@oneuptime/common 13.0.8 → 14.0.0

package/Tests/Server/API/SsoProviderListingsEdition.test.ts

@@ -0,0 +1,432 @@
+import ProjectOidcAPI from "../../../Server/API/ProjectOIDC";
+import ProjectSsoAPI from "../../../Server/API/ProjectSSO";
+import StatusPageAPI from "../../../Server/API/StatusPageAPI";
+import ProjectOidcService from "../../../Server/Services/ProjectOidcService";
+import ProjectSsoService from "../../../Server/Services/ProjectSsoService";
+import StatusPageDomainService from "../../../Server/Services/StatusPageDomainService";
+import StatusPageFooterLinkService from "../../../Server/Services/StatusPageFooterLinkService";
+import StatusPageHeaderLinkService from "../../../Server/Services/StatusPageHeaderLinkService";
+import StatusPageOidcService from "../../../Server/Services/StatusPageOidcService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import StatusPageSsoService from "../../../Server/Services/StatusPageSsoService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import ProjectOIDC from "../../../Models/DatabaseModels/ProjectOidc";
+import ProjectSSO from "../../../Models/DatabaseModels/ProjectSso";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import StatusPageOIDC from "../../../Models/DatabaseModels/StatusPageOidc";
+import StatusPageSSO from "../../../Models/DatabaseModels/StatusPageSso";
+import FakeEnterpriseModule, {
+  createEditionStateCases,
+  createLicenseSnapshotWithStatus,
+  EditionStateCase,
+  installFakeEnterpriseModule,
+  uninstallEnterpriseModule,
+} from "../Enterprise/FakeEnterpriseModule";
+import { setTestBillingEnabled } from "../Enterprise/TestBillingFlag";
+import { getJestSpyOn } from "../../Spy";
+import { mockRouter } from "./Helpers";
+import logger from "../../../Server/Utils/Logger";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+type SpyInstance = ReturnType<typeof getJestSpyOn>;
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  const billingFlag: typeof import("../Enterprise/TestBillingFlag") =
+    jest.requireActual(
+      "../Enterprise/TestBillingFlag",
+    ) as typeof import("../Enterprise/TestBillingFlag");
+
+  return billingFlag.withLiveBillingFlag(
+    jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >,
+  );
+});
+
+/*
+ * The provider lists that sign-in pages offer, and the status page's own
+ * "should I force SSO / offer SSO" flags.
+ *
+ * The SAML/OIDC login routes answer only while SSO is ACTIVE
+ * (EnterpriseEdition.isFeatureActive(SSO), through EditionEnforcement): the
+ * Enterprise Edition with billing on, or with a license that covers SSO
+ * (valid, grace, trial), or while the license state is unknown. So:
+ *   - SSO active: providers are listed as configured, and a status page's
+ *     SSO requirement is reported.
+ *   - SSO not active - the Community Edition, or an Enterprise install whose
+ *     license lapsed: every list is empty and the status page reports no SSO,
+ *     so no client sends a user into a route that answers 404 or refuses.
+ *     Nothing is even read from the provider tables.
