@oneuptime/common 13.0.7 → 14.0.0

package/Server/Services/TeamPermissionService.ts

@@ -2,6 +2,8 @@ import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
+import ModelPermission from "../Types/Database/Permissions/Index";
+import QueryHelper from "../Types/Database/QueryHelper";
 import AccessTokenService from "./AccessTokenService";
 import DatabaseService from "./DatabaseService";
 import TeamMemberService from "./TeamMemberService";
@@ -11,7 +13,7 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
-import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
@@ -112,6 +114,11 @@ export class Service extends DatabaseService<Model> {
         data.props,
         PermissionType.Allow,
       );
+    const callerBlocks: Array<UserPermission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        data.props,
+        PermissionType.Block,
+      );
 
     /*
      * ProjectOwner is the sole tenant-level delegation override. In
@@ -123,6 +130,12 @@ export class Service extends DatabaseService<Model> {
      */
     if (
       callerPermissions.some((permission: UserPermission) => {
+        return (
+          permission.permission === Permission.ProjectOwner &&
+          this.permissionCoversGrant(permission, PermissionScope.All, [])
+        );
+      }) &&
+      !callerBlocks.some((permission: UserPermission) => {
         return permission.permission === Permission.ProjectOwner;
       })
     ) {
@@ -142,7 +155,38 @@ export class Service extends DatabaseService<Model> {
         );
       });
 
-    if (!canDelegate) {
+    const matchingBlocks: Array<UserPermission> = callerBlocks.filter(
+      (permission: UserPermission) => {
+        return permission.permission === data.permission;
+      },
+    );
+    const targetHasLabelScope: boolean =
+      targetLabelIds.length > 0 &&
+      data.scope !== PermissionScope.All &&
+      data.scope !== PermissionScope.Owned;
+    const isBlocked: boolean = matchingBlocks.some(
+      (permission: UserPermission) => {
+        /*
+         * An unrestricted/Owned grant may include resources blocked from the
+         * caller. Ownership also cannot be transferred between principals.
+         */
+        if (
+          !targetHasLabelScope ||
+          permission.scope === PermissionScope.All ||
+          permission.scope === PermissionScope.Owned ||
+          permission.labelIds.length === 0
+        ) {
+          return true;
+        }
+        return permission.labelIds.some((blockedLabelId: ObjectID) => {
+          return targetLabelIds.some((labelId: ObjectID) => {
+            return labelId.toString() === blockedLabelId.toString();
+          });
+        });
+      },
+    );
+
+    if (!canDelegate || isBlocked) {
       throw new NotAuthorizedException(
         `You cannot grant ${data.permission} because your own access does not include that permission at an equal or broader scope.`,
       );
@@ -349,13 +393,33 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
-    const teamPermissions: Array<Model> = await this.findBy({
+    updateBy.query = await ModelPermission.checkUpdateQueryPermissions(
+      Model,
+      updateBy.query,
+      updateBy.data,
+      updateBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: updateBy.query,
+      select: { _id: true },
+      skip: updateBy.skip,
+      limit: updateBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    // Read complete labels independently of any relation filters in the query.
+    const teamPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         teamId: true,
         projectId: true,
         permission: true,
+        isBlockPermission: true,
         labels: {
           _id: true,
         },
@@ -364,8 +428,6 @@ export class Service extends DatabaseService<Model> {
           isPermissionsEditable: true,
         },
       },
-      skip: 0,
-      limit: LIMIT_MAX,
       props: {
         isRoot: true,
       },
@@ -404,6 +466,16 @@ export class Service extends DatabaseService<Model> {
           ? (rawUpdateData.scope as PermissionScope)
           : permission.scope;
 
