@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Server/API/SecurityEventAttributesAPI.test.ts

@@ -8,6 +8,10 @@ import {
 import Response from "../../../Server/Utils/Response";
 import Dictionary from "../../../Types/Dictionary";
 import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import Permission, {
@@ -339,7 +343,13 @@ describe("Security event attribute API", () => {
   });
 
   describe("access control", () => {
-    test("an unauthenticated caller is refused", async () => {
+    /*
+     * Tightened from "refused somehow" to the exact refusal. A tokenless
+     * request is, in practice, a SIEM page left open past the access-token
+     * lifetime; the browser client refreshes the session and replays only on
+     * a 401, so the status is as much the contract as the refusal itself.
+     */
+    test("an unauthenticated caller is refused with NotAuthenticatedException (401)", async () => {
       const result: CallResult = await callRoute({
         uri: KEYS_ROUTE,
         request: { userType: UserType.Public, tenantId: projectId },
@@ -347,10 +357,71 @@ describe("Security event attribute API", () => {
       });
 
       expect(result.reachedHandler).toBe(false);
-      expect(result.deniedWith).toBeDefined();
+      expect(result.deniedWith).toBeInstanceOf(NotAuthenticatedException);
+      expect(result.deniedWith?.code).toBe(
+        ExceptionCode.NotAuthenticatedException,
+      );
+      expect(result.deniedWith?.code).toBe(401);
+      expect(result.deniedWith?.message).toBe(
+        UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+      );
+      expect(fetchAttributes.mock.calls).toHaveLength(0);
+    });
+
+    test("a request with no userType at all is the same 401", async () => {
+      const result: CallResult = await callRoute({
+        uri: KEYS_ROUTE,
+        request: { tenantId: projectId },
+        body: {},
+      });
+
+      expect(result.reachedHandler).toBe(false);
+      expect(result.deniedWith).toBeInstanceOf(NotAuthenticatedException);
+      expect(result.deniedWith?.code).toBe(401);
       expect(fetchAttributes.mock.calls).toHaveLength(0);
     });
 
+    /*
+     * requireUserAuthentication answers the anonymous caller first, but the
+     * permission guard behind it must not depend on that ordering: run on its
+     * own, it too asks "who are you?" before comparing permissions, rather
+     * than answering an expired session with the 422 below.
+     */
+    test("the permission guard on its own answers an anonymous caller with 401, not 422", async () => {
+      const guard: RouterFunction | undefined =
+        findRoute(KEYS_ROUTE).handlers[2];
+
+      expect(guard).toBeDefined();
+
+      const req: ExpressRequest = {
+        userType: UserType.Public,
+        tenantId: projectId,
+        headers: {},
+      } as unknown as ExpressRequest;
+
+      const res: ExpressResponse = {
+        status: jest.fn().mockReturnThis(),
+        send: jest.fn(),
+      } as unknown as ExpressResponse;
+
+      const step: { calledNext: boolean } = { calledNext: false };
+
+      await guard!(req, res, ((): void => {
+        step.calledNext = true;
+      }) as unknown as NextFunction);
+
+      // The guard answered the request itself.
+      expect(step.calledNext).toBe(false);
+
+      const sendErrorResponse: jest.Mock =
+        Response.sendErrorResponse as unknown as jest.Mock;
+      const denied: Exception = sendErrorResponse.mock
+        .calls[0]![2] as Exception;
+
+      expect(denied).toBeInstanceOf(NotAuthenticatedException);
+      expect(denied.code).toBe(401);
+    });
+
     test("a project member without any security read permission is refused", async () => {
       const result: CallResult = await callRoute({
         uri: KEYS_ROUTE,
@@ -364,6 +435,14 @@ describe("Security event attribute API", () => {
 
       expect(result.reachedHandler).toBe(false);
       expect(result.deniedWith).toBeDefined();
+      /*
+       * Logged in, so this stays the 422: a 401 here would make the browser
+       * refresh a perfectly good session and replay into the same refusal.
+       */
+      expect(result.deniedWith).toBeInstanceOf(NotAuthorizedException);
+      expect(result.deniedWith?.code).toBe(
+        ExceptionCode.NotAuthorizedException,
+      );
       expect(fetchAttributes.mock.calls).toHaveLength(0);
     });
 
