@oneuptime/common 13.0.8 → 14.0.0

package/Server/Services/MonitorStatusTimelineService.ts

@@ -21,6 +21,11 @@ import { MonitorFeedEventType } from "../../Models/DatabaseModels/MonitorFeed";
 import MonitorStatus from "../../Models/DatabaseModels/MonitorStatus";
 import MonitorStatusService from "./MonitorStatusService";
 import ServerException from "../../Types/Exception/ServerException";
+import {
+  MonitorUptimeDailyAggregate,
+  UptimeDailyAggregate,
+  UptimeDayBucket,
+} from "../../Types/StatusPage/UptimeDailyAggregate";
 
 /*
  * Thrown by onBeforeCreate when the incoming status is the same as the status of
@@ -45,6 +50,285 @@ export class Service extends DatabaseService<MonitorStatusTimeline> {
     super(MonitorStatusTimeline);
   }
 
+  /**
+   * Per-monitor, per-day status durations for the status-page uptime bars.
+   *
+   * WHY THIS EXISTS
+   *
+   * The bars used to be painted from raw rows fetched with a single
+   * `limit: LIMIT_MAX` (10,000) across EVERY monitor on the page, sorted
+   * `startsAt DESC`. Measured on a real status page: 254,550 rows matched the
+   * 60-day window and 10,000 came back. The oldest surviving row started four
+   * days before the request, so 56 of 60 bars were painted from data that had
+   * been silently dropped - and the uptime percentage was computed from the
+   * same 3.9%.
+   *
+   * The cap being GLOBAL across monitors is what makes it vicious. A quiet,
+   * healthy monitor's covering row has an OLD `startsAt`, so under
+   * `startsAt DESC` it sorts last and is cut first: on the page that reported
+   * this, three flapping monitors held 9,995 of the 10,000 slots. The
+   * healthier a monitor is, the more likely it is to lose its entire history
+   * to a noisy neighbour on the same page.
+   *
+   * Shipping more rows cannot fix it - 254,550 rows is ~105 MB of this
+   * codebase's typed JSON, into a response held in a 500-entry in-memory
+   * cache and then filtered per-bar on the client's main thread. So this
+   * returns DURATIONS. The result is O(monitors x days x statuses) and cannot
+   * be inflated by a flapping monitor.
+   *
+   * THE SQL, AND THE THREE TRAPS IN IT
+   *
+   * 1. An open row (`endsAt IS NULL`) is capped at the NEXT row's `startsAt`,
+   *    not at `now()`. `COALESCE(endsAt, now())` would overlap the successor
+   *    and double-count that span. This mirrors what
+   *    UptimeUtil.getMonitorEventsForId already does client-side.
+   *
+   * 2. Periods are split into days ARITHMETICALLY (`generate_series` over the
+   *    days a period touches) and then hash-aggregated, rather than joined
+   *    against a bucket grid. Both give the same answer; the join does not
+   *    scale. Joining emitted one row per timeline row - 255,486 on the
+   *    reporting page - which then had to be sorted for the GroupAggregate
+   *    and spilled 26 MB to disk, ~4.7s. Splitting first aggregates 255k rows
+   *    into ~450 with no sort: ~1.5s.
+   *
+   *    A period that lies inside one day yields exactly one segment, which is
+   *    the overwhelmingly common case - a flapping monitor's rows last well
+   *    under a second. Only a long-running period fans out, one segment per
+   *    day it spans.
+   *
+   * 3. Seconds are summed as `double precision` and NEVER rounded per group.
+   *    Rounding each (monitor, day, status) sum to a bigint loses up to half a
+   *    second per status, so a fully covered day with two statuses reported
+   *    86,399 of 86,400 seconds - a day that is complete looking one second
+   *    short. Coverage is compared with a tolerance by the client rather than
+   *    for exact equality.
+   *
+   * A trap that is worth recording even though this SQL no longer contains it:
+   * PostgreSQL's LEAST/GREATEST IGNORE NULLs, returning the smallest or
+   * largest NON-NULL argument. An earlier draft joined rows to buckets, and on
+   * an unmatched LEFT JOIN row `LEAST(NULL, bucketEnd) - GREATEST(NULL,
+   * bucketStart)` silently became a FULL DAY of coverage - reporting a monitor
+   * as up before it existed. It was caught against real data, not in review.
+   * Any future rewrite that reintroduces a row-to-bucket join must handle it.
+   *
+   * Day buckets are local calendar days converted to UTC instants, so a DST
+   * day is genuinely 23 or 25 hours - `daySeconds` is never hardcoded to
+   * 86400. The window's first and last buckets are clipped to the window, and
+   * the end is clamped to `now()` so a future day is never emitted and can
+   * never be reported as 100%.
+   */
+  @CaptureSpan()
+  public async getDailyUptimeAggregate(data: {
+    monitorIds: Array<ObjectID>;
+    startDate: Date;
+    endDate: Date;
+    timezone?: string | undefined;
+  }): Promise<UptimeDailyAggregate> {
+    const empty: UptimeDailyAggregate = {
+      monitors: [],
+      isComplete: true,
+      completeFrom: null,
+    };
+
+    if (data.monitorIds.length === 0) {
+      return empty;
+    }
+
+    /*
+     * The overlap predicate is preserved verbatim from the row fetch this
+     * replaces: a row counts if it started on or before the window ends and
+     * either ended on or after the window started or is still open. The
+     * inclusive `>=` is deliberate - a row ending exactly at startDate still
+     * overlaps - and a strict `>` is NOT interchangeable.
+     */
+    const sql: string = `
+      WITH params AS (
+        SELECT $2::timestamptz AS win_start,
+               LEAST($3::timestamptz, now()) AS eff_end,
+               $4::text AS tz
+      ),
+      mons AS (
+        SELECT UNNEST($1::uuid[]) AS monitor_id
+      ),
+      src AS (
+        SELECT t."monitorId" AS monitor_id,
+               t."monitorStatusId" AS status_id,
+               GREATEST(t."startsAt", p.win_start) AS s,
+               LEAST(
+                 COALESCE(