+      // Retargeting or narrowing a deny also removes its original restriction.
+      if (permission.isBlockPermission) {
+        this.assertCanGrantPermission({
+          permission: permission.permission!,
+          labelIds: this.getLabelIds(permission.labels),
+          scope: permission.scope,
+          props: updateBy.props,
+        });
+      }
+
       this.assertCanGrantPermission({
         permission: requestedPermission,
         labelIds: this.getLabelIds(requestedLabels),
@@ -413,24 +485,7 @@ export class Service extends DatabaseService<Model> {
     }
 
     if (updateBy.data.labels && updateBy.data.labels.length > 0) {
-      const existingPermissions: Array<Model> = await this.findBy({
-        query: updateBy.query,
-        select: {
-          _id: true,
-          labels: true,
-          isBlockPermission: true,
-          projectId: true,
-          teamId: true,
-          permission: true,
-        },
-        limit: LIMIT_PER_PROJECT,
-        skip: 0,
-        props: {
-          isRoot: true,
-        },
-      });
-
-      for (const alreadySavedPermission of existingPermissions) {
+      for (const alreadySavedPermission of teamPermissions) {
         // check if the
 
         const isBlockPermission: boolean =
@@ -471,6 +526,8 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    updateBy.query = { ...updateBy.query, _id: QueryHelper.any(selectedIds) };
+    updateBy.skip = 0;
     return { updateBy, carryForward: teamPermissions };
   }
 
@@ -523,31 +580,68 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<Model>,
   ): Promise<OnDelete<Model>> {
-    const teamPermissions: Array<Model> = await this.findBy({
+    // Scope the root lookup using the same delete authorization as the write.
+    deleteBy.query = await ModelPermission.checkDeleteQueryPermission(
+      Model,
+      deleteBy.query,
+      deleteBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: deleteBy.query,
+      select: { _id: true },
+      skip: deleteBy.skip,
+      limit: deleteBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    const teamPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         teamId: true,
         projectId: true,
+        permission: true,
+        isBlockPermission: true,
+        labels: { _id: true },
+        scope: true,
         team: {
           isPermissionsEditable: true,
         },
       },
-      skip: 0,
-      limit: LIMIT_MAX,
       props: {
         isRoot: true,
       },
     });
 
     for (const permission of teamPermissions) {
+      this.assertProjectMatchesTenant(permission.projectId!, deleteBy.props);
       if (!permission.team?.isPermissionsEditable) {
         throw new BadDataException(
           "Permissions for this team is not deleteable. You can create a new team and add permissions to that team instead.",
         );
       }
+
+      if (permission.isBlockPermission) {
+        this.assertCanGrantPermission({
+          permission: permission.permission!,
+          labelIds: this.getLabelIds(permission.labels),
+          scope: permission.scope,
+          props: deleteBy.props,
+        });
+      }
     }
 
+    // Keep the write restricted to the page whose authority was checked.
+    deleteBy.query = {
+      ...deleteBy.query,
+      _id: QueryHelper.any(selectedIds),
+    };
+    deleteBy.skip = 0;
+
     let teamMembers: Array<TeamMember> = [];
 
     for (const permission of teamPermissions) {

package/Server/Services/TeamService.ts

@@ -14,6 +14,7 @@ import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import TeamMemberService from "./TeamMemberService";
 import ProjectSCIMService from "./ProjectSCIMService";
 import ModelPermission from "../Types/Database/Permissions/Index";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -61,6 +62,15 @@ export class Service extends DatabaseService<Model> {
       return;
     }
 
+    /*
+     * The lock exists because the identity provider owns the teams while
+     * Push Groups is on. The Community Edition serves no SCIM endpoint, so
+     * nothing could manage them there: a leftover lock is not enforced.
+     */
+    if (!EditionEnforcement.areScimTeamLocksEnforced()) {
+      return;
+    }
+
     const uniqueProjectIds: Map<string, ObjectID> = new Map();
 
     for (const projectId of data.projectIds) {

package/Server/Services/ThreatIntelFeedService.ts

@@ -9,6 +9,8 @@ import ObjectID from "../../Types/ObjectID";
 import {
   THREAT_INTEL_MINIMUM_CONFIDENCE_MAX,
   THREAT_INTEL_MINIMUM_CONFIDENCE_MIN,
+  THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES,
+  THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES,
 } from "../../Types/SecurityEvent/ThreatIntelConstants";
 import TaxiiClient from "../Utils/SecurityEvent/ThreatIntel/TaxiiClient";
 
