@oneuptime/common 13.0.8 → 14.0.0

package/Server/Middleware/UserAuthorization.ts

@@ -41,6 +41,7 @@ import Permission, {
 } from "../../Types/Permission";
 import UserType from "../../Types/UserType";
 import UserPermissionUtil from "../Utils/UserPermission/UserPermission";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 
 export default class UserMiddleware {
   /*
@@ -881,10 +882,21 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
+    /*
+     * SSO requirements are enforced while SSO is active: the Enterprise
+     * Edition is loaded and its license covers SSO (or billing is on). The
+     * Community Edition, which has no SSO login routes, and an Enterprise
+     * install whose license lapsed, where those routes refuse, relax them.
+     * Errors and an unknown license state answer "enforce".
+     */
+    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
+
     /*
      * Resolve the SSO requirement and the tenant permission in parallel.
      * `getRequireSsoForLogin` is cached in-process for 60s, so this is
-     * usually free; the tenant permission lookup is the expensive call.
+     * usually free; the tenant permission lookup is the expensive call. It
+     * runs on the Community Edition too: it is also what turns an unknown
+     * project into TenantNotFoundException.
      */
     const [projectRequireSsoForLogin, tenantPermission]: [
       boolean,
@@ -909,8 +921,9 @@ export default class UserMiddleware {
      * can't lock them out — a project's own requireSsoForLogin still applies to
      * them. Only checked when the project doesn't already enforce SSO.
      */
-    let requireSsoForLogin: boolean = projectRequireSsoForLogin;
-    if (!requireSsoForLogin && !isMasterAdmin) {
+    let requireSsoForLogin: boolean =
+      isSsoEnforced && projectRequireSsoForLogin;
+    if (isSsoEnforced && !requireSsoForLogin && !isMasterAdmin) {
       requireSsoForLogin =
         await GlobalConfigService.getRequireSsoForLogin().catch(() => {
           return false;
@@ -957,15 +970,23 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
+    /*
+     * Same rule as the single-tenant path: SSO requirements are enforced
+     * while SSO is active and relaxed on the Community Edition and while the
+     * license does not cover SSO. Decided once for the whole fan-out.
+     */
+    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
+
     /*
      * Instance-wide "Require SSO for Login" forces SSO on every project. Master
      * admins are exempt. Resolved once (cached) rather than per project.
      */
-    const globalRequireSsoForLogin: boolean = isMasterAdmin
-      ? false
-      : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
-          return false;
-        });
+    const globalRequireSsoForLogin: boolean =
+      isMasterAdmin || !isSsoEnforced
+        ? false
+        : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
+            return false;
+          });
 
     /*
      * Resolve permissions for every project in parallel. A project's own
@@ -977,14 +998,15 @@ export default class UserMiddleware {
       permission: UserTenantAccessPermission | null;
     }> = await Promise.all(
       projectIds.map(async (projectId: ObjectID) => {
-        const projectRequireSsoForLogin: boolean =
-          await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
-            /*
-             * Unknown/inaccessible project: do not enforce SSO here. Actual
-             * access is still gated by AccessTokenService below.
-             */
-            return false;
-          });
+        const projectRequireSsoForLogin: boolean = !isSsoEnforced
+          ? false
+          : await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
+              /*
+               * Unknown/inaccessible project: do not enforce SSO here. Actual
+               * access is still gated by AccessTokenService below.
+               */
+              return false;
+            });
 
         const requireSsoForLogin: boolean =
           projectRequireSsoForLogin || globalRequireSsoForLogin;