+ *
+ * Billing and the edition are pinned in every test. This suite runs without
+ * ee/: it uses the fake enterprise module only.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const STATUS_PAGE_ID: ObjectID = new ObjectID(
+  "77777777-7777-4777-8777-777777777777",
+);
+
+const PROJECT_SSO_ROUTE: string = `${new ProjectSSO()
+  .getCrudApiPath()
+  ?.toString()}/:projectId/sso-list`;
+const PROJECT_OIDC_ROUTE: string = `${new ProjectOIDC()
+  .getCrudApiPath()
+  ?.toString()}/:projectId/oidc-list`;
+const STATUS_PAGE_SSO_ROUTE: string = "/status-page/sso/:statusPageId";
+const STATUS_PAGE_OIDC_ROUTE: string = "/status-page/oidc/:statusPageId";
+const MASTER_PAGE_ROUTE: string = "/status-page/master-page/:statusPageId";
+
+const EDITION_CASES: Array<EditionStateCase> = createEditionStateCases();
+
+const buildProjectSso: () => ProjectSSO = (): ProjectSSO => {
+  const sso: ProjectSSO = new ProjectSSO();
+  sso._id = ObjectID.generate().toString();
+  sso.name = "Okta";
+  return sso;
+};
+
+const buildProjectOidc: () => ProjectOIDC = (): ProjectOIDC => {
+  const oidc: ProjectOIDC = new ProjectOIDC();
+  oidc._id = ObjectID.generate().toString();
+  oidc.name = "Entra ID";
+  return oidc;
+};
+
+const buildStatusPageSso: () => StatusPageSSO = (): StatusPageSSO => {
+  const sso: StatusPageSSO = new StatusPageSSO();
+  sso._id = ObjectID.generate().toString();
+  sso.name = "Okta";
+  return sso;
+};
+
+const buildStatusPageOidc: () => StatusPageOIDC = (): StatusPageOIDC => {
+  const oidc: StatusPageOIDC = new StatusPageOIDC();
+  oidc._id = ObjectID.generate().toString();
+  oidc.name = "Entra ID";
+  return oidc;
+};
+
+const invoke: (data: {
+  route: string;
+  params: Record<string, string>;
+}) => Promise<void> = async (data: {
+  route: string;
+  params: Record<string, string>;
+}): Promise<void> => {
+  const headers: Record<string, string> = { host: "app.example.com" };
+
+  const req: ExpressRequest = {
+    params: data.params,
+    query: {},
+    body: {},
+    cookies: {},
+    headers,
+    get: (name: string): string | undefined => {
+      return headers[name.toLowerCase()];
+    },
+    socket: {},
+    ips: [],
+  } as unknown as ExpressRequest;
+
+  const res: ExpressResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+  } as unknown as ExpressResponse;
+
+  const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+  await mockRouter.match("post", data.route).handlerFunction(req, res, next);
+
+  expect(next).not.toHaveBeenCalled();
+};
+
+const listedItems: () => Array<unknown> = (): Array<unknown> => {
+  expect(Response.sendEntityArrayResponse).toHaveBeenCalledTimes(1);
+
+  const call: Array<unknown> = (Response.sendEntityArrayResponse as jest.Mock)
+    .mock.calls[0] as Array<unknown>;
+
+  const items: Array<unknown> = call[2] as Array<unknown>;
+  const count: PositiveNumber = call[3] as PositiveNumber;
+
+  expect(count.toNumber()).toBe(items.length);
+
+  return items;
+};
+
+describe("SSO provider listings and status page SSO flags, by edition", () => {
+  const originalHost: string | undefined = process.env["HOST"];
+
+  let projectSsoFind: SpyInstance;
+  let projectOidcFind: SpyInstance;
+  let statusPageSsoFind: SpyInstance;
+  let statusPageOidcFind: SpyInstance;
+  let statusPageSsoCount: SpyInstance;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new ProjectSsoAPI();
+    new ProjectOidcAPI();
+    new StatusPageAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env["HOST"] = "app.example.com";
+    setTestBillingEnabled(false);
+    uninstallEnterpriseModule();
+
+    projectSsoFind = getJestSpyOn(
+      ProjectSsoService,
+      "findBy",
+    ).mockResolvedValue([buildProjectSso()]);
+    projectOidcFind = getJestSpyOn(
+      ProjectOidcService,
+      "findBy",
+    ).mockResolvedValue([buildProjectOidc()]);
+    statusPageSsoFind = getJestSpyOn(
+      StatusPageSsoService,
+      "findBy",
+    ).mockResolvedValue([buildStatusPageSso()]);
+    statusPageOidcFind = getJestSpyOn(
+      StatusPageOidcService,
+      "findBy",
+    ).mockResolvedValue([buildStatusPageOidc()]);
+    statusPageSsoCount = getJestSpyOn(
+      StatusPageSsoService,
+      "countBy",
+    ).mockResolvedValue(new PositiveNumber(2));