@@ -40,11 +42,12 @@ export class Service extends DatabaseService<Model> {
     if (data.pollIntervalInMinutes !== undefined) {
       if (
         !Number.isInteger(data.pollIntervalInMinutes) ||
-        data.pollIntervalInMinutes < 1 ||
-        data.pollIntervalInMinutes > 1440
+        data.pollIntervalInMinutes <
+          THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES ||
+        data.pollIntervalInMinutes > THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES
       ) {
         throw new BadDataException(
-          "Poll interval must be a whole number of minutes between 1 and 1440.",
+          `Poll interval must be a whole number of minutes between ${THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES} and ${THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES}.`,
         );
       }
     }

package/Server/Services/UserService.ts

@@ -1,3 +1,4 @@
+import crypto from "crypto";
 import DatabaseConfig from "../DatabaseConfig";
 import {
   EncryptionSecret,
@@ -59,7 +60,7 @@ import Name from "../../Types/Name";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Timezone from "../../Types/Timezone";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
-import EnterpriseLicenseSeatUtil from "../Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil";
+import EnterpriseEdition from "../Enterprise/EnterpriseEdition";
 
 /*
  * Names the Redis mutex that serializes the first-Master-Admin election across
@@ -195,22 +196,13 @@ export class Service extends DatabaseService<Model> {
      *
      * No isRoot exemption on purpose — invitations create the invited user as
      * root, so exempting root would exempt invitations, which is the exact
-     * thing this is here to bound. It is a no-op on Community Edition and on
-     * oneuptime.com (see EnterpriseLicenseSeatUtil.isSeatLimitEnforceable),
-     * and it never counts the User table on a licence with no seat limit.
+     * thing this is here to bound. The limit itself belongs to the Enterprise
+     * license client (ee/Server/License): this is a no-op on the Community
+     * Edition, on oneuptime.com (billing enabled) and whenever the license is
+     * not valid or in grace, and it never counts the User table on a license
+     * with no seat limit.
      */
-    await EnterpriseLicenseSeatUtil.assertSeatAvailableForNewUser({
-      getLocalUserCount: async (): Promise<number> => {
-        const userCount: PositiveNumber = await this.countBy({
-          query: {},
-          props: {
-            isRoot: true,
-          },
-        });
-
-        return userCount.toNumber();
-      },
-    });
+    await EnterpriseEdition.assertSeatAvailableForNewUser();
 
     /*
      * clickIds / firstTouchAttribution are publicly creatable jsonb columns
@@ -1310,7 +1302,8 @@ export class Service extends DatabaseService<Model> {
       );
     }
 
-    const token: string = ObjectID.generate().toString();
+    // A bearer secret: from the CSPRNG, never ObjectID's non-crypto fallback.
+    const token: string = crypto.randomUUID();
 
     const hashedToken: string = await HashedString.hashValue(
       token,

package/Server/Types/Database/Permissions/BasePermission.ts

@@ -70,16 +70,18 @@ export default class BasePermission {
         props,
       );
 
-      if (!props.isMultiTenantRequest) {
-        // We will check for this permission in recursive function.
-
+      /*
+       * Only TenantPermission's per-project recursion returns an array of
+       * queries whose permissions have already been checked. The incoming
+       * query is copied into an ordinary object above, so a caller cannot
+       * supply this array. A multi-tenant request scoped to the current user
+       * (such as pending team invitations) still needs every check below.
+       */
+      if (!Array.isArray(query)) {
         // check model level permissions.
         TablePermission.checkTableLevelPermissions(modelType, props, type);
 
