@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Server/Utils/EditionEnforcement.test.ts

@@ -0,0 +1,303 @@
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import EnterpriseEdition from "../../../Server/Enterprise/EnterpriseEdition";
+import EnterpriseFeature from "../../../Server/Enterprise/EnterpriseFeature";
+import EditionEnforcement from "../../../Server/Utils/EditionEnforcement";
+import logger from "../../../Server/Utils/Logger";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../Types/ObjectID";
+import FakeEnterpriseModule, {
+  createEditionStateCases,
+  createLicenseSnapshot,
+  createLicenseSnapshotWithStatus,
+  EditionStateCase,
+  installFakeEnterpriseModule,
+  uninstallEnterpriseModule,
+} from "../Enterprise/FakeEnterpriseModule";
+import { setTestBillingEnabled } from "../Enterprise/TestBillingFlag";
+import { getJestSpyOn } from "../../Spy";
+
+type SpyInstance = ReturnType<typeof getJestSpyOn>;
+
+/*
+ * EditionEnforcement answers "is this identity control live here?" for the
+ * core enforcement sites (UserAuthorization, status page sign-in, SCIM team
+ * locks, provider listings, read masking).
+ *
+ * The rule: the answer follows the RUNTIME state of the feature behind it
+ * (EnterpriseEdition.isFeatureActive) - SSO for the SSO requirements, routes
+ * and listings, SCIM for the team locks. So the controls are live on the
+ * Enterprise Edition while the license covers the feature (or billing is on),
+ * and relaxed on the Community Edition AND on an Enterprise install whose
+ * license has lapsed - there the SSO routes refuse and nobody could satisfy a
+ * requirement. An unknown license state and any error answer "enforce".
+ *
+ * Billing and the edition are pinned in every test (CI's config.env sets
+ * BILLING_ENABLED=true).
+ */
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  const billingFlag: typeof import("../Enterprise/TestBillingFlag") =
+    jest.requireActual(
+      "../Enterprise/TestBillingFlag",
+    ) as typeof import("../Enterprise/TestBillingFlag");
+
+  return billingFlag.withLiveBillingFlag(
+    jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >,
+  );
+});
+
+const userProps: DatabaseCommonInteractionProps = {
+  userId: new ObjectID("22222222-2222-4222-8222-222222222222"),
+  tenantId: new ObjectID("11111111-1111-4111-8111-111111111111"),
+};
+
+const EDITION_CASES: Array<EditionStateCase> = createEditionStateCases();
+
+describe("EditionEnforcement", () => {
+  beforeEach(() => {
+    setTestBillingEnabled(false);
+    uninstallEnterpriseModule();
+    getJestSpyOn(logger, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+    getJestSpyOn(logger, "info").mockImplementation((): void => {
+      return undefined;
+    });
+  });
+
+  afterEach(() => {
+    uninstallEnterpriseModule();
+    setTestBillingEnabled(false);
+    jest.restoreAllMocks();
+  });
+
+  describe("the answers follow the runtime state of SSO and SCIM", () => {
+    test("the matrix has lapsed Enterprise states, not just the two editions", () => {
+      expect(
+        EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+          return editionCase.isLoaded && !editionCase.isActive;
+        }).length,
+      ).toBeGreaterThanOrEqual(4);
+    });
+
+    test.each(
+      EDITION_CASES.map(
+        (editionCase: EditionStateCase): [string, EditionStateCase] => {
+          return [editionCase.label, editionCase];
+        },
+      ),
+    )("%s", (_label: string, editionCase: EditionStateCase) => {
+      editionCase.apply();
+
+      expect(EditionEnforcement.isSsoEnforced()).toBe(editionCase.isActive);
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(editionCase.isActive);
+      expect(EditionEnforcement.areScimTeamLocksEnforced()).toBe(
+        editionCase.isActive,
+      );
+      expect(EditionEnforcement.areSsoRoutesServed()).toBe(
+        editionCase.isActive,
+      );
+      expect(EditionEnforcement.shouldMaskSsoRequirementOnRead(userProps)).toBe(
+        !editionCase.isActive,
+      );
+    });
+  });
+
