@oneuptime/common 13.0.8 → 14.0.0

package/Server/Services/RumSessionPinService.ts

@@ -162,12 +162,31 @@ export class Service extends DatabaseService<Model> {
     this.assertCallerMayCreatePins(createBy.props);
 
     if (!isInternalCaller(createBy.props)) {
-      /* The database keeps these for itself; a request does not set them. */
-      delete createBy.data._id;
-      delete createBy.data.createdAt;
-      delete createBy.data.updatedAt;
-      delete createBy.data.deletedAt;
-      delete createBy.data.version;
+      /*
+       * The database keeps these for itself; a request does not set them.
+       *
+       * Cleared rather than deleted: `createBy.data` is a live model instance,
+       * and the column-metadata lookups downstream used to enumerate the own
+       * keys of whichever instance reached them first and cache that as the
+       * CLASS's column list - so deleting `_id` off this instance taught the
+       * whole process that RumSessionPin has no id, and every later response
+       * for it lost one. TableColumn.ts no longer reads the caller's instance
+       * (see CanonicalModelInstance.ts), so this is defence in depth. An
+       * unset column holds `undefined` anyway, which TypeORM and the write
+       * path treat exactly as an absent key - the save is still an INSERT.
+       */
+      const databaseManagedColumns: Array<string> = [
+        "_id",
+        "createdAt",
+        "updatedAt",
+        "deletedAt",
+        "version",
+      ];
+
+      for (const columnName of databaseManagedColumns) {
+        (createBy.data as unknown as Record<string, unknown>)[columnName] =
+          undefined;
+      }
     }
 
     const pinKey: PinKey | null = this.resolvePinKey(createBy);

package/Server/Services/StatusPagePrivateUserService.ts

@@ -1,8 +1,10 @@
+import crypto from "crypto";
 import DatabaseConfig from "../DatabaseConfig";
 import { EncryptionSecret } from "../EnvironmentConfig";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 import logger from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import MailService from "./MailService";
@@ -19,7 +21,6 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import Email from "../../Types/Email";
 import HashedString from "../../Types/HashedString";
 import BadDataException from "../../Types/Exception/BadDataException";
-import ObjectID from "../../Types/ObjectID";
 import StatusPage from "../../Models/DatabaseModels/StatusPage";
 import Model from "../../Models/DatabaseModels/StatusPagePrivateUser";
 
@@ -189,8 +190,10 @@ export class Service extends DatabaseService<Model> {
     /*
      * SCIM and admin-created users must follow the page's login policy too.
      * Do not create a password-reset credential when only SSO can be used.
+     * On the Community Edition there is no SSO login for status pages, so a
+     * leftover requirement is not enforced and the user gets a password link.
      */
-    if (statusPage.requireSsoForLogin) {
+    if (EditionEnforcement.isSsoRequired(statusPage.requireSsoForLogin)) {
       return createdItem;
     }
 
@@ -206,7 +209,8 @@ export class Service extends DatabaseService<Model> {
      * Same split as `/status-page-api/forgot-password`: the digest is
      * persisted, the raw token is only ever mailed.
      */
-    const token: string = ObjectID.generate().toString();
+    // A bearer secret: from the CSPRNG, never ObjectID's non-crypto fallback.
+    const token: string = crypto.randomUUID();
     const hashedToken: string = await HashedString.hashValue(
       token,
       EncryptionSecret,

package/Server/Services/StatusPageService.ts

@@ -1,9 +1,10 @@
 import DatabaseConfig from "../DatabaseConfig";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import CookieUtil from "../Utils/Cookie";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 import { ExpressRequest } from "../Utils/Express";
 import JSONWebToken from "../Utils/JsonWebToken";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -65,6 +66,7 @@ import OneUptimeDate from "../../Types/Date";
 import IncidentService from "./IncidentService";
 import MonitorStatusTimeline from "../../Models/DatabaseModels/MonitorStatusTimeline";
 import MonitorStatusTimelineService from "./MonitorStatusTimelineService";
+import { UptimeDailyAggregate } from "../../Types/StatusPage/UptimeDailyAggregate";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import UptimeUtil, { UptimeWindow } from "../../Utils/Uptime/UptimeUtil";
 import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
@@ -104,6 +106,14 @@ export {
   StatusPageReportRow,
 };
 