@@ -507,6 +586,14 @@ describe("Security event attribute API", () => {
 
       expect(result.reachedHandler).toBe(false);
       expect(result.deniedWith).toBeDefined();
+      expect(result.deniedWith).toBeInstanceOf(NotAuthenticatedException);
+      expect(result.deniedWith?.code).toBe(
+        ExceptionCode.NotAuthenticatedException,
+      );
+      expect(result.deniedWith?.message).toBe(
+        UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+      );
+      expect(fetchAttributeValues.mock.calls).toHaveLength(0);
     });
   });
 

package/Tests/Server/API/SessionReplayAPI.test.ts

@@ -35,7 +35,9 @@ import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/Database
 import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import Permission, {
@@ -631,6 +633,125 @@ describe("Session replay playback API", () => {
     });
   });
 
+  /*
+   * The one caller the note on status codes at the top of this file does NOT
+   * cover: somebody with no credentials at all. That is a 401 - it is the case
+   * NotAuthenticatedException exists for - and in practice it is a reviewer
+   * whose replay tab sat open past the access-token lifetime, so the cookie
+   * stopped being sent. The browser client refreshes the session and replays
+   * the request on a 401 and on nothing else, which is why these assert the
+   * code and not merely a refusal.
+   */
+  describe("an expired session is asked to authenticate, on every route", () => {
+    const allRoutes: Array<string> = [
+      LIST_ROUTE,
+      SUMMARIES_ROUTE,
+      USERS_ROUTE,
+      MANIFEST_ROUTE,
+      CHUNKS_ROUTE,
+      HEARTBEAT_ROUTE,
+      VIEWS_ROUTE,
+      FOR_EXCEPTION_ROUTE,
+      INGEST_STATUS_ROUTE,
+    ];
+
+    function expectAuthenticationRequired(denied: Exception | undefined): void {
+      expect(denied).toBeInstanceOf(NotAuthenticatedException);
+      expect(denied?.code).toBe(ExceptionCode.NotAuthenticatedException);
+      expect(denied?.code).toBe(401);
+      expect(denied?.message).toBe(
+        UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+      );
+    }
+
+    test.each(allRoutes)(
+      "%s refuses a Public caller carrying a tenant with 401 and reads nothing",
+      async (uri: string) => {
+        const result: CallResult = await callRoute({
+          uri: uri,
+          request: {
+            userType: UserType.Public,
+            tenantId: projectId,
+          } as unknown as JSONObject,
+          body: { sessionId: "session-1" },
+        });
+
+        expectAuthenticationRequired(result.deniedWith);
+        expect(result.reachedHandler).toBe(false);
+        expect(result.thrownToNext).toBeUndefined();
+        expect(headerQuerySpy).not.toHaveBeenCalled();
+        expect(chunkQuerySpy).not.toHaveBeenCalled();
+        expect(recordViewSpy).not.toHaveBeenCalled();
+      },
+    );
+
+    /*
+     * requireUserAuthentication answers first on the real chain, so this runs
+     * each route's permission guard (handlers[2]) by itself. It must ask "who
+     * are you?" before comparing permissions too; otherwise an anonymous
+     * request that ever reached it would get the 422 - the answer that left
+     * the customer's dashboard stuck.
+     */
+    test.each(allRoutes)(
+      "%s: the permission guard alone answers an anonymous caller with 401, not 422",
+      async (uri: string) => {
+        const guard: RouterFunction | undefined = findRoute(uri).handlers[2];
+
+        expect(guard).toBeDefined();
+
+        const req: ExpressRequest = {
+          userType: UserType.Public,
+          tenantId: projectId,
+          headers: {},
+        } as unknown as ExpressRequest;
+
+        const res: ExpressResponse = {
+          status: jest.fn().mockReturnThis(),
+          send: jest.fn(),
+        } as unknown as ExpressResponse;
+
+        const next: jest.Mock = jest.fn();
+
+        await guard!(req, res, next as unknown as NextFunction);
+
+        expect(next).not.toHaveBeenCalled();
+
+        const sendErrorResponse: jest.Mock =
+          Response.sendErrorResponse as unknown as jest.Mock;
+
+        expectAuthenticationRequired(
+          sendErrorResponse.mock.calls[0]?.[2] as Exception | undefined,
+        );
+      },
+    );
+
+    test("a logged-in caller without the payload permission still gets the 422, not a 401", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.ProjectMember],
+      });
+
+      mockProps(principal.databaseProps);
+
+      const result: CallResult = await callRoute({
+        uri: MANIFEST_ROUTE,
+        request: principal.request,
+        body: { sessionId: "session-1" },
+      });
+
+      expect(result.deniedWith).toBeInstanceOf(NotAuthorizedException);
+      expect(result.deniedWith).not.toBeInstanceOf(NotAuthenticatedException);
+      expect(result.deniedWith?.code).toBe(
+        ExceptionCode.NotAuthorizedException,
+      );
+      expect(result.reachedHandler).toBe(false);
+    });
+  });
+
   /*
    * The chunk table's replace key is (projectId, sessionId, tabId,
    * chunkIndex) - rumApplicationId is a plain column. sessionId is minted