+                   t."endsAt",
+                   LEAD(t."startsAt") OVER (
+                     PARTITION BY t."monitorId" ORDER BY t."startsAt"
+                   ),
+                   p.eff_end
+                 ),
+                 p.eff_end
+               ) AS e
+        FROM "MonitorStatusTimeline" t
+        CROSS JOIN params p
+        WHERE t."monitorId" = ANY($1::uuid[])
+          AND t."deletedAt" IS NULL
+          AND t."startsAt" <= p.eff_end
+          AND (t."endsAt" >= p.win_start OR t."endsAt" IS NULL)
+      ),
+      split AS (
+        SELECT src.monitor_id,
+               src.status_id,
+               (gs AT TIME ZONE p.tz) AS day_start,
+               GREATEST(src.s, (gs AT TIME ZONE p.tz)) AS seg_start,
+               LEAST(src.e, ((gs + interval '1 day') AT TIME ZONE p.tz))
+                 AS seg_end
+        FROM src
+        CROSS JOIN params p,
+        LATERAL generate_series(
+          date_trunc('day', src.s AT TIME ZONE p.tz),
+          date_trunc('day', (src.e - interval '1 microsecond') AT TIME ZONE p.tz),
+          interval '1 day'
+        ) AS gs
+        WHERE src.e > src.s
+      ),
+      agg AS (
+        SELECT monitor_id,
+               day_start,
+               status_id,
+               SUM(EXTRACT(EPOCH FROM (seg_end - seg_start)))::double precision
+                 AS seconds
+        FROM split
+        WHERE seg_end > seg_start
+        GROUP BY monitor_id, day_start, status_id
+      ),
+      buckets AS (
+        SELECT (d AT TIME ZONE p.tz) AS day_start,
+               GREATEST((d AT TIME ZONE p.tz), p.win_start) AS bucket_start,
+               LEAST(((d + interval '1 day') AT TIME ZONE p.tz), p.eff_end)
+                 AS bucket_end
+        FROM params p,
+             generate_series(
+               date_trunc('day', p.win_start AT TIME ZONE p.tz),
+               date_trunc('day', p.eff_end AT TIME ZONE p.tz),
+               interval '1 day'
+             ) AS d
+      )
+      SELECT m.monitor_id AS "monitorId",
+             b.bucket_start AS "bucketStart",
+             b.bucket_end AS "bucketEnd",
+             EXTRACT(EPOCH FROM (b.bucket_end - b.bucket_start))::bigint
+               AS "daySeconds",
+             a.status_id AS "monitorStatusId",
+             COALESCE(a.seconds, 0)::double precision AS "seconds"
+      FROM mons m
+      CROSS JOIN buckets b
+      LEFT JOIN agg a ON a.monitor_id = m.monitor_id
+                     AND a.day_start = b.day_start
+      WHERE b.bucket_end > b.bucket_start
+      ORDER BY m.monitor_id, b.bucket_start
+    `;
+
+    const rows: Array<{
+      monitorId: string;
+      bucketStart: Date;
+      bucketEnd: Date;
+      daySeconds: string | number;
+      monitorStatusId: string | null;
+      seconds: string | number;
+    }> = await this.getRepository().manager.query(sql, [
+      data.monitorIds.map((id: ObjectID) => {
+        return id.toString();
+      }),
+      data.startDate,
+      data.endDate,
+      data.timezone || "UTC",
+    ]);
+
+    return Service.toUptimeDailyAggregate(rows);
+  }
+
+  /*
+   * Exported shape-only step, so the bucketing can be tested without a
+   * database. One row per (monitor, day, status); a day with no coverage
+   * comes back as a single row with a NULL status and zero seconds, which is
+   * what makes a no-data day distinguishable from a day spent up.
+   */
+  public static toUptimeDailyAggregate(
+    rows: Array<{
+      monitorId: string;
+      bucketStart: Date;
+      bucketEnd: Date;
+      daySeconds: string | number;
+      monitorStatusId: string | null;
+      seconds: string | number;
+    }>,
+  ): UptimeDailyAggregate {
+    const byMonitor: Map<string, Map<number, UptimeDayBucket>> = new Map();
+
+    for (const row of rows) {
+      let buckets: Map<number, UptimeDayBucket> | undefined = byMonitor.get(
+        row.monitorId,
+      );
+
+      if (!buckets) {
+        buckets = new Map<number, UptimeDayBucket>();
+        byMonitor.set(row.monitorId, buckets);
+      }
+
+      const bucketStart: Date = new Date(row.bucketStart);
+      const key: number = bucketStart.getTime();
+
+      let bucket: UptimeDayBucket | undefined = buckets.get(key);
+
+      if (!bucket) {
+        bucket = {
+          bucketStart: bucketStart,
+          bucketEnd: new Date(row.bucketEnd),
+          daySeconds: Number(row.daySeconds),
+          coveredSeconds: 0,
+          statusDurations: [],
+        };
+        buckets.set(key, bucket);
+      }
+
+      const seconds: number = Number(row.seconds);
+
+      /*
+       * A NULL status is the LEFT JOIN's "nothing overlapped this day" row.
+       * It must not become a status duration, and it contributes no coverage.
+       */
+      if (!row.monitorStatusId || seconds <= 0) {
+        continue;
+      }
+
+      bucket.coveredSeconds += seconds;
+      bucket.statusDurations.push({
+        monitorStatusId: new ObjectID(row.monitorStatusId),
+        seconds: seconds,
+      });
+    }
+
+    const monitors: Array<MonitorUptimeDailyAggregate> = [];
+
+    for (const [monitorId, buckets] of byMonitor) {
+      monitors.push({
+        monitorId: new ObjectID(monitorId),
+        buckets: Array.from(buckets.values()).sort(
+          (a: UptimeDayBucket, b: UptimeDayBucket) => {
+            return a.bucketStart.getTime() - b.bucketStart.getTime();
+          },
+        ),
+      });
+    }
+
+    /*
+     * There is no cap in this path, so the window is always fully covered.
+     * The fields exist so that a bound added later has to SHOW rather than be
+     * absorbed into a green bar - which is the failure this replaces.
+     */
+    return {
+      monitors: monitors,
+      isComplete: true,
+      completeFrom: null,
+    };
+  }
+
   @CaptureSpan()
   public override async create(
     createBy: CreateBy<MonitorStatusTimeline>,