+/*
+ * The status page column that holds its SSO requirement: the one
+ * onFindSuccess masks and onBeforeUpdate guards while SSO is not active.
+ */
+export const STATUS_PAGE_SSO_REQUIREMENT_COLUMNS: ReadonlyArray<string> = [
+  "requireSsoForLogin",
+];
+
 export class Service extends DatabaseService<StatusPage> {
   /*
    * Caches the resolved status page URL per statusPageId. `getStatusPageURL`
@@ -268,6 +278,36 @@ export class Service extends DatabaseService<StatusPage> {
     return this.getDefaultEmailFooterText();
   }
 
+  /*
+   * While SSO is not active a status page's SSO requirement is not enforced:
+   * on the Community Edition (status page SSO login is part of the
+   * Enterprise Edition), and on an Enterprise install whose license is
+   * lapsed or does not include SSO (the SSO routes refuse). Reads made for a
+   * caller then report the EFFECTIVE value: not required. Internal (root)
+   * reads and the stored row keep the real value, and onBeforeUpdate keeps a
+   * caller from writing the masked value back, so running the Enterprise
+   * Edition with a valid license (or in its trial or grace period) again
+   * restores enforcement exactly as configured. The public master-page route
+   * reads as root and applies the same rule itself.
+   */
+  @CaptureSpan()
+  protected override async onFindSuccess(
+    onFind: OnFind<StatusPage>,
+    items: Array<StatusPage>,
+  ): Promise<OnFind<StatusPage>> {
+    if (
+      EditionEnforcement.shouldMaskSsoRequirementOnRead(onFind.findBy.props)
+    ) {
+      for (const item of items) {
+        if (item.requireSsoForLogin !== undefined) {
+          item.requireSsoForLogin = false;
+        }
+      }
+    }
+
+    return { ...onFind, carryForward: items };
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<StatusPage>,
@@ -763,6 +803,32 @@ export class Service extends DatabaseService<StatusPage> {
     return false;
   }
 
+  /**
+   * Per-monitor, per-day status durations for this status page's bars.
+   *
+   * This is what the uptime bars are painted from. It exists because the raw
+   * row fetch below is capped at LIMIT_MAX across EVERY monitor on the page,
+   * sorted newest-first - a bound that silently destroyed history. Measured
+   * on a real page: 254,550 rows matched the window, 10,000 came back, and
+   * three flapping monitors held 9,995 of those slots, starving the quiet
+   * monitors out entirely. See MonitorStatusTimelineService for the full
+   * account and for the traps in the SQL.
+   */
+  @CaptureSpan()
+  public async getUptimeDailyAggregateForStatusPage(data: {
+    monitorIds: Array<ObjectID>;
+    startDate: Date;
+    endDate: Date;
+    timezone?: string | undefined;
+  }): Promise<UptimeDailyAggregate> {
+    return await MonitorStatusTimelineService.getDailyUptimeAggregate({
+      monitorIds: data.monitorIds,
+      startDate: data.startDate,
+      endDate: data.endDate,
+      timezone: data.timezone,
+    });
+  }
+
   @CaptureSpan()
   public async getMonitorStatusTimelineForStatusPage(data: {
     monitorIds: Array<ObjectID>;
@@ -991,6 +1057,17 @@ export class Service extends DatabaseService<StatusPage> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<StatusPage>,
   ): Promise<OnUpdate<StatusPage>> {
+    /*
+     * While SSO is not active this caller only ever read the requirement as
+     * off (see onFindSuccess), so a write of it must not switch the stored
+     * requirement off, or set one nobody could see. Drops or refuses it.
+     */
+    EditionEnforcement.guardSsoRequirementWrite({
+      props: updateBy.props,
+      data: updateBy.data as unknown as Record<string, unknown>,
+      columns: STATUS_PAGE_SSO_REQUIREMENT_COLUMNS,
+    });
+
     // is enabling SMS subscribers.
 
     if (updateBy.data.enableSmsSubscribers) {

package/Server/Services/TeamMemberService.ts

@@ -8,6 +8,7 @@ import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Select from "../Types/Database/Select";
 import UpdateBy from "../Types/Database/UpdateBy";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 import Errors from "../Utils/Errors";
 import logger, { LogAttributes } from "../Utils/Logger";
 import ProductAnalytics from "../Utils/ProductAnalytics";
@@ -89,8 +90,18 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     super(TeamMember);
   }
 