package/Tests/Server/API/SsoProviderListingsEdition.test.ts

@@ -0,0 +1,432 @@
+import ProjectOidcAPI from "../../../Server/API/ProjectOIDC";
+import ProjectSsoAPI from "../../../Server/API/ProjectSSO";
+import StatusPageAPI from "../../../Server/API/StatusPageAPI";
+import ProjectOidcService from "../../../Server/Services/ProjectOidcService";
+import ProjectSsoService from "../../../Server/Services/ProjectSsoService";
+import StatusPageDomainService from "../../../Server/Services/StatusPageDomainService";
+import StatusPageFooterLinkService from "../../../Server/Services/StatusPageFooterLinkService";
+import StatusPageHeaderLinkService from "../../../Server/Services/StatusPageHeaderLinkService";
+import StatusPageOidcService from "../../../Server/Services/StatusPageOidcService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import StatusPageSsoService from "../../../Server/Services/StatusPageSsoService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import ProjectOIDC from "../../../Models/DatabaseModels/ProjectOidc";
+import ProjectSSO from "../../../Models/DatabaseModels/ProjectSso";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import StatusPageOIDC from "../../../Models/DatabaseModels/StatusPageOidc";
+import StatusPageSSO from "../../../Models/DatabaseModels/StatusPageSso";
+import FakeEnterpriseModule, {
+  createEditionStateCases,
+  createLicenseSnapshotWithStatus,
+  EditionStateCase,
+  installFakeEnterpriseModule,
+  uninstallEnterpriseModule,
+} from "../Enterprise/FakeEnterpriseModule";
+import { setTestBillingEnabled } from "../Enterprise/TestBillingFlag";
+import { getJestSpyOn } from "../../Spy";
+import { mockRouter } from "./Helpers";
+import logger from "../../../Server/Utils/Logger";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+type SpyInstance = ReturnType<typeof getJestSpyOn>;
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  const billingFlag: typeof import("../Enterprise/TestBillingFlag") =
+    jest.requireActual(
+      "../Enterprise/TestBillingFlag",
+    ) as typeof import("../Enterprise/TestBillingFlag");
+
+  return billingFlag.withLiveBillingFlag(
+    jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >,
+  );
+});
+
+/*
+ * The provider lists that sign-in pages offer, and the status page's own
+ * "should I force SSO / offer SSO" flags.
+ *
+ * The SAML/OIDC login routes answer only while SSO is ACTIVE
+ * (EnterpriseEdition.isFeatureActive(SSO), through EditionEnforcement): the
+ * Enterprise Edition with billing on, or with a license that covers SSO
+ * (valid, grace, trial), or while the license state is unknown. So:
+ *   - SSO active: providers are listed as configured, and a status page's
+ *     SSO requirement is reported.
+ *   - SSO not active - the Community Edition, or an Enterprise install whose
+ *     license lapsed: every list is empty and the status page reports no SSO,
+ *     so no client sends a user into a route that answers 404 or refuses.
+ *     Nothing is even read from the provider tables.
+ *
+ * Billing and the edition are pinned in every test. This suite runs without
+ * ee/: it uses the fake enterprise module only.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const STATUS_PAGE_ID: ObjectID = new ObjectID(
+  "77777777-7777-4777-8777-777777777777",
+);
+
+const PROJECT_SSO_ROUTE: string = `${new ProjectSSO()
+  .getCrudApiPath()
+  ?.toString()}/:projectId/sso-list`;