package/Server/Services/MonitorTemplateService.ts

@@ -10,6 +10,7 @@ import DeleteBy from "../Types/Database/DeleteBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import MonitorStepsProjectValidator from "../Utils/Monitor/MonitorStepsProjectValidator";
+import MonitoringIntervalValidator from "../Utils/Monitor/MonitoringIntervalValidator";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Includes from "../../Types/BaseDatabase/Includes";
@@ -116,6 +117,18 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
+    /*
+     * A template's interval is copied onto every monitor it creates or syncs,
+     * so an unvalidated value here becomes many broken monitors later.
+     */
+    if (createBy.data.monitoringInterval !== undefined) {
+      (createBy.data as unknown as Record<string, unknown>)[
+        "monitoringInterval"
+      ] = MonitoringIntervalValidator.validateAndNormalize(
+        createBy.data.monitoringInterval,
+      );
+    }
+
     this.validateSyncFields(
       createBy.data.monitorSteps,
       createBy.data.monitorType,
@@ -132,6 +145,19 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    /*
+     * Ahead of the early return below: an update that touches only the
+     * interval must still be validated, and key presence is the test for the
+     * same reason it is in MonitorService.onBeforeUpdate.
+     */
+    if (Object.keys(updateBy.data || {}).includes("monitoringInterval")) {
+      (updateBy.data as unknown as Record<string, unknown>)[
+        "monitoringInterval"
+      ] = MonitoringIntervalValidator.validateAndNormalize(
+        updateBy.data.monitoringInterval as string | null | undefined,
+      );
+    }
+
     if (!updateBy.data.monitorSteps && !updateBy.data.monitorType) {
       return { updateBy, carryForward: null };
     }

