@oneuptime/common 13.0.8 → 14.0.0

package/Utils/EnterpriseLicense/EnterpriseLicenseSeats.ts

@@ -1,287 +0,0 @@
-import EnterpriseLicenseInstanceSummary from "../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
-
-/*
- * Everything the seat calculation needs, taken as plain values so this file
- * stays a pure function the tests can drive directly. The server reads these
- * off GlobalConfig; the browser reads them off the /global-config/license
- * response.
- */
-export interface SeatUsageInput {
-  /*
-   * The seat limit mirrored from oneuptime.com. Null, undefined or anything
-   * that is not a positive whole number means "no limit to enforce" — see
-   * getSeatUsage for why zero is included in that.
-   */
-  userLimit?: number | null | undefined;
-
-  /*
-   * Users that exist on THIS installation right now. The live number, counted
-   * at the moment of the check rather than taken from the last daily report,
-   * because the whole point of enforcement is to catch the user who is being
-   * added a second after the report was sent.
-   */
-  localUserCount: number;
-
-  /*
-   * Unique users across every instance sharing this license, as oneuptime.com
-   * last computed it. Up to a day stale, and only meaningful for a customer
-   * running more than one instance on one key.
-   */
-  aggregatedUserCount?: number | null | undefined;
-
-  /*
-   * Per-instance breakdown from the same report. Used only to work out how
-   * much of aggregatedUserCount belongs to OTHER instances.
-   */
-  instances?: Array<EnterpriseLicenseInstanceSummary> | null | undefined;
-
-  // This installation's own instance id, so it can find itself in `instances`.
-  thisInstanceId?: string | null | undefined;
-}
-
-export interface SeatUsage {
-  /*
-   * False when the license carries no usable seat limit. Every other field is
-   * still filled in — a caller that wants to display usage can, it just must
-   * not block anything.
-   */
-  isEnforced: boolean;
-
-  // The limit actually being enforced, or null when there is none.
-  userLimit: number | null;
-
-  /*
-   * The best estimate of how many licensed seats are consumed right now,
-   * across every instance on this license. See getSeatUsage for how it is
-   * derived and which way it is allowed to be wrong.
-   */
-  seatsInUse: number;
-
-  // Null when there is no limit. Never negative — a breach reads as 0 free.
-  seatsRemaining: number | null;
-
-  /*
-   * The single question enforcement asks. True whenever there is no limit, so
-   * a caller can use this on its own without re-checking isEnforced.
-   */
-  hasSeatForNewUser: boolean;
-
-  /*
-   * How many of seatsInUse are users this installation has never seen. Zero
-   * whenever the topology is not known well enough to say, which is the
-   * conservative answer — see getSeatUsage.
-   */
-  seatsUsedByOtherInstances: number;
-}
-
-export default class EnterpriseLicenseSeatsUtil {
-  /*
-   * How many seats are in use, and whether one more user fits.
-   *
-   * The awkward part is that a license is shared by every instance the
-   * customer runs, and only oneuptime.com can deduplicate users across them —
-   * the same person on staging and production is one seat. So this instance
-   * has two numbers and neither one is the answer on its own:
-   *
-   *   localUserCount      live, but blind to the customer's other instances.
-   *   aggregatedUserCount complete, but up to a day old, so it does not know
-   *                       about anyone added since the last daily report —
-   *                       including the user being added right now.
-   *
-   * Combining them needs to know how much of the aggregate is NOT ours, which
-   * is what the per-instance breakdown is for: subtract our own last reported
-   * count from the aggregate and what is left is other instances. Add the live
-   * local count back and the result is current on this instance and complete
-   * on the others.
-   *
-   * When the breakdown does not say — an older license server that sends no
-   * instance list, an instance that has never registered — there is nothing to
-   * subtract, and the fallback is the larger of the two numbers on their own.
-   * That is the only case where the stale aggregate decides anything: with a
-   * usable breakdown it is deliberately NOT maxed in, because it would then
-   * outvote the live count in the one direction that hurts. Free twenty seats
-   * by deleting twenty users and a stale aggregate would go on refusing new
-   * ones until the next daily report.
-   *
-   * Which way it is allowed to be wrong: under-enforcing is recoverable (the
-   * next daily report corrects the count, and the breach emails already go
-   * out), over-enforcing locks a paying customer out of their own instance.
-   * So every "I cannot tell" branch below resolves towards under-enforcing.
-   */
-  public static getSeatUsage(input: SeatUsageInput): SeatUsage {
-    const userLimit: number | null = this.parseUserLimit(input.userLimit);
-    const localUserCount: number = this.parseCount(input.localUserCount) ?? 0;
-    const aggregatedUserCount: number | null = this.parseCount(
-      input.aggregatedUserCount,
-    );
-
-    /*
-     * Null means the report is not complete enough to attribute seats to
-     * anybody, which is a different thing from attributing zero to them.