+  describe("SSO and SCIM are decided separately", () => {
+    test("a license without SCIM relaxes the SCIM team locks only", () => {
+      installFakeEnterpriseModule({
+        snapshot: createLicenseSnapshot({
+          features: [EnterpriseFeature.SSO, EnterpriseFeature.AuditLogs],
+        }),
+      });
+
+      expect(EditionEnforcement.isSsoEnforced()).toBe(true);
+      expect(EditionEnforcement.areSsoRoutesServed()).toBe(true);
+      expect(EditionEnforcement.areScimTeamLocksEnforced()).toBe(false);
+    });
+
+    test("a license without SSO relaxes the SSO requirements only", () => {
+      installFakeEnterpriseModule({
+        snapshot: createLicenseSnapshot({
+          features: [EnterpriseFeature.SCIM],
+        }),
+      });
+
+      expect(EditionEnforcement.isSsoEnforced()).toBe(false);
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(false);
+      expect(EditionEnforcement.areSsoRoutesServed()).toBe(false);
+      expect(EditionEnforcement.shouldMaskSsoRequirementOnRead(userProps)).toBe(
+        true,
+      );
+      expect(EditionEnforcement.areScimTeamLocksEnforced()).toBe(true);
+    });
+  });
+
+  describe("a license change applies at once, without a restart", () => {
+    test("lapse relaxes, renewal enforces again, lapse relaxes again", () => {
+      const fake: FakeEnterpriseModule = installFakeEnterpriseModule();
+
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(true);
+      expect(EditionEnforcement.areScimTeamLocksEnforced()).toBe(true);
+
+      fake.setSnapshot(createLicenseSnapshotWithStatus("expired"));
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(false);
+      expect(EditionEnforcement.areScimTeamLocksEnforced()).toBe(false);
+      expect(EditionEnforcement.areSsoRoutesServed()).toBe(false);
+
+      fake.setSnapshot(createLicenseSnapshotWithStatus("valid"));
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(true);
+      expect(EditionEnforcement.areScimTeamLocksEnforced()).toBe(true);
+      expect(EditionEnforcement.areSsoRoutesServed()).toBe(true);
+
+      fake.setSnapshot(createLicenseSnapshotWithStatus("missing"));
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(false);
+    });
+  });
+
+  describe("isSsoRequired", () => {
+    test.each([false, undefined, null])(
+      "a requirement that is not configured (%p) is never required",
+      (configured: boolean | undefined | null) => {
+        installFakeEnterpriseModule();
+        expect(EditionEnforcement.isSsoRequired(configured)).toBe(false);
+
+        uninstallEnterpriseModule();
+        expect(EditionEnforcement.isSsoRequired(configured)).toBe(false);
+      },
+    );
+
+    test("a configured requirement is relaxed on the Enterprise Edition once the license lapsed", () => {
+      installFakeEnterpriseModule({
+        snapshot: createLicenseSnapshotWithStatus("expired"),
+      });
+
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(false);
+    });
+
+    test("a configured requirement is still required during the grace period", () => {
+      installFakeEnterpriseModule({
+        snapshot: createLicenseSnapshotWithStatus("grace"),
+      });
+
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(true);
+    });
+
+    test("a configured requirement is relaxed on the Community Edition", () => {
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(false);
+    });
+  });
+
+  describe("errors answer 'enforce' (fail secure)", () => {
+    let loggerError: SpyInstance;
+
+    beforeEach(() => {
+      loggerError = getJestSpyOn(logger, "error").mockImplementation(
+        (): void => {
+          return undefined;
+        },
+      );
+      getJestSpyOn(EnterpriseEdition, "isFeatureActive").mockImplementation(
+        (): boolean => {
+          throw new Error("facade exploded");
+        },
+      );
+    });
+
+    test("an error while deciding SSO enforcement enforces SSO and logs it", () => {
+      expect(EditionEnforcement.isSsoEnforced()).toBe(true);
+      expect(EditionEnforcement.isSsoRequired(true)).toBe(true);
+      expect(EditionEnforcement.shouldMaskSsoRequirementOnRead(userProps)).toBe(