package/Server/Services/ProjectService.ts

@@ -14,6 +14,9 @@ import { OnCreate, OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
 import UpdateBy from "../Types/Database/UpdateBy";
 import logger, { LogAttributes } from "../Utils/Logger";
+import EditionEnforcement from "../Utils/EditionEnforcement";
+import EnterpriseEdition from "../Enterprise/EnterpriseEdition";
+import EnterpriseFeature from "../Enterprise/EnterpriseFeature";
 import Errors from "../Utils/Errors";
 import ProductAnalytics from "../Utils/ProductAnalytics";
 import MarketingEventUtil, {
@@ -142,6 +145,107 @@ export type ProjectBalanceColumnName =
  */
 export const MAX_BALANCE_ADJUSTMENT_IN_USD_CENTS: number = 10_000 * 100;
 
+/*
+ * The project columns that hold its SSO requirement: the ones onFindSuccess
+ * masks and onBeforeUpdate guards while SSO is not active.
+ */
+export const PROJECT_SSO_REQUIREMENT_COLUMNS: ReadonlyArray<string> = [
+  "requireSsoForLogin",
+  "requireSsoWithSsoProviderId",
+];
+
+// The project columns that decide what the audit log records and keeps.
+export interface ProjectAuditLogSettings {
+  enableAuditLogs: boolean;
+  storeSystemEventsInAuditLogs: boolean;
+  auditLogsRetentionInDays: number;
+}
+
+/*
+ * The settings as a project row holds them: a column that was not selected,
+ * or predates its default, reads as undefined or null.
+ */
+export interface StoredProjectAuditLogSettings {
+  enableAuditLogs?: boolean | null | undefined;
+  storeSystemEventsInAuditLogs?: boolean | null | undefined;
+  auditLogsRetentionInDays?: number | null | undefined;
+}
+
+// What a new project starts with: the three columns' defaults.
+export const DEFAULT_PROJECT_AUDIT_LOG_SETTINGS: Readonly<ProjectAuditLogSettings> =
+  {
+    enableAuditLogs: false,
+    storeSystemEventsInAuditLogs: false,
+    auditLogsRetentionInDays: 7,
+  };
+
+/*
+ * The narrowest settings there are. A write that widens even these could
+ * widen some project's; one that does not can only keep or narrow.
+ */
+const NARROWEST_AUDIT_LOG_SETTINGS: Readonly<ProjectAuditLogSettings> = {
+  enableAuditLogs: false,
+  storeSystemEventsInAuditLogs: false,
+  auditLogsRetentionInDays: Number.NEGATIVE_INFINITY,
+};
+
+/*
+ * Whether a written switch value turns the switch on. Only false (and a
+ * missing value) means off: anything else a database could read as true
+ * ("true", 1) counts as on, so an odd value is judged by the license check
+ * rather than waved through.
+ */
+const isSwitchedOn: (value: unknown) => boolean = (value: unknown): boolean => {
+  return value !== undefined && value !== null && value !== false;
+};
+
+/*
+ * Whether writing `requested` over `current` widens audit logging: switches
+ * it on, starts recording system events, or keeps entries for longer.
+ * Switching off, recording less and shortening retention never widen, and
+ * neither does writing the value a project already has.
+ */
+export const widensAuditLogging: (
+  requested: Record<string, unknown>,
+  current: StoredProjectAuditLogSettings,
+) => boolean = (
+  requested: Record<string, unknown>,
+  current: StoredProjectAuditLogSettings,
+): boolean => {
+  if (
+    isSwitchedOn(requested["enableAuditLogs"]) &&
+    current.enableAuditLogs !== true
+  ) {
+    return true;
+  }
+
+  if (
+    isSwitchedOn(requested["storeSystemEventsInAuditLogs"]) &&
+    current.storeSystemEventsInAuditLogs !== true
+  ) {
+    return true;
+  }
+
+  const requestedRetention: unknown = requested["auditLogsRetentionInDays"];
+
+  if (requestedRetention === undefined || requestedRetention === null) {
+    return false;
+  }
+
+  const requestedDays: number =
+    typeof requestedRetention === "number"
+      ? requestedRetention
+      : Number(requestedRetention);
+
+  const currentDays: number =
+    typeof current.auditLogsRetentionInDays === "number"
+      ? current.auditLogsRetentionInDays
+      : DEFAULT_PROJECT_AUDIT_LOG_SETTINGS.auditLogsRetentionInDays;
+
+  // A value that is not a number cannot be judged: treat it as widening.
+  return !Number.isFinite(requestedDays) || requestedDays > currentDays;
+};
+
 export class ProjectService extends DatabaseService<Model> {
   /*
    * Suppresses repeated `lastActive` UPDATEs from a single API node. 60s of
@@ -231,6 +335,17 @@ export class ProjectService extends DatabaseService<Model> {
       );
     }
 
