@oneuptime/common 12.0.30 → 12.0.32

package/Server/Services/TelemetrySourceMapService.ts

@@ -6,12 +6,20 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
+import PositiveNumber from "../../Types/PositiveNumber";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger from "../Utils/Logger";
 import SourceMapResolver, {
+  MAX_FRAMES_TO_RESOLVE,
   MAX_SOURCE_MAP_SIZE_IN_BYTES,
   SourceMapBundle,
 } from "../Utils/Telemetry/SourceMapResolver";
+import {
+  SourceMapMaxBytesPerResolve,
+  SourceMapMaxMapsPerRelease,
+  SourceMapRetentionInDays,
+} from "../EnvironmentConfig";
 import {
   MinifiedStackFrame,
   ResolvedStackFrame,
@@ -23,17 +31,24 @@ export { MAX_SOURCE_MAP_SIZE_IN_BYTES };
 /*
  * How long uploaded maps are kept. Old releases age out automatically —
  * a map is only useful while exceptions from its release are still within
- * telemetry retention, and 90 days comfortably exceeds the default.
+ * telemetry retention, and the default comfortably exceeds it.
+ * SOURCE_MAP_RETENTION_DAYS overrides it.
  */
-export const SOURCE_MAP_RETENTION_DAYS: number = 90;
+export const SOURCE_MAP_RETENTION_DAYS: number = SourceMapRetentionInDays;
 
 /*
- * How many maps one (service, release) pair may hold. Enforced by the
- * upload endpoint (existing bundles + new bundles must fit) and used as
- * the resolver's read limit, so nothing stored is ever silently ignored.
- * A build rarely emits more than a few dozen chunks with maps.
+ * How many distinct bundles one (service, release) pair may hold, from
+ * SOURCE_MAP_MAX_MAPS_PER_RELEASE.
+ *
+ * This is a WRITE gate and nothing else: the upload endpoint checks that
+ * existing bundles + new bundles fit, and rejects with a 400 naming the
+ * limit. It used to double as the resolver's read limit, which coupled two
+ * different quantities — distinct bundle paths on the write side, rows on
+ * the read side — and made raising it dangerous. resolveFramesForService now
+ * bounds itself by BYTES loaded (SourceMapMaxBytesPerResolve), so a release
+ * that fits this ceiling always resolves in full.
  */
-export const MAX_SOURCE_MAPS_PER_RELEASE: number = 100;
+export const MAX_SOURCE_MAPS_PER_RELEASE: number = SourceMapMaxMapsPerRelease;
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -74,11 +89,116 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Service version is required.");
     }
 
+    await this.assertReleaseHasRoomFor(createBy);
+
     createBy.data.sizeInBytes = Buffer.byteLength(content, "utf8");
 