-     */
-    const otherInstanceSeats: number | null = this.getSeatsUsedByOtherInstances(
-      {
-        aggregatedUserCount: aggregatedUserCount,
-        instances: input.instances,
-        thisInstanceId: input.thisInstanceId,
-      },
-    );
-
-    const seatsUsedByOtherInstances: number = otherInstanceSeats ?? 0;
-
-    const seatsInUse: number =
-      otherInstanceSeats === null
-        ? Math.max(localUserCount, aggregatedUserCount ?? 0)
-        : otherInstanceSeats + localUserCount;
-
-    if (userLimit === null) {
-      return {
-        isEnforced: false,
-        userLimit: null,
-        seatsInUse: seatsInUse,
-        seatsRemaining: null,
-        hasSeatForNewUser: true,
-        seatsUsedByOtherInstances: seatsUsedByOtherInstances,
-      };
-    }
-
-    return {
-      isEnforced: true,
-      userLimit: userLimit,
-      seatsInUse: seatsInUse,
-      seatsRemaining: Math.max(0, userLimit - seatsInUse),
-      hasSeatForNewUser: seatsInUse < userLimit,
-      seatsUsedByOtherInstances: seatsUsedByOtherInstances,
-    };
-  }
-
-  /*
-   * The message an administrator reads when a seat could not be taken. Built
-   * here rather than at each throw site so the invite form, the signup form
-   * and SSO/SCIM provisioning all explain the same thing the same way, and so
-   * the tests can assert on it without copying the wording.
-   */
-  public static getSeatLimitReachedMessage(data: {
-    seatsInUse: number;
-    userLimit: number;
-  }): string {
-    return (
-      `This OneUptime installation has reached the ${data.userLimit.toLocaleString()}-user ` +
-      `limit of its enterprise license (${data.seatsInUse.toLocaleString()} in use). New users ` +
-      `cannot be invited, signed up or provisioned until a seat is freed up or the license is ` +
-      `expanded. Contact sales@oneuptime.com to add seats, then use "Refresh license" in the ` +
-      `edition dialog to apply the new limit.`
-    );
-  }
-
-  /*
-   * The part of the aggregate that belongs to instances other than this one,
-   * or null when the report does not say.
-   *
-   * Null rather than zero, because the two lead somewhere different: zero means
-   * "this installation is the only one holding seats", and null means "the
-   * report cannot be decomposed, fall back to comparing the two totals". Every
-   * missing or unusable field lands on null.
-   *
-   * In particular, an instance list that does not contain us is NOT treated as
-   * "then all of the aggregate is somebody else's". That reading is right for a
-   * genuinely unregistered instance, and catastrophic for an instance whose id
-   * changed after its users were already counted under the old one: it would
-   * count this installation's users twice and lock it out.
-   */
-  private static getSeatsUsedByOtherInstances(data: {
-    aggregatedUserCount: number | null;
-    instances?: Array<EnterpriseLicenseInstanceSummary> | null | undefined;
-    thisInstanceId?: string | null | undefined;
-  }): number | null {
-    const aggregatedUserCount: number | null = data.aggregatedUserCount;
-
-    if (aggregatedUserCount === null) {
-      return null;
-    }
-
-    if (!Array.isArray(data.instances) || data.instances.length === 0) {
-      return null;
-    }
-
-    const thisInstanceId: string =
-      typeof data.thisInstanceId === "string" ? data.thisInstanceId.trim() : "";
-
-    if (!thisInstanceId) {
-      return null;
-    }
-
-    const thisInstance: EnterpriseLicenseInstanceSummary | undefined =
-      data.instances.find(
-        (instance: EnterpriseLicenseInstanceSummary): boolean => {
-          return Boolean(instance) && instance.instanceId === thisInstanceId;
-        },
-      );
-
-    if (!thisInstance) {
-      return null;
-    }
-
-    /*
-     * The active-only aggregate contains none of this installation's stale
-     * reported users. Subtracting that old count would remove users belonging
-     * to active instances and under-enforce the license. Treat the complete
-     * aggregate as other-instance usage. We also cannot add the two counts:
-     * the same users may exist on both this installation and active ones.
-     * Return null to use the existing uncertainty fallback, which takes the
-     * larger complete-or-live total without subtracting or double-counting.
-     *
-     * Undefined retains the legacy behavior for responses from older license
-     * servers that did not send activity provenance.
-     */
-    if (thisInstance.isCountedTowardsUsage === false) {
-      return null;
-    }
-
-    const ownReportedCount: number | null = this.parseCount(
-      thisInstance.userCount,
-    );
-
-    if (ownReportedCount === null) {
-      return null;
-    }
-
-    return Math.max(0, aggregatedUserCount - ownReportedCount);
-  }
-
-  /*
-   * A limit is only a limit when it is a positive whole number.