+  });
+
+  afterEach(() => {
+    uninstallEnterpriseModule();
+    setTestBillingEnabled(false);
+    jest.restoreAllMocks();
+
+    if (originalHost === undefined) {
+      delete process.env["HOST"];
+    } else {
+      process.env["HOST"] = originalHost;
+    }
+  });
+
+  test("the cases include lapsed Enterprise licenses, not just the two editions", () => {
+    expect(
+      EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+        return editionCase.isLoaded && !editionCase.isActive;
+      }).length,
+    ).toBeGreaterThanOrEqual(4);
+  });
+
+  describe.each(
+    EDITION_CASES.map(
+      (editionCase: EditionStateCase): [string, EditionStateCase] => {
+        return [editionCase.label, editionCase];
+      },
+    ),
+  )("%s", (_label: string, editionCase: EditionStateCase) => {
+    beforeEach(() => {
+      editionCase.apply();
+      getJestSpyOn(logger, "warn").mockImplementation((): void => {
+        return undefined;
+      });
+    });
+
+    test(`project SSO list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+      await invoke({
+        route: PROJECT_SSO_ROUTE,
+        params: { projectId: PROJECT_ID.toString() },
+      });
+
+      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
+
+      if (editionCase.isActive) {
+        expect(projectSsoFind).toHaveBeenCalledWith(
+          expect.objectContaining({
+            query: { projectId: PROJECT_ID, isEnabled: true },
+            props: { isRoot: true },
+          }),
+        );
+      } else {
+        expect(projectSsoFind).not.toHaveBeenCalled();
+      }
+    });
+
+    test(`project OIDC list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+      await invoke({
+        route: PROJECT_OIDC_ROUTE,
+        params: { projectId: PROJECT_ID.toString() },
+      });
+
+      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
+      expect(projectOidcFind).toHaveBeenCalledTimes(
+        editionCase.isActive ? 1 : 0,
+      );
+    });
+
+    test(`status page SSO list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+      await invoke({
+        route: STATUS_PAGE_SSO_ROUTE,
+        params: { statusPageId: STATUS_PAGE_ID.toString() },
+      });
+
+      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
+      expect(statusPageSsoFind).toHaveBeenCalledTimes(
+        editionCase.isActive ? 1 : 0,
+      );
+    });
+
+    test(`status page OIDC list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+      await invoke({
+        route: STATUS_PAGE_OIDC_ROUTE,
+        params: { statusPageId: STATUS_PAGE_ID.toString() },
+      });
+
+      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
+      expect(statusPageOidcFind).toHaveBeenCalledTimes(
+        editionCase.isActive ? 1 : 0,
+      );
+    });
+
+    test(`master page ${editionCase.isActive ? "reports the stored SSO requirement and providers" : "reports no SSO (effective value) and leaves the stored value alone"}`, async () => {
+      const statusPage: StatusPage = new StatusPage();
+      statusPage.id = STATUS_PAGE_ID;
+      statusPage.pageTitle = "Customer Status";
+      statusPage.requireSsoForLogin = true;
+
+      const findStatusPage: SpyInstance = getJestSpyOn(
+        StatusPageService,
+        "findOneById",
+      ).mockResolvedValue(statusPage);
+      getJestSpyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
+      getJestSpyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
+      getJestSpyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(
+        null,
+      );
+
+      await invoke({
+        route: MASTER_PAGE_ROUTE,
+        params: { statusPageId: STATUS_PAGE_ID.toString() },
+      });
+
+      expect(Response.sendJsonObjectResponse).toHaveBeenCalledTimes(1);
+
+      const payload: JSONObject = (Response.sendJsonObjectResponse as jest.Mock)
+        .mock.calls[0]![2] as JSONObject;
+
+      expect((payload["statusPage"] as JSONObject)["requireSsoForLogin"]).toBe(
+        editionCase.isActive,
+      );
+      expect(payload["hasEnabledSSO"]).toBe(editionCase.isActive ? 2 : 0);
+      expect(statusPageSsoCount).toHaveBeenCalledTimes(
+        editionCase.isActive ? 1 : 0,
+      );
+
+      // The stored requirement is still read, never written.