     return { createBy, carryForward: null };
   }
 
+  /**
+   * Enforce the per-release ceiling on the create path itself.
+   *
+   * The upload endpoint checks the whole batch up front, which is where the
+   * useful error message lives — but TelemetrySourceMap is a full CRUD
+   * resource, so POST /api/telemetry-source-map reaches create() without ever
+   * passing that check. Without this the configured ceiling was advisory on
+   * that path, and a release could quietly grow past what the operator set.
+   *
+   * Two steps, so the common case stays cheap: an indexed COUNT on every
+   * insert, and the exact distinct-bundle answer only once that COUNT says
+   * the release is at the boundary. A release is written once per CI run, and
+   * on the upload path the batch check has already passed, so the second step
+   * is effectively unreachable there.
+   */
+  @CaptureSpan()
+  private async assertReleaseHasRoomFor(
+    createBy: CreateBy<Model>,
+  ): Promise<void> {
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId || undefined;
+    const serviceId: ObjectID | undefined =
+      createBy.data.serviceId || undefined;
+    const serviceVersion: string | undefined = createBy.data.serviceVersion;
+
+    /*
+     * Not a silent pass: a create missing any of these cannot be scoped to a
+     * release, and the tenant column / required-column checks reject it on
+     * their own with a better message than a count could give.
+     */
+    if (!projectId || !serviceId || !serviceVersion) {
+      return;
+    }
+
+    /*
+     * Cheap check first, and it is the one that runs in practice: a COUNT of
+     * ROWS on the (projectId, serviceId, serviceVersion) index. Below the
+     * ceiling there is nothing to decide, whatever the rows contain.
+     */
+    const existingRowCount: PositiveNumber = await this.countBy({
+      query: {
+        projectId: projectId,
+        serviceId: serviceId,
+        serviceVersion: serviceVersion,
+      },
+      skip: 0,
+      limit: LIMIT_MAX,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (existingRowCount.toNumber() < MAX_SOURCE_MAPS_PER_RELEASE) {
+      return;
+    }
+
+    /*
+     * At or above the ceiling on rows — but rows are not the unit the ceiling
+     * is expressed in. The model deliberately allows more than one row per
+     * bundle (a racing double upload must not fail CI), so rejecting on the
+     * row count would fail a legitimate re-upload of a full release purely
+     * because a duplicate row exists. Pay for the exact answer only here,
+     * where the fast path has already established this is the boundary.
+     */
+    const storedBundlePaths: Array<string> =
+      await this.getStoredBundlePathsForRelease({
+        projectId: projectId,
+        serviceId: serviceId,
+        serviceVersion: serviceVersion,
+      });
+
+    const distinctBundlePaths: Set<string> = new Set(
+      storedBundlePaths.map((bundlePath: string) => {
+        return SourceMapResolver.normalizePath(bundlePath);
+      }),
+    );
+
+    /*
+     * Normalized, which makes this backstop slightly MORE permissive than the
+     * upload endpoint's raw-path gate. That is the right direction for a
+     * backstop: it must never be the thing that fails a request the primary
+     * gate already approved.
+     */
+    const incomingBundlePath: string = SourceMapResolver.normalizePath(
+      createBy.data.bundlePath || "",
+    );
+
+    /*
+     * Adding a row for a bundle the release already holds does not grow the
+     * release, so it stays allowed even at the ceiling. Only a NEW distinct
+     * bundle is refused.
+     */
+    if (distinctBundlePaths.has(incomingBundlePath)) {
+      return;
+    }
+
+    if (distinctBundlePaths.size >= MAX_SOURCE_MAPS_PER_RELEASE) {
+      throw new BadDataException(
+        `This release already holds ${distinctBundlePaths.size} source maps, which is the limit of ${MAX_SOURCE_MAPS_PER_RELEASE} per release. Delete unused maps, use a new serviceVersion, or raise SOURCE_MAP_MAX_MAPS_PER_RELEASE.`,
+      );
+    }
+  }
+
   /**
    * Bundle paths currently stored for a (project, service, release) tuple.
    * Used by the upload endpoint to enforce the per-release ceiling without
@@ -182,15 +302,26 @@ export class Service extends DatabaseService<Model> {
         }),
         resolvedCount: 0,
         sourceMapCount: 0,
+        sourceMapsSkippedForSize: 0,
       };
     }
 
     /*
-     * Two-step fetch: list bundle paths first (cheap), then pull content
-     * only for bundles that at least one frame can match. Maps can be tens
-     * of megabytes each and a release may store up to
-     * MAX_SOURCE_MAPS_PER_RELEASE of them — loading them all for every
-     * exception view would be a memory hazard for no benefit.
+     * Two-step fetch: list bundle paths first (cheap — no content), then pull
+     * content only for the bundles a frame can match, and only as many of
+     * those as the byte budget allows. Maps can be tens of megabytes each, so
+     * loading a whole release for every exception view would be a memory
+     * hazard for no benefit.
+     *
+     * The listing reads with LIMIT_MAX rather than the per-release ceiling.
+     * The ceiling counts distinct bundle PATHS, while a read limit counts
+     * ROWS, and duplicate rows for one bundle are deliberately allowed (see
+     * the model: a racing double upload must not fail CI). With the two
+     * numbers equal, one duplicate row was enough to push a distinct bundle
+     * out of resolution — it stored fine, showed in the dashboard, and
+     * silently never resolved. Reading everything and deduping afterwards
+     * removes that coupling; memory is bounded below by bytes, not by how
+     * many rows a content-free listing returns.
      */
     const sourceMapRows: Array<Model> = await this.findBy({
       query: {
@@ -202,11 +333,12 @@ export class Service extends DatabaseService<Model> {
         _id: true,
         bundlePath: true,
         createdAt: true,
+        sizeInBytes: true,
       },
       sort: {
         createdAt: SortOrder.Descending,
       },
-      limit: MAX_SOURCE_MAPS_PER_RELEASE,
+      limit: LIMIT_MAX,
       skip: 0,
       props: {
         isRoot: true,
@@ -237,16 +369,121 @@ export class Service extends DatabaseService<Model> {
       dedupedRows.push(row);
     }
 