-   *
-   * Zero is deliberately read as "no limit" rather than "no seats at all",
-   * matching every other place in the product that measures seat usage
-   * (the license modal, the breach notification job). A license that really
-   * grants nobody an account is not a thing OneUptime issues, and reading a
-   * stray zero the other way would leave an installation unable to create even
-   * its first user.
-   */
-  private static parseUserLimit(value: unknown): number | null {
-    if (
-      typeof value !== "number" ||
-      !Number.isFinite(value) ||
-      !Number.isInteger(value) ||
-      value <= 0
-    ) {
-      return null;
-    }
-
-    return value;
-  }
-
-  private static parseCount(value: unknown): number | null {
-    if (
-      typeof value !== "number" ||
-      !Number.isFinite(value) ||
-      !Number.isInteger(value) ||
-      value < 0
-    ) {
-      return null;
-    }
-
-    return value;
-  }
-}

package/Utils/EnterpriseLicense/EnterpriseLicenseSync.ts

@@ -1,244 +0,0 @@
-import GlobalConfig from "../../Models/DatabaseModels/GlobalConfig";
-import PartialEntity from "../../Types/Database/PartialEntity";
-import EnterpriseLicenseInstanceSummary from "../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
-import { JSONObject } from "../../Types/JSON";
-
-export interface EnterpriseLicenseSyncResult {
-  /*
-   * Only the columns the license server actually spoke about. A column the
-   * response did not mention is absent from this object, so updateOneById
-   * leaves whatever is stored alone.
-   */
-  updateData: PartialEntity<GlobalConfig>;
-
-  /*
-   * Fields the server sent in a shape this build cannot use. Returned rather
-   * than logged so this stays a pure function the tests can drive directly;
-   * the caller decides how loud to be about them.
-   */
-  warnings: Array<string>;
-}
-
-/*
- * Maps a license-server response (from /enterprise-license/validate or
- * /enterprise-license/report-user-count) onto the GlobalConfig columns a
- * self-hosted installation mirrors locally.
- *
- * Every field is three-state, and the distinction is the whole contract:
- *
- *   key absent  - the license server did not speak about this field. That is
- *                 what an oneuptime.com older than this build looks like, so
- *                 the stored value is left exactly as it is. Collapsing this
- *                 to null is how a daily report would wipe a perfectly good
- *                 license expiry and take the installation down.
- *   null        - the server explicitly says "there is no value". Written as
- *                 null, so clearing a seat limit on oneuptime.com actually
- *                 clears it on the customer's installation.
- *   a value     - validated, then written.
- *
- * Anything that is neither absent, null, nor a usable value is treated as
- * absent and reported as a warning: a malformed response must never be able
- * to corrupt license state that was correct a moment ago.
- */
-export default class EnterpriseLicenseSyncUtil {
-  /*
-   * The license key is deliberately NOT synced. The installation authenticates
-   * with the key it already holds, and a response must never be able to swap
-   * it for another one.
-   */
-  public static getGlobalConfigUpdateFromLicenseResponse(data: {
-    payload: JSONObject;
-    /*
-     * Used as the "user count as of" stamp when the server reports a count but
-     * no timestamp for it. Passed in rather than read from the clock so the
-     * function stays pure.
-     */
-    reportedAt: Date;
-  }): EnterpriseLicenseSyncResult {
-    const payload: JSONObject = data.payload || {};
-    const updateData: PartialEntity<GlobalConfig> = {};
-    const warnings: Array<string> = [];
-
-    /*
-     * The seat limit. This is the field customers change on oneuptime.com and
-     * then wait for: without it here, buying seats never reaches the
-     * installation that is enforcing the old number.
-     */
-    if (this.isPresent(payload, "userLimit")) {
-      const rawUserLimit: unknown = payload["userLimit"];
-
-      if (rawUserLimit === null) {
-        updateData.enterpriseLicenseUserLimit = null;
-      } else if (this.isNonNegativeInteger(rawUserLimit)) {
-        updateData.enterpriseLicenseUserLimit = rawUserLimit as number;
-      } else {
-        warnings.push(
-          `Ignored userLimit "${String(
-            rawUserLimit,
-          )}" from the license server: it is not a non-negative whole number.`,
-        );
-      }
-    }
-
-    /*
-     * The count and its timestamp move together: a count with a stamp from a
-     * previous report would read as "confirmed today", which is the exact
-     * lie this whole sync exists to stop telling.