+        false,
+      );
+      expect(loggerError).toHaveBeenCalled();
+    });
+
+    test("an error while deciding whether the SSO routes are served serves them", () => {
+      expect(EditionEnforcement.areSsoRoutesServed()).toBe(true);
+      expect(loggerError).toHaveBeenCalled();
+    });
+
+    test("an error while deciding the SCIM team locks applies them", () => {
+      expect(EditionEnforcement.areScimTeamLocksEnforced()).toBe(true);
+      expect(loggerError).toHaveBeenCalled();
+    });
+  });
+
+  describe("shouldMaskSsoRequirementOnRead", () => {
+    test("internal root reads are never masked, in any state", () => {
+      expect(
+        EditionEnforcement.shouldMaskSsoRequirementOnRead({ isRoot: true }),
+      ).toBe(false);
+
+      installFakeEnterpriseModule({
+        snapshot: createLicenseSnapshotWithStatus("expired"),
+      });
+
+      expect(
+        EditionEnforcement.shouldMaskSsoRequirementOnRead({ isRoot: true }),
+      ).toBe(false);
+
+      installFakeEnterpriseModule();
+
+      expect(
+        EditionEnforcement.shouldMaskSsoRequirementOnRead({ isRoot: true }),
+      ).toBe(false);
+    });
+
+    test("missing props are treated as an internal read", () => {
+      expect(EditionEnforcement.shouldMaskSsoRequirementOnRead(undefined)).toBe(
+        false,
+      );
+      expect(EditionEnforcement.shouldMaskSsoRequirementOnRead(null)).toBe(
+        false,
+      );
+    });
+
+    test("master admin and user reads are masked while SSO is not active only", () => {
+      const masterAdmin: DatabaseCommonInteractionProps = {
+        userId: userProps.userId!,
+        isMasterAdmin: true,
+      };
+
+      // Community Edition.
+      expect(
+        EditionEnforcement.shouldMaskSsoRequirementOnRead(masterAdmin),
+      ).toBe(true);
+      expect(EditionEnforcement.shouldMaskSsoRequirementOnRead(userProps)).toBe(
+        true,
+      );
+
+      // Enterprise Edition, lapsed license.
+      const fake: FakeEnterpriseModule = installFakeEnterpriseModule({
+        snapshot: createLicenseSnapshotWithStatus("invalid"),
+      });
+
+      expect(
+        EditionEnforcement.shouldMaskSsoRequirementOnRead(masterAdmin),
+      ).toBe(true);
+      expect(EditionEnforcement.shouldMaskSsoRequirementOnRead(userProps)).toBe(
+        true,
+      );
+
+      // Enterprise Edition, license renewed.
+      fake.setSnapshot(createLicenseSnapshotWithStatus("valid"));
+
+      expect(
+        EditionEnforcement.shouldMaskSsoRequirementOnRead(masterAdmin),
+      ).toBe(false);
+      expect(EditionEnforcement.shouldMaskSsoRequirementOnRead(userProps)).toBe(
+        false,
+      );
+    });
+  });
+});

package/Tests/Server/Utils/FrontendEnvironment.test.ts

@@ -1,4 +1,6 @@
 import { afterEach, describe, expect, test, jest } from "@jest/globals";
+import fs from "fs";
+import path from "path";
 import type {
   ExpressRequest,
   ExpressResponse,
@@ -6,6 +8,9 @@ import type {
 
 const MANAGED_KEYS: Array<string> = [
   "HOST",
+  "IS_ENTERPRISE_EDITION",
+  "ONEUPTIME_EDITION",
+  "ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED",
   "PUBLIC_TEST_SETTING",
   "OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
   "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
@@ -22,9 +27,15 @@ interface BrowserWindow {
   };
 }
 
+interface RenderOptions {
+  // Register a fake enterprise module before serializing (the EE image).
+  enterpriseLoaded?: boolean;
+}
+
 async function render(
   overrides: Record<string, string | undefined>,
   initialWindow: BrowserWindow = {},
+  options: RenderOptions = {},
 ): Promise<{ script: string; window: BrowserWindow }> {
   for (const key of MANAGED_KEYS) {
     delete process.env[key];
@@ -42,6 +53,20 @@ async function render(
   const { getFrontendEnvironmentScript } = await import(
     "../../../Server/Utils/FrontendEnvironment"
   );
+
+  /*
+   * Imported from the same fresh module registry as the serializer, so the
+   * fake is registered on the very EnterpriseEdition instance it reads.