-        /*
-         * We will check for this permission in recursive function.
-         * check query permissions.
-         */
+        // check query permissions.
         QueryPermission.checkQueryPermission(modelType, query, props);
 
         query = await AccessControlPermission.addAccessControlIdsToQuery(

package/Server/Types/Database/Permissions/CreatePermission.ts

@@ -1,5 +1,6 @@
 import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
 import ColumnPermissions from "./ColumnPermission";
+import EditionPermissions from "./EditionPermission";
 import TablePermission from "./TablePermission";
 import TenantPermission from "./TenantPermission";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
@@ -15,6 +16,20 @@ export default class CreatePermission {
     data: TBaseModel,
     props: DatabaseCommonInteractionProps,
   ): void {
+    /*
+     * Master admins skip every table-level check below, but not the edition
+     * check: creating enterprise configuration (global SSO/OIDC providers
+     * are only ever created by master admins) needs the license for them
+     * too. Everyone else gets the same check through TablePermission.
+     */
+    if (props.isMasterAdmin && !props.isRoot) {
+      EditionPermissions.checkEditionPermissions(
+        modelType,
+        props,
+        DatabaseRequestType.Create,
+      );
+    }
+
     // If system is making this query then let the query run!
     if (props.isRoot || props.isMasterAdmin) {
       return;

