConfig gets an opt-in blockFilesWithExpiredLicense option. When it is enabled (together with enableLicenseFeature), the public image and file routes respond with a 404 for files whose license has expired. It defaults to false, so delivery is unchanged for existing projects.

DamModule.register({
    damConfig: {
        // ...
        enableLicenseFeature: true,
        blockFilesWithExpiredLicense: true,
    },
});

The public routes cache aggressively (max-age=31536000, s-maxage=86400), so blocking alone would be ineffective: browsers and CDNs would keep serving a file long after its license expired. When the option is enabled, the cache lifetime of files with a license end date is therefore capped at the expiration date.

The license validity checks move from FileLicensesResolver into license.util.ts so the resolver and the controllers share one implementation. The GraphQL schema is unchanged.

Decisions

• The check is opt-in rather than the new default. Blocking delivery is a breaking behavior change for projects that use the license fields as documentation only, and it costs a DB read on every public request. A project that maintains license durations enables it explicitly.
• Only expired licenses are blocked, not licenses that have not started yet. isValid on the API also covers durationFrom being in the future, but a license bought in advance is a normal editorial state and blocking it would surprise. If not-yet-valid files should be blocked too, that's a follow-up.
• The cache lifetime is capped instead of leaving the headers untouched. Without the cap, the feature would only apply to the first request per file per cache. The cap is limited to files that have a license end date and to projects with the option enabled, so cache behavior is unchanged everywhere else.

Verification

license.util.spec.ts covers the expiry boundary (a license is valid through its durationTo day and expires one day later), the config gating (neither flag alone blocks anything), files without a license or without an end date, and the cache header in all four cases: uncapped, capped max-age only, both capped, and 0 for an already-expired license.

Verified that demo/api still boots its AppModule and regenerates schema.gql/block-meta.json without changes (it then fails on the missing local database, which is expected in this environment).

Further information

• Task:

🤖 Generated with Claude Code

https://claude.ai/code/session_01L22ETjLL8qy8xS2gcKZUmz

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Team

Run ID: da5d2461-2105-45c5-9d06-5b580620ddeb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}