+   */
+  const enterpriseKit: typeof import("../Enterprise/FakeEnterpriseModule") =
+    await import("../Enterprise/FakeEnterpriseModule");
+
+  if (options.enterpriseLoaded) {
+    enterpriseKit.installFakeEnterpriseModule();
+  } else {
+    enterpriseKit.uninstallEnterpriseModule();
+  }
+
   const script: string = getFrontendEnvironmentScript();
 
   new Function("window", script)(initialWindow);
@@ -188,3 +213,345 @@ describe("frontend environment script serialization", () => {
     expect(end).toHaveBeenCalledTimes(1);
   });
 });
+
+describe("frontend environment edition flags", () => {
+  interface EditionCase {
+    rawValue: string | undefined;
+    enterpriseLoaded: boolean;
+    effective: string;
+    requestedButNotLoaded: string;
+  }
+
+  test.each([
+    {
+      rawValue: undefined,
+      enterpriseLoaded: false,
+      effective: "false",
+      requestedButNotLoaded: "false",
+    },
+    {
+      rawValue: "false",
+      enterpriseLoaded: false,
+      effective: "false",
+      requestedButNotLoaded: "false",
+    },
+    {
+      rawValue: "true",
+      enterpriseLoaded: false,
+      effective: "false",
+      requestedButNotLoaded: "true",
+    },
+    {
+      rawValue: "true",
+      enterpriseLoaded: true,
+      effective: "true",
+      requestedButNotLoaded: "false",
+    },
+    {
+      rawValue: undefined,
+      enterpriseLoaded: true,
+      effective: "true",
+      requestedButNotLoaded: "false",
+    },
+    {
+      rawValue: "false",
+      enterpriseLoaded: true,
+      effective: "true",
+      requestedButNotLoaded: "false",
+    },
+  ] as Array<EditionCase>)(
+    "IS_ENTERPRISE_EDITION=$rawValue with ee loaded=$enterpriseLoaded serializes the effective edition $effective",
+    async (editionCase: EditionCase) => {
+      const result: Awaited<ReturnType<typeof render>> = await render(
+        { IS_ENTERPRISE_EDITION: editionCase.rawValue },
+        {},
+        { enterpriseLoaded: editionCase.enterpriseLoaded },
+      );
+
+      expect(result.window.process?.env?.["IS_ENTERPRISE_EDITION"]).toBe(
+        editionCase.effective,
+      );
+      expect(
+        result.window.process?.env?.[
+          "ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED"
+        ],
+      ).toBe(editionCase.requestedButNotLoaded);
+    },
+  );
+
+  test("a client-supplied ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED cannot leak through", async () => {
+    const result: Awaited<ReturnType<typeof render>> = await render(
+      {
+        ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED: "true",
+        PUBLIC_TEST_SETTING: "kept",
+      },
+      {},
+      { enterpriseLoaded: true },
+    );
+
+    expect(
+      result.window.process?.env?.[
+        "ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED"
+      ],
+    ).toBe("false");
+    expect(result.window.process?.env?.["PUBLIC_TEST_SETTING"]).toBe("kept");
+  });
+
+  /*
+   * "Requested" is EnvironmentConfig's isEnterpriseEditionRequested, the
+   * definition the App's boot guard uses too: an explicit
+   * ONEUPTIME_EDITION=community withdraws the request. The Enterprise image
+   * bakes IS_ENTERPRISE_EDITION=true, so without that exception an operator
+   * running it as the Community Edition on purpose (the documented way) would
+   * be told "this is the Community image, switch images".