+  /*
+   * Whether SCIM Push Groups owns this project's team membership, which locks
+   * member invites and removals made from OneUptime and lifts the one-member
+   * guard. Never on the Community Edition: it serves no SCIM endpoint, so a
+   * leftover Push Groups setting there would leave teams nobody can manage.
+   */
   @CaptureSpan()
   private async isSCIMPushGroupsEnabled(projectId: ObjectID): Promise<boolean> {
+    if (!EditionEnforcement.areScimTeamLocksEnforced()) {
+      return false;
+    }
+
     const count: PositiveNumber = await ProjectSCIMService.countBy({
       query: {
         projectId: projectId,

package/Server/Services/TeamService.ts

@@ -14,6 +14,7 @@ import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import TeamMemberService from "./TeamMemberService";
 import ProjectSCIMService from "./ProjectSCIMService";
 import ModelPermission from "../Types/Database/Permissions/Index";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -61,6 +62,15 @@ export class Service extends DatabaseService<Model> {
       return;
     }
 
+    /*
+     * The lock exists because the identity provider owns the teams while
+     * Push Groups is on. The Community Edition serves no SCIM endpoint, so
+     * nothing could manage them there: a leftover lock is not enforced.
+     */
+    if (!EditionEnforcement.areScimTeamLocksEnforced()) {
+      return;
+    }
+
     const uniqueProjectIds: Map<string, ObjectID> = new Map();
 
     for (const projectId of data.projectIds) {

package/Server/Services/UserService.ts

@@ -1,3 +1,4 @@
+import crypto from "crypto";
 import DatabaseConfig from "../DatabaseConfig";
 import {
   EncryptionSecret,
@@ -59,7 +60,7 @@ import Name from "../../Types/Name";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Timezone from "../../Types/Timezone";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
-import EnterpriseLicenseSeatUtil from "../Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil";
+import EnterpriseEdition from "../Enterprise/EnterpriseEdition";
 
 /*
  * Names the Redis mutex that serializes the first-Master-Admin election across
@@ -195,22 +196,13 @@ export class Service extends DatabaseService<Model> {
      *
      * No isRoot exemption on purpose — invitations create the invited user as
      * root, so exempting root would exempt invitations, which is the exact
-     * thing this is here to bound. It is a no-op on Community Edition and on
-     * oneuptime.com (see EnterpriseLicenseSeatUtil.isSeatLimitEnforceable),
-     * and it never counts the User table on a licence with no seat limit.
+     * thing this is here to bound. The limit itself belongs to the Enterprise
+     * license client (ee/Server/License): this is a no-op on the Community
+     * Edition, on oneuptime.com (billing enabled) and whenever the license is
+     * not valid or in grace, and it never counts the User table on a license
+     * with no seat limit.
      */
-    await EnterpriseLicenseSeatUtil.assertSeatAvailableForNewUser({
-      getLocalUserCount: async (): Promise<number> => {
-        const userCount: PositiveNumber = await this.countBy({
-          query: {},
-          props: {
-            isRoot: true,
-          },
-        });
-
-        return userCount.toNumber();
-      },
-    });
+    await EnterpriseEdition.assertSeatAvailableForNewUser();
 
     /*
      * clickIds / firstTouchAttribution are publicly creatable jsonb columns
@@ -1310,7 +1302,8 @@ export class Service extends DatabaseService<Model> {
       );
     }
 
-    const token: string = ObjectID.generate().toString();
+    // A bearer secret: from the CSPRNG, never ObjectID's non-crypto fallback.
+    const token: string = crypto.randomUUID();
 
     const hashedToken: string = await HashedString.hashValue(
       token,

package/Server/Types/Database/Permissions/CreatePermission.ts

@@ -1,5 +1,6 @@
 import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
 import ColumnPermissions from "./ColumnPermission";
+import EditionPermissions from "./EditionPermission";
 import TablePermission from "./TablePermission";
 import TenantPermission from "./TenantPermission";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
@@ -15,6 +16,20 @@ export default class CreatePermission {
     data: TBaseModel,
     props: DatabaseCommonInteractionProps,
   ): void {
+    /*
+     * Master admins skip every table-level check below, but not the edition
+     * check: creating enterprise configuration (global SSO/OIDC providers
+     * are only ever created by master admins) needs the license for them
+     * too. Everyone else gets the same check through TablePermission.
+     */
+    if (props.isMasterAdmin && !props.isRoot) {
+      EditionPermissions.checkEditionPermissions(
+        modelType,
+        props,
+        DatabaseRequestType.Create,
+      );
+    }
+
     // If system is making this query then let the query run!
     if (props.isRoot || props.isMasterAdmin) {
       return;