+      expect(findStatusPage).toHaveBeenCalledWith(
+        expect.objectContaining({
+          select: expect.objectContaining({ requireSsoForLogin: true }),
+          props: { isRoot: true },
+        }),
+      );
+    });
+  });
+
+  test("the lists follow the license at request time: empty while lapsed, listed again after renewal", async () => {
+    getJestSpyOn(logger, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+    getJestSpyOn(logger, "info").mockImplementation((): void => {
+      return undefined;
+    });
+
+    const fake: FakeEnterpriseModule = installFakeEnterpriseModule({
+      snapshot: createLicenseSnapshotWithStatus("expired"),
+    });
+
+    await invoke({
+      route: PROJECT_SSO_ROUTE,
+      params: { projectId: PROJECT_ID.toString() },
+    });
+
+    expect(listedItems()).toHaveLength(0);
+    expect(projectSsoFind).not.toHaveBeenCalled();
+
+    fake.setSnapshot(createLicenseSnapshotWithStatus("valid"));
+    (Response.sendEntityArrayResponse as jest.Mock).mockClear();
+
+    await invoke({
+      route: PROJECT_SSO_ROUTE,
+      params: { projectId: PROJECT_ID.toString() },
+    });
+
+    expect(listedItems()).toHaveLength(1);
+    expect(projectSsoFind).toHaveBeenCalledTimes(1);
+  });
+
+  test("the master page reports a page that does not require SSO the same way on both editions", async () => {
+    const statusPage: StatusPage = new StatusPage();
+    statusPage.id = STATUS_PAGE_ID;
+    statusPage.requireSsoForLogin = false;
+
+    getJestSpyOn(StatusPageService, "findOneById").mockResolvedValue(
+      statusPage,
+    );
+    getJestSpyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
+    getJestSpyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
+    getJestSpyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(null);
+
+    installFakeEnterpriseModule();
+
+    await invoke({
+      route: MASTER_PAGE_ROUTE,
+      params: { statusPageId: STATUS_PAGE_ID.toString() },
+    });
+
+    const payload: JSONObject = (Response.sendJsonObjectResponse as jest.Mock)
+      .mock.calls[0]![2] as JSONObject;
+
+    expect((payload["statusPage"] as JSONObject)["requireSsoForLogin"]).toBe(
+      false,
+    );
+  });
+});

package/Tests/Server/API/TeamMemberLeaveScimLockEdition.test.ts

@@ -0,0 +1,252 @@
+import TeamMemberAPI from "../../../Server/API/TeamMemberAPI";
+import ProjectSCIMService from "../../../Server/Services/ProjectSCIMService";
+import TeamMemberService from "../../../Server/Services/TeamMemberService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import FakeEnterpriseModule, {
+  createEditionStateCases,
+  createLicenseSnapshotWithStatus,
+  EditionStateCase,
+  installFakeEnterpriseModule,
+  uninstallEnterpriseModule,
+} from "../Enterprise/FakeEnterpriseModule";
+import logger from "../../../Server/Utils/Logger";
+import { setTestBillingEnabled } from "../Enterprise/TestBillingFlag";
+import { getJestSpyOn } from "../../Spy";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+type SpyInstance = ReturnType<typeof getJestSpyOn>;
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  const billingFlag: typeof import("../Enterprise/TestBillingFlag") =
+    jest.requireActual(
+      "../Enterprise/TestBillingFlag",
+    ) as typeof import("../Enterprise/TestBillingFlag");
+
+  return billingFlag.withLiveBillingFlag(
+    jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >,
+  );
+});
+
+/*
+ * POST /team-member/:id/leave lets a member leave a team. While SCIM Push
+ * Groups owns the project's teams, only the identity provider may remove
+ * members, so the route refuses - while SCIM is active
+ * (EnterpriseEdition.isFeatureActive(SCIM)). The Community Edition has no
+ * SCIM endpoint, and an Enterprise install whose license lapsed answers none,
+ * so there a Push Groups setting left on must not trap the member in the team.