+   */
+  interface RequestCase {
+    label: string;
+    isEnterpriseEdition: string | undefined;
+    edition: string | undefined;
+    enterpriseLoaded: boolean;
+    requestedButNotLoaded: string;
+  }
+
+  test.each([
+    {
+      label: "the Enterprise image run with ONEUPTIME_EDITION=community",
+      isEnterpriseEdition: "true",
+      edition: "community",
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "false",
+    },
+    {
+      label: "ONEUPTIME_EDITION=community in any case and spacing",
+      isEnterpriseEdition: "true",
+      edition: "  Community \n",
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "false",
+    },
+    {
+      label: "the Community image with a leftover IS_ENTERPRISE_EDITION=true",
+      isEnterpriseEdition: "true",
+      edition: undefined,
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "true",
+    },
+    {
+      label:
+        "IS_ENTERPRISE_EDITION=true with an explicit ONEUPTIME_EDITION=auto",
+      isEnterpriseEdition: "true",
+      edition: "auto",
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "true",
+    },
+    {
+      label: "IS_ENTERPRISE_EDITION=true with a blank ONEUPTIME_EDITION (auto)",
+      isEnterpriseEdition: "true",
+      edition: "   ",
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "true",
+    },
+    {
+      label: "ONEUPTIME_EDITION=enterprise whose module did not load",
+      isEnterpriseEdition: "true",
+      edition: "enterprise",
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "true",
+    },
+    {
+      label: "an unrecognised ONEUPTIME_EDITION does not withdraw the request",
+      isEnterpriseEdition: "true",
+      edition: "comunity",
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "true",
+    },
+    {
+      label: "IS_ENTERPRISE_EDITION=TRUE is not a request (exactly true only)",
+      isEnterpriseEdition: "TRUE",
+      edition: undefined,
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "false",
+    },
+    {
+      label: "the Enterprise image with ee loaded",
+      isEnterpriseEdition: "true",
+      edition: "enterprise",
+      enterpriseLoaded: true,
+      requestedButNotLoaded: "false",
+    },
+    {
+      label: "ONEUPTIME_EDITION=community without IS_ENTERPRISE_EDITION",
+      isEnterpriseEdition: undefined,
+      edition: "community",
+      enterpriseLoaded: false,
+      requestedButNotLoaded: "false",
+    },
+  ] as Array<RequestCase>)(
+    "$label: requested but not loaded = $requestedButNotLoaded",
+    async (requestCase: RequestCase) => {
+      const result: Awaited<ReturnType<typeof render>> = await render(
+        {
+          IS_ENTERPRISE_EDITION: requestCase.isEnterpriseEdition,
+          ONEUPTIME_EDITION: requestCase.edition,
+        },
+        {},
+        { enterpriseLoaded: requestCase.enterpriseLoaded },
+      );
+
+      expect(
+        result.window.process?.env?.[
+          "ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED"
+        ],
+      ).toBe(requestCase.requestedButNotLoaded);
+      expect(result.window.process?.env?.["IS_ENTERPRISE_EDITION"]).toBe(
+        requestCase.enterpriseLoaded ? "true" : "false",
+      );
+    },
+  );
+
+  test("the request is read on every call, not frozen at import", async () => {
+    await render({ IS_ENTERPRISE_EDITION: "true" });
+
+    const { getFrontendEnvironmentVariables } = await import(
+      "../../../Server/Utils/FrontendEnvironment"
+    );
+
+    expect(
+      getFrontendEnvironmentVariables()[
+        "ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED"
+      ],
+    ).toBe("true");
+
+    process.env["ONEUPTIME_EDITION"] = "community";
+
+    expect(
+      getFrontendEnvironmentVariables()[
+        "ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED"
+      ],
+    ).toBe("false");
+  });
+
+  test("uses EnvironmentConfig's shared definition, not a copy of it", () => {
+    const source: string = fs
+      .readFileSync(
+        path.join(__dirname, "../../../Server/Utils/FrontendEnvironment.ts"),
+        "utf8",
+      )
+      .replace(/\/\*[\s\S]*?\*\//g, "")
+      .replace(/(^|[^:])\/\/[^\n]*/g, "$1");
+
+    expect(source).toMatch(
+      /isEnterpriseEditionRequested\(\s*process\.env,?\s*\)/,
+    );
+    expect(source).not.toMatch(/IS_ENTERPRISE_EDITION"\]\s*===/);
+    expect(source).not.toContain("ONEUPTIME_EDITION");
+  });
+
+  test("the effective flags are the only edition values in the script", async () => {
+    const result: Awaited<ReturnType<typeof render>> = await render(
+      { IS_ENTERPRISE_EDITION: "true" },
+      {},
+      { enterpriseLoaded: false },
+    );
+
+    expect(result.script.match(/IS_ENTERPRISE_EDITION/g)?.length).toBe(1);
+    expect(result.script).toContain('"IS_ENTERPRISE_EDITION":"false"');
+  });
+});
+
+/*
+ * The shared definition itself (EnvironmentConfig), which the App's boot guard
+ * (packages/App/Utils/EnterpriseLoader.ts) also uses as its default.