+    // A new project starts from the defaults, so any audit setting above them widens.
+    await this.assertAuditLogSettingsChangeIsLicensed({
+      requested: data.data as unknown as Record<string, unknown>,
+      props: data.props,
+      loadCurrentSettings: async (): Promise<
+        Array<StoredProjectAuditLogSettings>
+      > => {
+        return [DEFAULT_PROJECT_AUDIT_LOG_SETTINGS];
+      },
+    });
+
     logger.debug("Creating project for user " + data.props.userId, {
       userId: data.props.userId?.toString(),
     } as LogAttributes);
@@ -546,6 +661,17 @@ export class ProjectService extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    /*
+     * While SSO is not active this caller only ever read the requirement as
+     * off (see onFindSuccess), so a write of it must not switch the stored
+     * requirement off, or set one nobody could see. Drops or refuses it.
+     */
+    EditionEnforcement.guardSsoRequirementWrite({
+      props: updateBy.props,
+      data: updateBy.data as unknown as Record<string, unknown>,
+      columns: PROJECT_SSO_REQUIREMENT_COLUMNS,
+    });
+
     /*
      * Any project field could have changed; invalidate the in-process cache
      * of the SSO flag. Cheap to refetch on the next request.
@@ -560,6 +686,19 @@ export class ProjectService extends DatabaseService<Model> {
 
     this.applyDataResidencyRules(updateBy.data);
 
+    await this.assertAuditLogSettingsChangeIsLicensed({
+      requested: updateBy.data as unknown as Record<string, unknown>,
+      props: updateBy.props,
+      loadCurrentSettings: (): Promise<
+        Array<StoredProjectAuditLogSettings>
+      > => {
+        return this.findAuditLogSettingsInCallerScope({
+          query: updateBy.query,
+          props: updateBy.props,
+        });
+      },
+    });
+
     if (IsBillingEnabled) {
       if (
         updateBy.data.businessDetails ||
@@ -653,6 +792,113 @@ export class ProjectService extends DatabaseService<Model> {
     return { updateBy, carryForward: [] };
   }
 
