Downloads & ISO control

The Downloads page is where account admins get bootable AVERASE images and control the device tokens embedded in them. Every download mints a fresh license token, and the same page's ISO control column is where you suspend, revoke, or reinstate any token later.

This page is admin-only. Members who try to open /downloads are redirected with "Only account admins are allowed to do that." That keeps ISO issuance — and the remote-kill controls next to it — in the hands of the people responsible for the account.

The product cards

Two cards sit side by side, one per product:

Card	Product	What it boots
AVERASE	`engine`	The erasure engine — the single-machine kiosk with hardware tests and asset reports
AVERASE Hotswap	`hotswap`	The Hotswap station — the bulk-erasure ISO for drive chassis with hot-swap bays

Each card shows a version badge (currently 1.0.0 for both products) and the exact image size in bytes, read live from the download service's configuration — the number you should see on disk after the download completes.

A card is in one of three states:

Provisioning — the image isn't available yet. The card is muted and has no button. (The Hotswap card stays in this state until its ISO is provisioned server-side.)
Download — the image is available and your account has an active subscription. Clicking it starts the flow below.
View plans — the image is available but your account isn't subscribed. The button links to the pricing page instead.

What a download actually does

Clicking Download sends POST /iso_downloads with the card's product (engine or hotswap). The server then:

Checks the rate limit. Each account may start at most 5 downloads per hour. Past that you'll see: "Download limit reached — please try again in an hour."
Checks the subscription. Unsubscribed accounts are bounced to the pricing page — the same gate the button state reflects.
Creates a download record (IsoDownload). The download link is valid for 5 minutes; the device token inside the image is valid for 366 days.
Mints a new license token. An Ed25519-signed device token (ltok_…) is issued for your account and bound to this specific download. Quota is currently unlimited (plan-tier quotas are a planned feature — see the note below).
Redirects your browser to a signed URL on the download service, which streams the ISO with your token spliced into its key slot mid-stream.

Each download mints a NEW token, bound to that exact image. The signed URL covers both a hash of the token and the product being downloaded, so a link can't be replayed with a different token or a different image swapped in. Two USB sticks from two downloads are two independent tokens — revoking one never affects the other.

The signed download URL

The redirect target has this shape:

Signed download URL (v3)

GET {worker}/download?dl=…&acct=…&u=…&exp=…&iso=<base|hotswap>&tok=<jws>&sig=<hex>

canonical = "averase-iso-download-v3:{dl}:{acct}:{u}:{exp}:{iso}:{sha256hex(tok)}"
sig       = hex HMAC-SHA256(download_signing_secret, canonical)

The link is reusable until its exp timestamp, and the download service independently rejects any link whose expiry is more than 15 minutes in the future — so even a leaked signing bug couldn't produce long-lived links.

Expired links

If you follow a link after its 5-minute window (a stale browser tab, a forwarded URL), the page shows: "That download link expired. Click Download to get a fresh one." Nothing is lost — a fresh click mints a fresh token and a fresh link. The expired link's token was never delivered to an ISO, so it simply goes unused.

ISO control

Below the product cards, the ISO control column lists every device token your account has issued — up to 200, newest first. This is the single place to manage tokens; there is no separate license-tokens page.

Each entry shows the token's prefix id (ltok_…) with a status badge, plus these rows:

Name
Product
Description
Which image the token was minted for — engine or hotswap.
Name
Issued to
Description
The user who downloaded the ISO.
Name
Wipes used
Description
The token's use count against its quota — shown as use_count of quota_limit, or use_count of ∞ when the token is unlimited (the current default for every token).
Name
Last seen
Description
The last time a device carrying this token checked in.
Name
Issued
Description
When the token was minted.

If the account has never downloaded an ISO, the column shows the empty state: "No device tokens issued yet. Download an ISO to mint one."

Status badges and actions

Badge	Meaning	Available actions
Active (green)	The token boots, unlocks, and wipes normally	Suspend, Revoke
Suspended (yellow)	Temporarily blocked — every verify and check-in is denied	Reinstate
Revoked (red)	Permanently blocked by an account admin	Reinstate
Disabled (solid)	Killed by MAESON staff	None

Suspend blocks the token immediately but reversibly — the next boot verification or pre-wipe check-in from that stick is denied until you reinstate it.
Revoke is meant to be final. The button asks first: "Revoking is permanent for this token. Continue?"
Reinstate returns a suspended or revoked token to active.

Status changes take effect at the device's next network interaction — the boot-time verify, the pre-wipe check-in, the wipe-result upload, or the asset report, whichever comes first. Because the engine fails closed, a suspended or revoked stick cannot start a wipe even if it's already booted and unlocked.

Staff-disabled tokens

A token MAESON support has disabled shows the solid Disabled badge and no action buttons — account admins cannot suspend, revoke, or reinstate around a staff disable. The row carries the note: "Disabled by MAESON support — contact support to restore."

Quota limits exist in the model (quota_limit, enforced atomically at check-in) but every token is currently minted unlimited — per-plan quota tiers are planned and not yet wired to billing. When a limited token runs out, the device is denied with quota_exceeded at its next check-in.

What happens on the device

The token you mint here is what the booted kiosk presents at every step of its lifecycle: the boot-time unlock, the once-per-boot asset report, the pre-wipe check-in, and the wipe-result upload. See License tokens for the full lifecycle and Boot & verification for the device side.