+const PROJECT_OIDC_ROUTE: string = `${new ProjectOIDC()
+  .getCrudApiPath()
+  ?.toString()}/:projectId/oidc-list`;
+const STATUS_PAGE_SSO_ROUTE: string = "/status-page/sso/:statusPageId";
+const STATUS_PAGE_OIDC_ROUTE: string = "/status-page/oidc/:statusPageId";
+const MASTER_PAGE_ROUTE: string = "/status-page/master-page/:statusPageId";
+
+const EDITION_CASES: Array<EditionStateCase> = createEditionStateCases();
+
+const buildProjectSso: () => ProjectSSO = (): ProjectSSO => {
+  const sso: ProjectSSO = new ProjectSSO();
+  sso._id = ObjectID.generate().toString();
+  sso.name = "Okta";
+  return sso;
+};
+
+const buildProjectOidc: () => ProjectOIDC = (): ProjectOIDC => {
+  const oidc: ProjectOIDC = new ProjectOIDC();
+  oidc._id = ObjectID.generate().toString();
+  oidc.name = "Entra ID";
+  return oidc;
+};
+
+const buildStatusPageSso: () => StatusPageSSO = (): StatusPageSSO => {
+  const sso: StatusPageSSO = new StatusPageSSO();
+  sso._id = ObjectID.generate().toString();
+  sso.name = "Okta";
+  return sso;
+};
+
+const buildStatusPageOidc: () => StatusPageOIDC = (): StatusPageOIDC => {
+  const oidc: StatusPageOIDC = new StatusPageOIDC();
+  oidc._id = ObjectID.generate().toString();
+  oidc.name = "Entra ID";
+  return oidc;
+};
+
+const invoke: (data: {
+  route: string;
+  params: Record<string, string>;
+}) => Promise<void> = async (data: {
+  route: string;
+  params: Record<string, string>;
+}): Promise<void> => {
+  const headers: Record<string, string> = { host: "app.example.com" };
+
+  const req: ExpressRequest = {
+    params: data.params,
+    query: {},
+    body: {},
+    cookies: {},
+    headers,
+    get: (name: string): string | undefined => {
+      return headers[name.toLowerCase()];
+    },
+    socket: {},
+    ips: [],
+  } as unknown as ExpressRequest;
+
+  const res: ExpressResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+  } as unknown as ExpressResponse;
+
+  const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+  await mockRouter.match("post", data.route).handlerFunction(req, res, next);
+
+  expect(next).not.toHaveBeenCalled();
+};
+
+const listedItems: () => Array<unknown> = (): Array<unknown> => {
+  expect(Response.sendEntityArrayResponse).toHaveBeenCalledTimes(1);
+
+  const call: Array<unknown> = (Response.sendEntityArrayResponse as jest.Mock)
+    .mock.calls[0] as Array<unknown>;
+
+  const items: Array<unknown> = call[2] as Array<unknown>;
+  const count: PositiveNumber = call[3] as PositiveNumber;
+
+  expect(count.toNumber()).toBe(items.length);
+
+  return items;
+};
+
+describe("SSO provider listings and status page SSO flags, by edition", () => {
+  const originalHost: string | undefined = process.env["HOST"];
+
+  let projectSsoFind: SpyInstance;
+  let projectOidcFind: SpyInstance;
+  let statusPageSsoFind: SpyInstance;
+  let statusPageOidcFind: SpyInstance;
+  let statusPageSsoCount: SpyInstance;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new ProjectSsoAPI();
+    new ProjectOidcAPI();
+    new StatusPageAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env["HOST"] = "app.example.com";
+    setTestBillingEnabled(false);
+    uninstallEnterpriseModule();
+
+    projectSsoFind = getJestSpyOn(
+      ProjectSsoService,
+      "findBy",
+    ).mockResolvedValue([buildProjectSso()]);
+    projectOidcFind = getJestSpyOn(
+      ProjectOidcService,
+      "findBy",
+    ).mockResolvedValue([buildProjectOidc()]);