+  /*
+   * Audit logging is an Enterprise feature (EnterpriseFeature.AuditLogs), but
+   * its settings are ordinary Project columns, gated only by the plan when
+   * billing is on. Without billing, switching audit logging on - or widening
+   * it: recording system events too, keeping entries longer - needs a license
+   * that includes audit logs, like creating or changing any other enterprise
+   * configuration. On the Community Edition it is refused.
+   *
+   * Never refused: switching it off or narrowing it (an administrator must
+   * always be able to record less), a write that keeps a project's settings
+   * as they are (the settings form sends every field), internal root writes,
+   * and anything when billing is on, where the plan gates apply. Whether
+   * entries are recorded at all is decided per entry by the recorder
+   * (EnterpriseEdition.isFeatureActive(AuditLogs)): recording stops while a
+   * self-hosted license is lapsed and resumes when it is renewed.
+   *
+   * The current settings are loaded only when the write could widen them and
+   * the license does not allow it.
+   */
+  @CaptureSpan()
+  public async assertAuditLogSettingsChangeIsLicensed(data: {
+    requested: Record<string, unknown>;
+    props: DatabaseCommonInteractionProps;
+    // The settings the write replaces, one entry per project it writes.
+    loadCurrentSettings: () => Promise<Array<StoredProjectAuditLogSettings>>;
+  }): Promise<void> {
+    if (IsBillingEnabled || data.props.isRoot) {
+      return;
+    }
+
+    if (!widensAuditLogging(data.requested, NARROWEST_AUDIT_LOG_SETTINGS)) {
+      return;
+    }
+
+    if (
+      await EnterpriseEdition.isFeatureAvailable(EnterpriseFeature.AuditLogs)
+    ) {
+      return;
+    }
+
+    const currentSettings: Array<StoredProjectAuditLogSettings> =
+      await data.loadCurrentSettings();
+
+    const widens: boolean = currentSettings.some(
+      (current: StoredProjectAuditLogSettings): boolean => {
+        return widensAuditLogging(data.requested, current);
+      },
+    );
+
+    if (!widens) {
+      return;
+    }
+
+    // Throws the Community Edition or the license message, as the case may be.
+    await EnterpriseEdition.assertFeatureAvailable(EnterpriseFeature.AuditLogs);
+  }
+
+  /*
+   * The audit settings of the projects an update matches, limited to the
+   * projects the caller belongs to (every project for a master admin). This
+   * runs in onBeforeUpdate, before the permission check: a refusal that
+   * depended on another project's settings would disclose them, and a write
+   * to a project the caller does not belong to is refused by the permission
+   * check that follows anyway.
+   */
+  private async findAuditLogSettingsInCallerScope(data: {
+    query: Query<Model>;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<Array<StoredProjectAuditLogSettings>> {
+    const projects: Array<Model> = await this.findBy({
+      query: data.query,
+      select: {
+        _id: true,
+        enableAuditLogs: true,
+        storeSystemEventsInAuditLogs: true,
+        auditLogsRetentionInDays: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: { isRoot: true },
+    });
+
+    const callerProjectIds: Array<string> = data.props.isMasterAdmin
+      ? []
+      : [
+          ...(data.props.tenantId ? [data.props.tenantId] : []),
+          ...(data.props.userGlobalAccessPermission?.projectIds || []),
+        ].map((projectId: ObjectID): string => {
+          return projectId.toString();
+        });
+
+    return projects
+      .filter((project: Model): boolean => {
+        return (
+          Boolean(data.props.isMasterAdmin) ||
+          callerProjectIds.includes(String(project._id))
+        );
+      })
+      .map((project: Model): StoredProjectAuditLogSettings => {
+        return {
+          enableAuditLogs: project.enableAuditLogs,
+          storeSystemEventsInAuditLogs: project.storeSystemEventsInAuditLogs,
+          auditLogsRetentionInDays: project.auditLogsRetentionInDays,
+        };
+      });
+  }
+
   @CaptureSpan()
   public async changePlan(params: {
     projectId: ObjectID;
@@ -2570,6 +2816,44 @@ These are no longer recorded against the project and have to be cancelled by han
     return { findBy, carryForward: null };
   }
 
+  /*
+   * While SSO is not active a project's SSO requirement is not enforced: on
+   * the Community Edition (the SSO login routes are part of the Enterprise
+   * Edition), and on an Enterprise install whose license is lapsed or does
+   * not include SSO (the routes refuse). Reads made for a caller then report
+   * the EFFECTIVE value: not required, no required provider. Clients decide
+   * from these columns whether to start an SSO flow - the mobile app hides a
+   * project's on-call data behind an SSO login it cannot complete, and its
+   * store builds cannot be patched.
+   *
+   * Only the returned objects change. Internal (root) reads, and the stored
+   * row, keep the real value, and onBeforeUpdate keeps a caller from writing
+   * the masked value back. So running the Enterprise Edition with a valid
+   * license (or in its trial or grace period) again restores enforcement
+   * exactly as configured.
+   */
+  @CaptureSpan()
+  protected override async onFindSuccess(
+    onFind: OnFind<Model>,
+    items: Array<Model>,
+  ): Promise<OnFind<Model>> {
+    if (
+      EditionEnforcement.shouldMaskSsoRequirementOnRead(onFind.findBy.props)
+    ) {
+      for (const item of items) {
+        if (item.requireSsoForLogin !== undefined) {
+          item.requireSsoForLogin = false;
+        }
+
+        if (item.requireSsoWithSsoProviderId !== undefined) {
+          item.requireSsoWithSsoProviderId = null!;
+        }
+      }
+    }
+
+    return { ...onFind, carryForward: items };
+  }
+
   @CaptureSpan()
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<Model>,