package/Server/Types/Database/Permissions/EditionPermission.ts

@@ -1,46 +1,236 @@
-import {
-  IsBillingEnabled,
-  IsEnterpriseEdition,
-} from "../../../../Server/EnvironmentConfig";
+import { IsBillingEnabled } from "../../../../Server/EnvironmentConfig";
+import EnterpriseEdition from "../../../Enterprise/EnterpriseEdition";
+import EnterpriseFeature, {
+  ALL_ENTERPRISE_FEATURES,
+} from "../../../Enterprise/EnterpriseFeature";
+import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
 import BaseModel, {
   DatabaseBaseModelType,
 } from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
-import PaymentRequiredException from "../../../../Types/Exception/PaymentRequiredException";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 
+// Whether one column value of an update can only tighten security.
+export type TightenOnlyColumnRule = (value: unknown) => boolean;
+
+/*
+ * Switching an identity provider off (isEnabled: false). Switching one on is
+ * configuration and needs the license; only the literal false counts, so a
+ * value the database might coerce ("false", 0) is judged by the full check.
+ */
+const isSwitchingOff: TightenOnlyColumnRule = (value: unknown): boolean => {
+  return value === false;
+};
+
+/*
+ * The shortest SCIM bearer token a rotation may set without the license. The
+ * Dashboard's "Reset token" generates a UUID (36 characters) and services
+ * default to one, so this only turns away a token short enough to be weaker
+ * than the one it replaces.
+ */
+export const MIN_ROTATED_SCIM_BEARER_TOKEN_LENGTH: number = 32;
+
+// Replacing a (possibly leaked) SCIM bearer token with a new, long one.
+const isRotatedBearerToken: TightenOnlyColumnRule = (
+  value: unknown,
+): boolean => {
+  return (
+    typeof value === "string" &&
+    value.trim().length >= MIN_ROTATED_SCIM_BEARER_TOKEN_LENGTH
+  );
+};
+
+/*
+ * The updates an administrator may make to enterprise configuration while
+ * the feature is unavailable, because they can only tighten security: the
+ * incident-response moves. Keyed by table name, like the facade's feature
+ * map; a model that is not listed has none.
+ *
+ *   isEnabled: false   disable an SSO/OIDC provider (project, status page or
+ *                      global), or a global provider's attachment to a
+ *                      project.
+ *   bearerToken        rotate a leaked SCIM bearer token.
+ *
+ * TeamComplianceSetting has no entry: switching a compliance rule off
+ * relaxes it.
+ */
+const TIGHTEN_ONLY_UPDATES: ReadonlyMap<
+  string,
+  Readonly<Record<string, TightenOnlyColumnRule>>
+> = new Map<string, Readonly<Record<string, TightenOnlyColumnRule>>>([
+  ["GlobalSSO", { isEnabled: isSwitchingOff }],
+  ["GlobalOIDC", { isEnabled: isSwitchingOff }],
+  ["GlobalSSOProject", { isEnabled: isSwitchingOff }],
+  ["GlobalOIDCProject", { isEnabled: isSwitchingOff }],
+  ["ProjectSSO", { isEnabled: isSwitchingOff }],
+  ["ProjectOIDC", { isEnabled: isSwitchingOff }],
+  ["StatusPageSSO", { isEnabled: isSwitchingOff }],
+  ["StatusPageOIDC", { isEnabled: isSwitchingOff }],
+  ["ProjectSCIM", { bearerToken: isRotatedBearerToken }],
+  ["StatusPageSCIM", { bearerToken: isRotatedBearerToken }],
+]);
+
 export default class EditionPermissions {
   /*
-   * Gates models marked with @TableEditionAccessControl({ requiresEnterprise: true }).
+   * Gates the enterprise CONFIGURATION models, the ones marked with
+   * @TableEditionAccessControl({ requiresEnterprise: true }): project, global
+   * and status page SSO/OIDC providers, SCIM configurations and team
+   * compliance settings.
    *
-   * On self-hosted builds (billing disabled) the model is only accessible when
-   * the binary was built as the Enterprise Edition (IS_ENTERPRISE_EDITION=true).
+   * Only creating and updating them needs the license. Reading and deleting
+   * are always allowed, so an install that dropped to the Community Edition,
+   * or whose license lapsed, can still see what it has configured and remove
+   * it. Only configuration is gated here, and none of it is ever deleted.
+   * Whether what exists RUNS is decided at runtime by
+   * EnterpriseEdition.isFeatureActive: SSO, SCIM and audit logging stop while
+   * a self-hosted license is lapsed and resume when a license is activated.
    *
-   * On the cloud / billing-enabled deployment we leave enforcement to
-   * BillingPermission — it already gates these models via the model's
-   * @TableBillingAccessControl plan tier, so a second check would be redundant.
+   * The one kind of update that needs no license either is a TIGHTEN-ONLY
+   * update (see TIGHTEN_ONLY_UPDATES): every column it writes is on the
+   * model's list with a value that can only tighten security - disabling an
+   * identity provider, rotating a leaked SCIM bearer token. A lapsed license
+   * must never stand between an administrator and those moves during an
+   * incident. The same holds on the Community Edition, deliberately and for
+   * the same reason reads and deletes do: the move can only reduce what the
+   * configuration allows, and a provider disabled (or a token rotated) there
+   * stays so when the install returns to the Enterprise Edition, instead of
+   * coming back live. Anything else in the same update - even one more
+   * column - makes it an ordinary update, which needs the license.
+   *
+   * `updateData` is what the update writes. Only UpdatePermission, which has
+   * it, passes it; without it an update is judged by the full check (fail
+   * closed). TablePermission leaves updates to UpdatePermission for that
+   * reason.
+   *
+   * Master admins are subject to this check - Create/UpdatePermission call it
+   * before their master-admin early return - because the global SSO/OIDC
+   * models are only ever written by master admins and would otherwise never
+   * be gated. Internal root writes (props.isRoot) are never checked.
+   *
+   * On the cloud / billing-enabled deployment enforcement is left to
+   * BillingPermission: it already gates these models by the plan tier in
+   * their @TableBillingAccessControl, so a second check would be redundant.
+   *
+   * Deliberately synchronous. TablePermission and CreatePermission are
+   * synchronous and their callers do not await them, so an async check with a
+   * missed await would turn the refusal into an unhandled rejection and let
+   * the write through. The license is read from the enterprise module's
+   * cached snapshot, and an unknown snapshot refuses the write (fail closed).
    */
   @CaptureSpan()
   public static checkEditionPermissions(
     modelType: DatabaseBaseModelType,
-    _props: DatabaseCommonInteractionProps,
+    props: DatabaseCommonInteractionProps,
+    operation: DatabaseRequestType,
+    updateData?: unknown,
   ): void {
     if (IsBillingEnabled) {
       return;
     }
 