+    statusPageSsoFind = getJestSpyOn(
+      StatusPageSsoService,
+      "findBy",
+    ).mockResolvedValue([buildStatusPageSso()]);
+    statusPageOidcFind = getJestSpyOn(
+      StatusPageOidcService,
+      "findBy",
+    ).mockResolvedValue([buildStatusPageOidc()]);
+    statusPageSsoCount = getJestSpyOn(
+      StatusPageSsoService,
+      "countBy",
+    ).mockResolvedValue(new PositiveNumber(2));
+  });
+
+  afterEach(() => {
+    uninstallEnterpriseModule();
+    setTestBillingEnabled(false);
+    jest.restoreAllMocks();
+
+    if (originalHost === undefined) {
+      delete process.env["HOST"];
+    } else {
+      process.env["HOST"] = originalHost;
+    }
+  });
+
+  test("the cases include lapsed Enterprise licenses, not just the two editions", () => {
+    expect(
+      EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+        return editionCase.isLoaded && !editionCase.isActive;
+      }).length,
+    ).toBeGreaterThanOrEqual(4);
+  });
+
+  describe.each(
+    EDITION_CASES.map(
+      (editionCase: EditionStateCase): [string, EditionStateCase] => {
+        return [editionCase.label, editionCase];
+      },
+    ),
+  )("%s", (_label: string, editionCase: EditionStateCase) => {
+    beforeEach(() => {
+      editionCase.apply();
+      getJestSpyOn(logger, "warn").mockImplementation((): void => {
+        return undefined;
+      });
+    });
+
+    test(`project SSO list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+      await invoke({
+        route: PROJECT_SSO_ROUTE,
+        params: { projectId: PROJECT_ID.toString() },
+      });
+
+      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
+
+      if (editionCase.isActive) {
+        expect(projectSsoFind).toHaveBeenCalledWith(
+          expect.objectContaining({
+            query: { projectId: PROJECT_ID, isEnabled: true },
+            props: { isRoot: true },
+          }),
+        );
+      } else {
+        expect(projectSsoFind).not.toHaveBeenCalled();
+      }
+    });
+
+    test(`project OIDC list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+      await invoke({
+        route: PROJECT_OIDC_ROUTE,
+        params: { projectId: PROJECT_ID.toString() },
+      });
+
+      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
+      expect(projectOidcFind).toHaveBeenCalledTimes(
+        editionCase.isActive ? 1 : 0,
+      );
+    });
+
+    test(`status page SSO list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+      await invoke({
+        route: STATUS_PAGE_SSO_ROUTE,
+        params: { statusPageId: STATUS_PAGE_ID.toString() },
+      });
+
+      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
+      expect(statusPageSsoFind).toHaveBeenCalledTimes(
+        editionCase.isActive ? 1 : 0,
+      );
+    });
+
+    test(`status page OIDC list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+      await invoke({
+        route: STATUS_PAGE_OIDC_ROUTE,
+        params: { statusPageId: STATUS_PAGE_ID.toString() },
+      });
+
+      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
+      expect(statusPageOidcFind).toHaveBeenCalledTimes(
+        editionCase.isActive ? 1 : 0,
+      );
+    });
+
+    test(`master page ${editionCase.isActive ? "reports the stored SSO requirement and providers" : "reports no SSO (effective value) and leaves the stored value alone"}`, async () => {
+      const statusPage: StatusPage = new StatusPage();