-     */
-    if (this.isPresent(payload, "currentUserCount")) {
-      const rawUserCount: unknown = payload["currentUserCount"];
-
-      if (this.isNonNegativeInteger(rawUserCount)) {
-        updateData.enterpriseLicenseCurrentUserCount = rawUserCount as number;
-        updateData.enterpriseLicenseUserCountUpdatedAt =
-          this.parseDate(payload["userCountUpdatedAt"]) || data.reportedAt;
-      } else if (rawUserCount === null) {
-        /*
-         * The server has never had a count for this license. Nothing useful to
-         * store, and blanking the last known count would be worse than keeping
-         * it, so leave both columns alone.
-         */
-        warnings.push(
-          "The license server reported no user count for this license. Keeping the previously stored usage.",
-        );
-      } else {
-        warnings.push(
-          `Ignored currentUserCount "${String(
-            rawUserCount,
-          )}" from the license server: it is not a non-negative whole number. Keeping the previously stored usage.`,
-        );
-      }
-    }
-
-    /*
-     * Expiry drives licenseValid on the installation, so a renewal that never
-     * arrives here shows up as a license that expires on its original date
-     * however much the customer paid. Null is treated as absent on purpose: a
-     * report is not the place to strip an installation of its expiry.
-     */
-    if (this.isPresent(payload, "expiresAt") && payload["expiresAt"] !== null) {
-      const expiresAt: Date | null = this.parseDate(payload["expiresAt"]);
-
-      if (expiresAt) {
-        updateData.enterpriseLicenseExpiresAt = expiresAt;
-      } else {
-        warnings.push(
-          `Ignored expiresAt "${String(
-            payload["expiresAt"],
-          )}" from the license server: it is not a date.`,
-        );
-      }
-    }
-
-    if (this.isPresent(payload, "isEvaluationLicense")) {
-      const rawIsEvaluation: unknown = payload["isEvaluationLicense"];
-
-      if (typeof rawIsEvaluation === "boolean") {
-        updateData.enterpriseLicenseIsEvaluation = rawIsEvaluation;
-      } else {
-        warnings.push(
-          `Ignored isEvaluationLicense "${String(
-            rawIsEvaluation,
-          )}" from the license server: it is not a boolean.`,
-        );
-      }
-    }
-
-    if (this.isPresent(payload, "companyName")) {
-      const companyName: string = this.parseNonEmptyString(
-        payload["companyName"],
-      );
-
-      /*
-       * An empty company name is what the server sends for a license with none
-       * set, and overwriting a good name with "" would be a visible regression
-       * in the modal. Only a real name is worth writing.
-       */
-      if (companyName) {
-        updateData.enterpriseCompanyName = companyName;
-      }
-    }
-
-    /*
-     * The token is opaque here - it is signed with the license server's secret
-     * and this side only checks that it exists. It is never cleared: a license
-     * that has expired is legitimately issued no token, and clearing it on the
-     * way past would compound an expiry the customer may be about to renew.
-     */
-    if (this.isPresent(payload, "token")) {
-      const token: string = this.parseNonEmptyString(payload["token"]);
-
-      if (token) {
-        updateData.enterpriseLicenseToken = token;
-      }
-    }
-
-    if (this.isPresent(payload, "instances")) {
-      const rawInstances: unknown = payload["instances"];
-
-      if (Array.isArray(rawInstances)) {
-        updateData.enterpriseLicenseInstances =
-          rawInstances as Array<EnterpriseLicenseInstanceSummary>;
-      } else {
-        warnings.push(
-          "Ignored the instance list from the license server: it is not an array.",
-        );
-      }
-    }
-
-    return {
-      updateData: updateData,
-      warnings: warnings,
-    };
-  }
-
-  /*
-   * Present means the key is on the object, even when it carries null or
-   * undefined. `"x" in payload` rather than a truthiness or undefined check,
-   * because "the server said null" and "the server said nothing" have to stay
-   * distinguishable all the way down.
-   */
-  private static isPresent(payload: JSONObject, key: string): boolean {
-    if (!Object.prototype.hasOwnProperty.call(payload, key)) {
-      return false;
-    }
-
-    // An explicit undefined is indistinguishable from silence. Treat it as one.
-    return payload[key] !== undefined;
-  }
-
-  private static isNonNegativeInteger(value: unknown): boolean {
-    return (
-      typeof value === "number" &&
-      Number.isFinite(value) &&
-      Number.isInteger(value) &&
-      value >= 0
-    );
-  }
-
-  private static parseNonEmptyString(value: unknown): string {
-    if (typeof value !== "string") {
-      return "";
-    }
-
-    return value.trim();
-  }
-
-  private static parseDate(value: unknown): Date | null {
-    if (value instanceof Date) {
-      return Number.isNaN(value.getTime()) ? null : value;
-    }
-
-    if (typeof value !== "string" || !value.trim()) {
-      return null;
-    }
-
-    const parsed: Date = new Date(value.trim());
-
-    if (Number.isNaN(parsed.getTime())) {
-      return null;
-    }
-
-    return parsed;
-  }
-}