package/Server/Types/Database/Permissions/EditionPermission.ts

@@ -1,46 +1,236 @@
-import {
-  IsBillingEnabled,
-  IsEnterpriseEdition,
-} from "../../../../Server/EnvironmentConfig";
+import { IsBillingEnabled } from "../../../../Server/EnvironmentConfig";
+import EnterpriseEdition from "../../../Enterprise/EnterpriseEdition";
+import EnterpriseFeature, {
+  ALL_ENTERPRISE_FEATURES,
+} from "../../../Enterprise/EnterpriseFeature";
+import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
 import BaseModel, {
   DatabaseBaseModelType,
 } from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
-import PaymentRequiredException from "../../../../Types/Exception/PaymentRequiredException";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 
+// Whether one column value of an update can only tighten security.
+export type TightenOnlyColumnRule = (value: unknown) => boolean;
+
+/*
+ * Switching an identity provider off (isEnabled: false). Switching one on is
+ * configuration and needs the license; only the literal false counts, so a
+ * value the database might coerce ("false", 0) is judged by the full check.
+ */
+const isSwitchingOff: TightenOnlyColumnRule = (value: unknown): boolean => {
+  return value === false;
+};
+
+/*
+ * The shortest SCIM bearer token a rotation may set without the license. The
+ * Dashboard's "Reset token" generates a UUID (36 characters) and services
+ * default to one, so this only turns away a token short enough to be weaker
+ * than the one it replaces.
+ */
+export const MIN_ROTATED_SCIM_BEARER_TOKEN_LENGTH: number = 32;
+
+// Replacing a (possibly leaked) SCIM bearer token with a new, long one.
+const isRotatedBearerToken: TightenOnlyColumnRule = (
+  value: unknown,
+): boolean => {
+  return (
+    typeof value === "string" &&
+    value.trim().length >= MIN_ROTATED_SCIM_BEARER_TOKEN_LENGTH
+  );
+};
+
+/*
+ * The updates an administrator may make to enterprise configuration while
+ * the feature is unavailable, because they can only tighten security: the
+ * incident-response moves. Keyed by table name, like the facade's feature
+ * map; a model that is not listed has none.
+ *
+ *   isEnabled: false   disable an SSO/OIDC provider (project, status page or
+ *                      global), or a global provider's attachment to a
+ *                      project.
+ *   bearerToken        rotate a leaked SCIM bearer token.
+ *
+ * TeamComplianceSetting has no entry: switching a compliance rule off
+ * relaxes it.
+ */
+const TIGHTEN_ONLY_UPDATES: ReadonlyMap<
+  string,
+  Readonly<Record<string, TightenOnlyColumnRule>>
+> = new Map<string, Readonly<Record<string, TightenOnlyColumnRule>>>([
+  ["GlobalSSO", { isEnabled: isSwitchingOff }],
+  ["GlobalOIDC", { isEnabled: isSwitchingOff }],
+  ["GlobalSSOProject", { isEnabled: isSwitchingOff }],
+  ["GlobalOIDCProject", { isEnabled: isSwitchingOff }],
+  ["ProjectSSO", { isEnabled: isSwitchingOff }],
+  ["ProjectOIDC", { isEnabled: isSwitchingOff }],
+  ["StatusPageSSO", { isEnabled: isSwitchingOff }],
+  ["StatusPageOIDC", { isEnabled: isSwitchingOff }],
+  ["ProjectSCIM", { bearerToken: isRotatedBearerToken }],
+  ["StatusPageSCIM", { bearerToken: isRotatedBearerToken }],
+]);
+
 export default class EditionPermissions {
   /*
-   * Gates models marked with @TableEditionAccessControl({ requiresEnterprise: true }).
+   * Gates the enterprise CONFIGURATION models, the ones marked with
+   * @TableEditionAccessControl({ requiresEnterprise: true }): project, global
+   * and status page SSO/OIDC providers, SCIM configurations and team
+   * compliance settings.
    *
-   * On self-hosted builds (billing disabled) the model is only accessible when
-   * the binary was built as the Enterprise Edition (IS_ENTERPRISE_EDITION=true).
+   * Only creating and updating them needs the license. Reading and deleting
+   * are always allowed, so an install that dropped to the Community Edition,
+   * or whose license lapsed, can still see what it has configured and remove
+   * it. Only configuration is gated here, and none of it is ever deleted.
+   * Whether what exists RUNS is decided at runtime by
+   * EnterpriseEdition.isFeatureActive: SSO, SCIM and audit logging stop while
+   * a self-hosted license is lapsed and resume when a license is activated.
    *
-   * On the cloud / billing-enabled deployment we leave enforcement to
-   * BillingPermission — it already gates these models via the model's
-   * @TableBillingAccessControl plan tier, so a second check would be redundant.
+   * The one kind of update that needs no license either is a TIGHTEN-ONLY
+   * update (see TIGHTEN_ONLY_UPDATES): every column it writes is on the
+   * model's list with a value that can only tighten security - disabling an
+   * identity provider, rotating a leaked SCIM bearer token. A lapsed license
+   * must never stand between an administrator and those moves during an
+   * incident. The same holds on the Community Edition, deliberately and for
+   * the same reason reads and deletes do: the move can only reduce what the
+   * configuration allows, and a provider disabled (or a token rotated) there
+   * stays so when the install returns to the Enterprise Edition, instead of
+   * coming back live. Anything else in the same update - even one more
+   * column - makes it an ordinary update, which needs the license.
+   *
+   * `updateData` is what the update writes. Only UpdatePermission, which has
+   * it, passes it; without it an update is judged by the full check (fail
+   * closed). TablePermission leaves updates to UpdatePermission for that
+   * reason.
+   *
+   * Master admins are subject to this check - Create/UpdatePermission call it
+   * before their master-admin early return - because the global SSO/OIDC
+   * models are only ever written by master admins and would otherwise never
+   * be gated. Internal root writes (props.isRoot) are never checked.
+   *
+   * On the cloud / billing-enabled deployment enforcement is left to
+   * BillingPermission: it already gates these models by the plan tier in
+   * their @TableBillingAccessControl, so a second check would be redundant.
+   *
+   * Deliberately synchronous. TablePermission and CreatePermission are
+   * synchronous and their callers do not await them, so an async check with a
+   * missed await would turn the refusal into an unhandled rejection and let
+   * the write through. The license is read from the enterprise module's
+   * cached snapshot, and an unknown snapshot refuses the write (fail closed).
    */
   @CaptureSpan()
   public static checkEditionPermissions(
     modelType: DatabaseBaseModelType,
-    _props: DatabaseCommonInteractionProps,
+    props: DatabaseCommonInteractionProps,
+    operation: DatabaseRequestType,
+    updateData?: unknown,
   ): void {
     if (IsBillingEnabled) {
       return;
     }
 