+      statusPage.id = STATUS_PAGE_ID;
+      statusPage.pageTitle = "Customer Status";
+      statusPage.requireSsoForLogin = true;
+
+      const findStatusPage: SpyInstance = getJestSpyOn(
+        StatusPageService,
+        "findOneById",
+      ).mockResolvedValue(statusPage);
+      getJestSpyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
+      getJestSpyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
+      getJestSpyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(
+        null,
+      );
+
+      await invoke({
+        route: MASTER_PAGE_ROUTE,
+        params: { statusPageId: STATUS_PAGE_ID.toString() },
+      });
+
+      expect(Response.sendJsonObjectResponse).toHaveBeenCalledTimes(1);
+
+      const payload: JSONObject = (Response.sendJsonObjectResponse as jest.Mock)
+        .mock.calls[0]![2] as JSONObject;
+
+      expect((payload["statusPage"] as JSONObject)["requireSsoForLogin"]).toBe(
+        editionCase.isActive,
+      );
+      expect(payload["hasEnabledSSO"]).toBe(editionCase.isActive ? 2 : 0);
+      expect(statusPageSsoCount).toHaveBeenCalledTimes(
+        editionCase.isActive ? 1 : 0,
+      );
+
+      // The stored requirement is still read, never written.
+      expect(findStatusPage).toHaveBeenCalledWith(
+        expect.objectContaining({
+          select: expect.objectContaining({ requireSsoForLogin: true }),
+          props: { isRoot: true },
+        }),
+      );
+    });
+  });
+
+  test("the lists follow the license at request time: empty while lapsed, listed again after renewal", async () => {
+    getJestSpyOn(logger, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+    getJestSpyOn(logger, "info").mockImplementation((): void => {
+      return undefined;
+    });
+
+    const fake: FakeEnterpriseModule = installFakeEnterpriseModule({
+      snapshot: createLicenseSnapshotWithStatus("expired"),
+    });
+
+    await invoke({
+      route: PROJECT_SSO_ROUTE,
+      params: { projectId: PROJECT_ID.toString() },
+    });
+
+    expect(listedItems()).toHaveLength(0);
+    expect(projectSsoFind).not.toHaveBeenCalled();
+
+    fake.setSnapshot(createLicenseSnapshotWithStatus("valid"));
+    (Response.sendEntityArrayResponse as jest.Mock).mockClear();
+
+    await invoke({
+      route: PROJECT_SSO_ROUTE,
+      params: { projectId: PROJECT_ID.toString() },
+    });
+
+    expect(listedItems()).toHaveLength(1);
+    expect(projectSsoFind).toHaveBeenCalledTimes(1);
+  });
+
+  test("the master page reports a page that does not require SSO the same way on both editions", async () => {
+    const statusPage: StatusPage = new StatusPage();
+    statusPage.id = STATUS_PAGE_ID;
+    statusPage.requireSsoForLogin = false;
+
+    getJestSpyOn(StatusPageService, "findOneById").mockResolvedValue(
+      statusPage,
+    );
+    getJestSpyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
+    getJestSpyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
+    getJestSpyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(null);
+
+    installFakeEnterpriseModule();
+
+    await invoke({
+      route: MASTER_PAGE_ROUTE,
+      params: { statusPageId: STATUS_PAGE_ID.toString() },
+    });
+
+    const payload: JSONObject = (Response.sendJsonObjectResponse as jest.Mock)
+      .mock.calls[0]![2] as JSONObject;
+
+    expect((payload["statusPage"] as JSONObject)["requireSsoForLogin"]).toBe(
+      false,
+    );
+  });
+});