-    const matchedRows: Array<Model> = dedupedRows.filter((row: Model) => {
-      return data.frames.some((frame: MinifiedStackFrame) => {
-        return (
-          SourceMapResolver.getMatchScore(
-            frame.fileName,
-            row.bundlePath || "",
-          ) > 0
+    /*
+     * Only the frames resolveFrames will actually attempt can pull a map in.
+     * Matching against every frame would let a caller-supplied array drive an
+     * O(rows x frames) scan and select maps that could never be used anyway —
+     * the frames array is parsed from client-supplied stack trace text, so it
+     * is capped rather than trusted (the API rejects absurd lengths outright).
+     */
+    const framesForMatching: Array<MinifiedStackFrame> = data.frames.slice(
+      0,
+      MAX_FRAMES_TO_RESOLVE,
+    );
+
+    /*
+     * Score every candidate against those frames. The score is how many
+     * trailing path segments the frame and the bundle share, so a frame
+     * "static/main.a8f1.js" prefers the bundle that agrees on "static/" over
+     * one that only agrees on the file name. That ordering is what makes the
+     * byte budget below defensible: when not everything fits, what gets
+     * dropped is the weakest match, not an arbitrary row.
+     */
+    const scoredRows: Array<{
+      row: Model;
+      score: number;
+      sizeInBytes: number;
+    }> = [];
+
+    for (const row of dedupedRows) {
+      let bestScore: number = 0;
+
+      for (const frame of framesForMatching) {
+        const score: number = SourceMapResolver.getMatchScore(
+          frame.fileName,
+          row.bundlePath || "",
         );
-      });
-    });
+
+        if (score > bestScore) {
+          bestScore = score;
+        }
+      }
+
+      if (bestScore > 0) {
+        scoredRows.push({
+          row: row,
+          score: bestScore,
+          /*
+           * onBeforeCreate stamps sizeInBytes on every insert, so a missing
+           * value means a row written straight to the database. Charge it the
+           * per-map ceiling rather than nothing: an unknown size must not be
+           * the way to slip past a budget meant to bound memory.
+           */
+          sizeInBytes:
+            typeof row.sizeInBytes === "number" &&
+            Number.isFinite(row.sizeInBytes) &&
+            row.sizeInBytes > 0
+              ? row.sizeInBytes
+              : MAX_SOURCE_MAP_SIZE_IN_BYTES,
+        });
+      }
+    }
+
+    scoredRows.sort(
+      (
+        a: { row: Model; score: number; sizeInBytes: number },
+        b: { row: Model; score: number; sizeInBytes: number },
+      ) => {
+        if (b.score !== a.score) {
+          return b.score - a.score;
+        }
+
+        // Same match quality: prefer the newer upload, as the dedupe does.
+        const aTime: number = a.row.createdAt
+          ? new Date(a.row.createdAt).getTime()
+          : 0;
+        const bTime: number = b.row.createdAt
+          ? new Date(b.row.createdAt).getTime()
+          : 0;
+
+        return bTime - aTime;
+      },
+    );
+
+    /*
+     * The byte budget. This is the bound that used to be implied by the
+     * per-release count and is a far tighter one, because it measures the
+     * thing that actually consumes memory. Lower-scoring maps that still fit
+     * are kept (hence continue, not break) so a single oversized map does not
+     * cost the rest of the stack trace its symbols.
+     *
+     * The best-scoring map is always attempted even if it alone exceeds the
+     * budget: a budget configured below the per-map ceiling should degrade to
+     * "one map at a time", not to "nothing ever resolves". Peak is therefore
+     * max(SourceMapMaxBytesPerResolve, MAX_SOURCE_MAP_SIZE_IN_BYTES).
+     */
+    const matchedRows: Array<Model> = [];
+    let budgetUsedInBytes: number = 0;
+    let sourceMapsSkippedForSize: number = 0;
+
+    for (const scored of scoredRows) {
+      const wouldExceedBudget: boolean =
+        budgetUsedInBytes + scored.sizeInBytes > SourceMapMaxBytesPerResolve;
+
+      if (wouldExceedBudget && matchedRows.length > 0) {
+        sourceMapsSkippedForSize++;
+        continue;
+      }
+
+      budgetUsedInBytes += scored.sizeInBytes;
+      matchedRows.push(scored.row);
+    }
+
+    if (sourceMapsSkippedForSize > 0) {
+      logger.warn(
+        `Source map resolution skipped ${sourceMapsSkippedForSize} matching map(s) for service ${data.serviceId.toString()} release ${data.serviceVersion}: loading them would exceed SOURCE_MAP_MAX_BYTES_PER_RESOLVE (${SourceMapMaxBytesPerResolve} bytes).`,
+      );
+    }
 