+ */
+describe("isEnterpriseEditionRequested", () => {
+  type EnvironmentConfigModule =
+    typeof import("../../../Server/EnvironmentConfig");
+
+  const loadConfig: (
+    overrides: Record<string, string | undefined>,
+  ) => Promise<EnvironmentConfigModule> = async (
+    overrides: Record<string, string | undefined>,
+  ): Promise<EnvironmentConfigModule> => {
+    for (const key of MANAGED_KEYS) {
+      delete process.env[key];
+    }
+
+    for (const [key, value] of Object.entries(overrides)) {
+      if (typeof value === "undefined") {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+
+    jest.resetModules();
+
+    return await import("../../../Server/EnvironmentConfig");
+  };
+
+  interface DefinitionCase {
+    isEnterpriseEdition: string | undefined;
+    edition: string | undefined;
+    requested: boolean;
+  }
+
+  test.each([
+    { isEnterpriseEdition: "true", edition: undefined, requested: true },
+    { isEnterpriseEdition: "true", edition: "", requested: true },
+    { isEnterpriseEdition: "true", edition: "auto", requested: true },
+    { isEnterpriseEdition: "true", edition: "enterprise", requested: true },
+    { isEnterpriseEdition: "true", edition: "not-an-edition", requested: true },
+    { isEnterpriseEdition: "true", edition: "community", requested: false },
+    { isEnterpriseEdition: "true", edition: " COMMUNITY ", requested: false },
+    { isEnterpriseEdition: "false", edition: undefined, requested: false },
+    { isEnterpriseEdition: "false", edition: "enterprise", requested: false },
+    { isEnterpriseEdition: undefined, edition: undefined, requested: false },
+    { isEnterpriseEdition: "", edition: "auto", requested: false },
+    { isEnterpriseEdition: "TRUE", edition: undefined, requested: false },
+    { isEnterpriseEdition: " true", edition: undefined, requested: false },
+    { isEnterpriseEdition: "1", edition: undefined, requested: false },
+  ] as Array<DefinitionCase>)(
+    "IS_ENTERPRISE_EDITION=$isEnterpriseEdition, ONEUPTIME_EDITION=$edition -> $requested",
+    async (definitionCase: DefinitionCase) => {
+      const config: EnvironmentConfigModule = await loadConfig({
+        IS_ENTERPRISE_EDITION: definitionCase.isEnterpriseEdition,
+        ONEUPTIME_EDITION: definitionCase.edition,
+      });
+
+      expect(
+        config.isEnterpriseEditionRequested({
+          IS_ENTERPRISE_EDITION: definitionCase.isEnterpriseEdition,
+          ONEUPTIME_EDITION: definitionCase.edition,
+        }),
+      ).toBe(definitionCase.requested);
+      // The constant the loader defaults to is the same rule over process.env.
+      expect(config.IsEnterpriseEditionRequested).toBe(
+        definitionCase.requested,
+      );
+    },
+  );
+
+  test("reads only the environment it is given", async () => {
+    const config: EnvironmentConfigModule = await loadConfig({
+      IS_ENTERPRISE_EDITION: "true",
+    });
+
+    expect(config.IsEnterpriseEditionRequested).toBe(true);
+    expect(config.isEnterpriseEditionRequested({})).toBe(false);
+    expect(
+      config.isEnterpriseEditionRequested({
+        IS_ENTERPRISE_EDITION: "true",
+        ONEUPTIME_EDITION: "community",
+      }),
+    ).toBe(false);
+  });
+
+  test("leaves the raw IsEnterpriseEdition flag meaning what it always meant", async () => {
+    const config: EnvironmentConfigModule = await loadConfig({
+      IS_ENTERPRISE_EDITION: "true",
+      ONEUPTIME_EDITION: "community",
+    });
+
+    expect(config.IsEnterpriseEdition).toBe(true);
+    expect(config.IsEnterpriseEditionRequested).toBe(false);
+  });
+});