+ */
+
+const ROUTE: string = "/team-member/:id/leave";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const MEMBERSHIP_ID: ObjectID = new ObjectID(
+  "66666666-6666-4666-8666-666666666666",
+);
+const USER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+
+const EDITION_CASES: Array<EditionStateCase> = createEditionStateCases();
+
+const toMatrix: (
+  cases: Array<EditionStateCase>,
+) => Array<[string, EditionStateCase]> = (
+  cases: Array<EditionStateCase>,
+): Array<[string, EditionStateCase]> => {
+  return cases.map(
+    (editionCase: EditionStateCase): [string, EditionStateCase] => {
+      return [editionCase.label, editionCase];
+    },
+  );
+};
+
+const LOCKED_MATRIX: Array<[string, EditionStateCase]> = toMatrix(
+  EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+    return editionCase.isActive;
+  }),
+);
+
+const UNLOCKED_MATRIX: Array<[string, EditionStateCase]> = toMatrix(
+  EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+    return !editionCase.isActive;
+  }),
+);
+
+let scimCount: SpyInstance;
+let deleteMembership: SpyInstance;
+
+const leave: () => Promise<void> = async (): Promise<void> => {
+  const req: ExpressRequest = {
+    params: { id: MEMBERSHIP_ID.toString() },
+    query: {},
+    body: {},
+    headers: {},
+    userAuthorization: { userId: USER_ID },
+  } as unknown as ExpressRequest;
+
+  const res: ExpressResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+  } as unknown as ExpressResponse;
+
+  const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+  await mockRouter.match("POST", ROUTE).handlerFunction(req, res, next);
+
+  expect(next).not.toHaveBeenCalled();
+};
+
+const expectRefusedBecauseOfScim: () => void = (): void => {
+  expect(Response.sendErrorResponse).toHaveBeenCalledWith(
+    expect.anything(),
+    expect.anything(),
+    new BadDataException(
+      "Team membership is managed by SCIM Push Groups for this project. Please contact your administrator to be removed.",
+    ),
+  );
+  expect(deleteMembership).not.toHaveBeenCalled();
+  expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
+};
+
+const expectLeft: () => void = (): void => {
+  expect(Response.sendErrorResponse).not.toHaveBeenCalled();
+  expect(deleteMembership).toHaveBeenCalledWith({
+    id: MEMBERSHIP_ID,
+    props: { isRoot: true },
+  });
+  expect(Response.sendEmptySuccessResponse).toHaveBeenCalledTimes(1);
+};
+
+describe("POST /team-member/:id/leave and SCIM Push Groups, by edition", () => {
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new TeamMemberAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    setTestBillingEnabled(false);
+    uninstallEnterpriseModule();
+
+    const membership: TeamMember = new TeamMember();
+    membership.userId = USER_ID;
+    membership.projectId = PROJECT_ID;
+
+    getJestSpyOn(TeamMemberService, "findOneById").mockResolvedValue(
+      membership,
+    );
+    deleteMembership = getJestSpyOn(
+      TeamMemberService,
+      "deleteOneById",
+    ).mockResolvedValue(1);
+    getJestSpyOn(logger, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+    getJestSpyOn(logger, "info").mockImplementation((): void => {
+      return undefined;
+    });
+
+    // Push Groups is ON for the project.
+    scimCount = getJestSpyOn(ProjectSCIMService, "countBy").mockResolvedValue(
+      new PositiveNumber(1),
+    );
+  });
+
+  afterEach(() => {
+    uninstallEnterpriseModule();
+    setTestBillingEnabled(false);
+    jest.restoreAllMocks();
+  });
+
+  test.each(LOCKED_MATRIX)(
+    "SCIM active (%s): leaving is refused",
+    async (_label: string, editionCase: EditionStateCase) => {
+      editionCase.apply();
+
+      await leave();
+
+      expect(scimCount).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: { projectId: PROJECT_ID, enablePushGroups: true },
+        }),
+      );
+      expectRefusedBecauseOfScim();
+    },
+  );
+
+  test.each(UNLOCKED_MATRIX)(
+    "SCIM not active (%s): the member can leave",
+    async (_label: string, editionCase: EditionStateCase) => {
+      editionCase.apply();
+
+      await leave();
+
+      expect(scimCount).not.toHaveBeenCalled();
+      expectLeft();
+    },
+  );
+
+  test("the lock follows the license at request time: a lapse lets the member leave, a renewal locks again", async () => {
+    const fake: FakeEnterpriseModule = installFakeEnterpriseModule({
+      snapshot: createLicenseSnapshotWithStatus("valid"),
+    });
+
+    await leave();
+    expectRefusedBecauseOfScim();
+
+    jest.clearAllMocks();
+    fake.setSnapshot(createLicenseSnapshotWithStatus("expired"));
+
+    await leave();
+    expectLeft();
+  });
+
+  test("with Push Groups off the Enterprise Edition lets the member leave", async () => {
+    installFakeEnterpriseModule();
+    scimCount.mockResolvedValue(new PositiveNumber(0));
+
+    await leave();
+
+    expectLeft();
+  });
+});