     const bundles: Array<SourceMapBundle> = [];
 
@@ -269,7 +506,7 @@ export class Service extends DatabaseService<Model> {
           bundlePath: true,
           content: true,
         },
-        limit: MAX_SOURCE_MAPS_PER_RELEASE,
+        limit: matchedRows.length,
         skip: 0,
         props: {
           isRoot: true,
@@ -300,6 +537,12 @@ export class Service extends DatabaseService<Model> {
        * distinguishable from "no maps uploaded".
        */
       sourceMapCount: dedupedRows.length,
+      /*
+       * Non-zero means symbols are missing because of the byte budget, not
+       * because the maps were never uploaded — the one distinction a user
+       * staring at a half-resolved stack trace cannot make for themselves.
+       */
+      sourceMapsSkippedForSize: sourceMapsSkippedForSize,
     };
   }
 }

package/Server/Services/UserNotificationSettingService.ts

@@ -800,12 +800,6 @@ export class Service extends DatabaseService<UserNotificationSetting> {
     userId: ObjectID,
     projectId: ObjectID,
   ): Promise<void> {
-    await this.addNotificationSettingIfNotExists(
-      userId,
-      projectId,
-      NotificationSettingEventType.SEND_MONITOR_STATUS_CHANGED_OWNER_NOTIFICATION,
-    );
-
     await this.addNotificationSettingIfNotExists(
       userId,
       projectId,

package/Server/Services/UserService.ts

@@ -58,6 +58,7 @@ import Name from "../../Types/Name";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Timezone from "../../Types/Timezone";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+import EnterpriseLicenseSeatUtil from "../Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil";
 
 /*
  * Names the Redis mutex that serializes the first-Master-Admin election across
@@ -184,6 +185,32 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
+    /*
+     * The enterprise seat limit, enforced here because this is the one place
+     * every new user passes through: team invitations, self-service signup,
+     * SSO/OIDC just-in-time provisioning, SCIM, and the Admin Dashboard all
+     * end up in `create`. Enforcing on the invitation instead would leave
+     * signup and SSO as open doors around it.
+     *
+     * No isRoot exemption on purpose — invitations create the invited user as
+     * root, so exempting root would exempt invitations, which is the exact
+     * thing this is here to bound. It is a no-op on Community Edition and on
+     * oneuptime.com (see EnterpriseLicenseSeatUtil.isSeatLimitEnforceable),
+     * and it never counts the User table on a licence with no seat limit.
+     */
+    await EnterpriseLicenseSeatUtil.assertSeatAvailableForNewUser({
+      getLocalUserCount: async (): Promise<number> => {
+        const userCount: PositiveNumber = await this.countBy({
+          query: {},
+          props: {
+            isRoot: true,
+          },
+        });
+
+        return userCount.toNumber();
+      },
+    });
+
     /*
      * clickIds / firstTouchAttribution are publicly creatable jsonb columns
      * (set during signup). Unlike the varchar(500) utm columns they have no

