Licence and add-ons

What the licence unlocks, and what guests see when it lapses.

What the licence gates

Every tenant has a licence key, which Kiwire decodes into (among other things) an expiry date and a list of modules. Each licensed module maps to the permission names it grants — see Permissions by licence module for the full, generated list — and the licence sync is what turns that list into actual permissions in the tenant's database: every permission belonging to a licensed module is created if it doesn't exist yet, and every permission belonging to a module that isn't licensed is deleted, cascading through every role that held it, including custom roles. A handful of permissions sit outside this entirely — the platform baseline (KAIA, the newer report tabs, the consent settings switch) — and are available on every tenant regardless of what's on the licence.

Modules and permissions

A module is a named bundle of permissions, not a single on/off switch: "Vouchers" is view-vouchers, create-vouchers, edit-vouchers, delete-vouchers and reset-vouchers together, "Devices" is the four device-controller permissions (view, create, edit, delete), and so on through connectors, reporting tabs, buy panel and the rest. The permissions reference lists every module and exactly which permissions it carries — it's generated straight from the same module-to-permission map Kiwire itself uses, so it can't drift out of date with what the product actually does. When you're deciding what a role should be able to do, that page is the one to check first: a role can only ever be given a permission that both the licence and that map agree on.

Add-ons and their expiry

Some capabilities are sold as add-ons on top of a base plan rather than baked into a licence tier — Passpoint is the current example. An add-on is its own subscription record, charged through the same payment provider as the base plan, and it carries its own cancellation date when it's cancelled rather than losing access the moment someone clicks "Cancel". A scheduled sweep looks for add-ons whose cancellation date has passed and only then removes the access they granted — so between cancelling and the cutover date, the add-on keeps working.

When a licence expires

Licence expiry isn't just a badge on the System › License page — it's enforced on every guest login. The licence check runs before a login is allowed to proceed: no licence key at all fails as "licence missing", a licence whose expiry date has passed fails as "licence expired", and either way the guest sees "This service is not licensed" or "The service license has expired. Please contact your administrator to renew." instead of getting online. The same check also enforces the licensed device limit (an over-limit tenant has its oldest controllers keep the licensed slots, and anything beyond that is rejected) and the monthly login quota. None of this blocks the admin panel — you can still sign in and see System › License to fix it — it specifically blocks guests from completing a login on the captive portal.

If a role suddenly can't see something it could see yesterday, check the licence before assuming it's a bug: a module dropping off the licence removes its permissions from every role automatically, on the next licence sync, without anyone touching Roles.

Renewing

Renewal happens on System › License (permission view-license to see it, manage-license to act on it). The page shows the decoded licence info, an expiry warning as the date approaches, the plan's included modules, and any active add-ons with their cancel dates. Subscribing or renewing goes through a hosted checkout (Curlec/Razorpay) — Subscribe creates the subscription, and once the payment is confirmed it is applied to the tenant. If the licence key on file has gotten out of sync with what the subscription actually entitles (for example after changing add-ons), the page's Sync action re-pulls the current plan and add-on set from the licence server and re-applies it to the tenant, which in turn re-runs the permission sync described above.