+    if (props.isRoot) {
+      return;
+    }
+
+    if (
+      operation !== DatabaseRequestType.Create &&
+      operation !== DatabaseRequestType.Update
+    ) {
+      return;
+    }
+
     const model: BaseModel = new modelType();
 
     if (!model.requiresEnterprise) {
       return;
     }
 
-    if (!IsEnterpriseEdition) {
-      throw new PaymentRequiredException(
-        `${model.singularName || "This feature"} is only available on the OneUptime Enterprise Edition. ` +
-          `Please switch to the Enterprise Edition build to enable this feature. ` +
-          `See https://oneuptime.com/enterprise/overview for details.`,
-      );
+    if (
+      operation === DatabaseRequestType.Update &&
+      EditionPermissions.isTightenOnlyUpdate(model.tableName, updateData)
+    ) {
+      return;
+    }
+
+    const feature: EnterpriseFeature | null =
+      EnterpriseEdition.getModelFeature(modelType);
+
+    if (feature) {
+      EnterpriseEdition.assertFeatureAvailableSync(feature);
+      return;
+    }
+
+    /*
+     * An enterprise model the facade has no feature for (its guard test
+     * should make this impossible). Fail closed: only a license entitled to
+     * every enterprise feature may configure it.
+     */
+    for (const enterpriseFeature of ALL_ENTERPRISE_FEATURES) {
+      EnterpriseEdition.assertFeatureAvailableSync(enterpriseFeature);
+    }
+  }
+
+  /*
+   * True when the update writes at least one column, and every column it
+   * writes is on the table's tighten-only list with a value that passes the
+   * column's rule. Columns set to undefined are not written and are ignored.
+   * Anything that is not a plain object of columns is not tighten-only.
+   */
+  public static isTightenOnlyUpdate(
+    tableName: string | null | undefined,
+    updateData: unknown,
+  ): boolean {
+    const rules: Readonly<Record<string, TightenOnlyColumnRule>> | undefined =
+      tableName ? TIGHTEN_ONLY_UPDATES.get(tableName) : undefined;
+
+    if (!rules) {
+      return false;
+    }
+
+    if (
+      !updateData ||
+      typeof updateData !== "object" ||
+      Array.isArray(updateData)
+    ) {
+      return false;
     }
+
+    const writtenColumns: Array<[string, unknown]> = Object.entries(
+      updateData as Record<string, unknown>,
+    ).filter(([, value]: [string, unknown]): boolean => {
+      return value !== undefined;
+    });
+
+    if (writtenColumns.length === 0) {
+      return false;
+    }
+
+    return writtenColumns.every(
+      ([column, value]: [string, unknown]): boolean => {
+        const rule: TightenOnlyColumnRule | undefined =
+          Object.prototype.hasOwnProperty.call(rules, column)
+            ? rules[column]
+            : undefined;
+
+        return Boolean(rule && rule(value));
+      },
+    );
+  }
+
+  // The tables with tighten-only updates, and their columns (for guard tests).
+  public static getTightenOnlyColumns(): ReadonlyMap<
+    string,
+    ReadonlyArray<string>
+  > {
+    const columns: Map<string, ReadonlyArray<string>> = new Map<
+      string,
+      ReadonlyArray<string>
+    >();
+
+    for (const [tableName, rules] of TIGHTEN_ONLY_UPDATES) {
+      columns.set(tableName, Object.keys(rules));
+    }
+
+    return columns;
   }
 }