package/Server/Services/WorkflowLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import WorkflowService from "./WorkflowService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class WorkflowLabelRuleEngineServiceClass {
   /**
@@ -35,10 +37,16 @@ class WorkflowLabelRuleEngineServiceClass {
             workflowDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "WorkflowLabelRule",
+        projectId: workflow.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/WorkflowOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import WorkflowService from "./WorkflowService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class WorkflowOwnerRuleEngineServiceClass {
   /**
@@ -42,10 +44,16 @@ class WorkflowOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "WorkflowOwnerRule",
+        projectId: workflow.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil.ts

@@ -0,0 +1,186 @@
+import GlobalConfig from "../../../Models/DatabaseModels/GlobalConfig";
+import EnterpriseLicenseInstanceSummary from "../../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import EnterpriseLicenseSeatsUtil, {
+  SeatUsage,
+} from "../../../Utils/EnterpriseLicense/EnterpriseLicenseSeats";
+import { IsBillingEnabled, IsEnterpriseEdition } from "../../EnvironmentConfig";
+import GlobalConfigService from "../../Services/GlobalConfigService";
+
+/*
+ * Counts the users on THIS installation. Passed in rather than called
+ * directly so this util never has to import UserService — and, more usefully,
+ * so the count is only paid for on the installations that actually enforce a
+ * limit. On Community Edition and on oneuptime.com itself the callbacks below
+ * are never invoked.
+ */
+export type GetLocalUserCountFunction = () => Promise<number>;
+
+/*
+ * Enforcement of the enterprise license seat limit on a self-hosted
+ * installation.
+ *
+ * The limit itself is set on oneuptime.com and mirrored into GlobalConfig by
+ * the daily report job (and by validating or refreshing the license by hand).
+ * This is the half that acts on it: it is the only thing standing between a
+ * customer's license terms and an unbounded User table.
+ *
+ * The seat arithmetic lives in Common/Utils/EnterpriseLicense/EnterpriseLicenseSeats
+ * as a pure function; everything here is about reading the license state and
+ * deciding whether the installation is one that enforces at all.
+ */
+export default class EnterpriseLicenseSeatUtil {
+  /*
+   * Whether this process is an installation whose users are governed by an
+   * enterprise license at all.
+   *
+   * Community Edition has no license and no limit. oneuptime.com runs with
+   * billing enabled and bounds seats through subscriptions instead
+   * (TeamMemberService.onBeforeCreate) — enforcing a license limit there as
+   * well would be a second, wrong answer to the same question.
+   */
+  public static isSeatLimitEnforceable(): boolean {
+    return IsEnterpriseEdition && !IsBillingEnabled;
+  }
+
+  /*
+   * Seat usage derived from an already-loaded GlobalConfig row. Kept separate
+   * from the loading so a caller that has the row in hand — the license
+   * endpoint, which has just read it — does not read it a second time.
+   *
+   * A null config (a fresh installation whose GlobalConfig has not been seeded
+   * yet) yields no limit, which is the same answer as a licence with no seat
+   * limit set.
+   */
+  public static getSeatUsageFromGlobalConfig(data: {
+    config: GlobalConfig | null;
+    localUserCount: number;
+  }): SeatUsage {
+    const config: GlobalConfig | null = data.config;
+
+    const instances: Array<EnterpriseLicenseInstanceSummary> = Array.isArray(
+      config?.enterpriseLicenseInstances,
+    )
+      ? config.enterpriseLicenseInstances
+      : [];
+
+    return EnterpriseLicenseSeatsUtil.getSeatUsage({
+      userLimit: config?.enterpriseLicenseUserLimit,
+      localUserCount: data.localUserCount,
+      aggregatedUserCount: config?.enterpriseLicenseCurrentUserCount,