+    if (props.isRoot) {
+      return;
+    }
+
+    if (
+      operation !== DatabaseRequestType.Create &&
+      operation !== DatabaseRequestType.Update
+    ) {
+      return;
+    }
+
     const model: BaseModel = new modelType();
 
     if (!model.requiresEnterprise) {
       return;
     }
 
-    if (!IsEnterpriseEdition) {
-      throw new PaymentRequiredException(
-        `${model.singularName || "This feature"} is only available on the OneUptime Enterprise Edition. ` +
-          `Please switch to the Enterprise Edition build to enable this feature. ` +
-          `See https://oneuptime.com/enterprise/overview for details.`,
-      );
+    if (
+      operation === DatabaseRequestType.Update &&
+      EditionPermissions.isTightenOnlyUpdate(model.tableName, updateData)
+    ) {
+      return;
+    }
+
+    const feature: EnterpriseFeature | null =
+      EnterpriseEdition.getModelFeature(modelType);
+
+    if (feature) {
+      EnterpriseEdition.assertFeatureAvailableSync(feature);
+      return;
+    }
+
+    /*
+     * An enterprise model the facade has no feature for (its guard test
+     * should make this impossible). Fail closed: only a license entitled to
+     * every enterprise feature may configure it.
+     */
+    for (const enterpriseFeature of ALL_ENTERPRISE_FEATURES) {
+      EnterpriseEdition.assertFeatureAvailableSync(enterpriseFeature);
+    }
+  }
+
+  /*
+   * True when the update writes at least one column, and every column it
+   * writes is on the table's tighten-only list with a value that passes the
+   * column's rule. Columns set to undefined are not written and are ignored.
+   * Anything that is not a plain object of columns is not tighten-only.
+   */
+  public static isTightenOnlyUpdate(
+    tableName: string | null | undefined,
+    updateData: unknown,
+  ): boolean {
+    const rules: Readonly<Record<string, TightenOnlyColumnRule>> | undefined =
+      tableName ? TIGHTEN_ONLY_UPDATES.get(tableName) : undefined;
+
+    if (!rules) {
+      return false;
+    }
+
+    if (
+      !updateData ||
+      typeof updateData !== "object" ||
+      Array.isArray(updateData)
+    ) {
+      return false;
     }
+
+    const writtenColumns: Array<[string, unknown]> = Object.entries(
+      updateData as Record<string, unknown>,
+    ).filter(([, value]: [string, unknown]): boolean => {
+      return value !== undefined;
+    });
+
+    if (writtenColumns.length === 0) {
+      return false;
+    }
+
+    return writtenColumns.every(
+      ([column, value]: [string, unknown]): boolean => {
+        const rule: TightenOnlyColumnRule | undefined =
+          Object.prototype.hasOwnProperty.call(rules, column)
+            ? rules[column]
+            : undefined;
+
+        return Boolean(rule && rule(value));
+      },
+    );
+  }
+
+  // The tables with tighten-only updates, and their columns (for guard tests).
+  public static getTightenOnlyColumns(): ReadonlyMap<
+    string,
+    ReadonlyArray<string>
+  > {
+    const columns: Map<string, ReadonlyArray<string>> = new Map<
+      string,
+      ReadonlyArray<string>
+    >();
+
+    for (const [tableName, rules] of TIGHTEN_ONLY_UPDATES) {
+      columns.set(tableName, Object.keys(rules));
+    }
+
+    return columns;
   }
 }