package/Server/Types/Database/Permissions/TablePermission.ts

@@ -57,10 +57,17 @@ export default class TablePermission {
     BillingPermissions.checkBillingPermissions(modelType, props, type);
 
     /*
-     * 3rd CHECK: Is this an enterprise-only feature being accessed on the
-     * community self-hosted build?
+     * 3rd CHECK: Is this a create of enterprise configuration that the
+     * edition or the license does not allow? (Reads and deletes always pass.)
+     * Updates are checked by UpdatePermission.checkUpdatePermissions instead,
+     * which every update runs and which sees what the update writes: an
+     * update that only tightens security (disabling an identity provider,
+     * rotating a SCIM token) needs no license, and this check, which is not
+     * handed the data, could only refuse it.
      */
-    EditionPermissions.checkEditionPermissions(modelType, props);
+    if (type !== DatabaseRequestType.Update) {
+      EditionPermissions.checkEditionPermissions(modelType, props, type);
+    }
 
     // 4th CHECK: Does user have access to CRUD data on this model.
     const userPermissions: Array<UserPermission> =

package/Server/Types/Database/Permissions/UpdatePermission.ts

@@ -3,6 +3,7 @@ import Query from "../Query";
 import AccessControlUtil from "./AccessControlPermission";
 import BasePermission, { CheckPermissionBaseInterface } from "./BasePermission";
 import ColumnPermissions from "./ColumnPermission";
+import EditionPermissions from "./EditionPermission";
 import TablePermission from "./TablePermission";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
@@ -35,6 +36,27 @@ export default class UpdatePermission {
     data: QueryDeepPartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    /*
+     * The edition check for updates runs here, the one permission entry
+     * point that sees what the update writes: an update that only tightens
+     * security (disabling an identity provider, rotating a SCIM token) needs
+     * no license, anything else does (see EditionPermission). TablePermission
+     * leaves updates to this method for that reason.
+     *
+     * Master admins skip every table-level check below, but not the edition
+     * check: changing enterprise configuration (global SSO/OIDC providers are
+     * only ever edited by master admins) needs the license for them too.
+     * Everyone else gets it right after the table-level check.
+     */
+    if (props.isMasterAdmin && !props.isRoot) {
+      EditionPermissions.checkEditionPermissions(
+        modelType,
+        props,
+        DatabaseRequestType.Update,
+        data,
+      );
+    }
+
     if (props.isRoot || props.isMasterAdmin) {
       // If system is making this query then let the query run!
       return query;
@@ -46,6 +68,13 @@ export default class UpdatePermission {
       DatabaseRequestType.Update,
     );
 
+    EditionPermissions.checkEditionPermissions(
+      modelType,
+      props,
+      DatabaseRequestType.Update,
+      data,
+    );
+
     const checkBasePermission: CheckPermissionBaseInterface<TBaseModel> =
       await BasePermission.checkPermissions(
         modelType,