+      instances: instances,
+      thisInstanceId: config?.instanceId ? config.instanceId.toString() : null,
+    });
+  }
+
+  /*
+   * Seat usage for this installation right now, or null on an installation
+   * that does not enforce a seat limit.
+   *
+   * Null rather than an unenforced SeatUsage so callers cannot accidentally
+   * present Community Edition with a seat report it has no business having,
+   * and so the user count is never queried there.
+   */
+  public static async getSeatUsage(data: {
+    getLocalUserCount: GetLocalUserCountFunction;
+  }): Promise<SeatUsage | null> {
+    if (!this.isSeatLimitEnforceable()) {
+      return null;
+    }
+
+    const config: GlobalConfig | null = await GlobalConfigService.findOneById({
+      id: ObjectID.getZeroObjectID(),
+      select: {
+        enterpriseLicenseUserLimit: true,
+        enterpriseLicenseCurrentUserCount: true,
+        enterpriseLicenseInstances: true,
+        instanceId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return this.getSeatUsageForLoadedGlobalConfig({
+      config: config,
+      getLocalUserCount: data.getLocalUserCount,
+    });
+  }
+
+  /*
+   * The same answer as getSeatUsage, for a caller that has already loaded the
+   * GlobalConfig row (the license endpoint reads it to build its response, and
+   * reading it twice per request would be silly).
+   *
+   * The row must have been selected with enterpriseLicenseUserLimit,
+   * enterpriseLicenseCurrentUserCount, enterpriseLicenseInstances and
+   * instanceId, or the numbers here are a fiction built from missing columns.
+   */
+  public static async getSeatUsageForLoadedGlobalConfig(data: {
+    config: GlobalConfig | null;
+    getLocalUserCount: GetLocalUserCountFunction;
+  }): Promise<SeatUsage | null> {
+    if (!this.isSeatLimitEnforceable()) {
+      return null;
+    }
+
+    /*
+     * The seat limit is read before the users are counted, and the count is
+     * skipped entirely when there is no limit. An unlimited licence is the
+     * common case on a large installation, and that is exactly the
+     * installation where counting the User table on every user creation would
+     * be worth avoiding.
+     */
+    const withoutLocalUsers: SeatUsage = this.getSeatUsageFromGlobalConfig({
+      config: data.config,
+      localUserCount: 0,
+    });
+
+    if (!withoutLocalUsers.isEnforced) {
+      return withoutLocalUsers;
+    }
+
+    return this.getSeatUsageFromGlobalConfig({
+      config: data.config,
+      localUserCount: await data.getLocalUserCount(),
+    });
+  }
+
+  /*
+   * Throws if this installation cannot take another user.
+   *
+   * Called from UserService.onBeforeCreate, which every path that creates a
+   * user goes through — team invitations, self-service signup, SSO and OIDC
+   * just-in-time provisioning, SCIM, and the Admin Dashboard. Enforcing on the
+   * User row rather than on the invitation is what makes that true: a seat is
+   * consumed by a person existing on the installation, not by the particular
+   * door they came through.
+   *
+   * It is also why this deliberately does NOT exempt root/internal writes.
+   * Team invitations create the invited user with `isRoot: true`, so an
+   * isRoot escape hatch here would exempt the single most important path.
+   */
+  public static async assertSeatAvailableForNewUser(data: {
+    getLocalUserCount: GetLocalUserCountFunction;
+  }): Promise<void> {
+    const seatUsage: SeatUsage | null = await this.getSeatUsage({
+      getLocalUserCount: data.getLocalUserCount,
+    });
+
+    if (!seatUsage || !seatUsage.isEnforced) {
+      return;
+    }
+
+    if (seatUsage.hasSeatForNewUser) {
+      return;
+    }
+
+    throw new BadDataException(
+      EnterpriseLicenseSeatsUtil.getSeatLimitReachedMessage({
+        seatsInUse: seatUsage.seatsInUse,
+        userLimit: seatUsage.userLimit as number,
+      }),
+    );
+  }
+}