@oneuptime/common 13.0.8 → 14.0.1

package/Tests/Server/Services/ProjectServiceAuditLogSettingsCache.test.ts

@@ -2,8 +2,9 @@ import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
 import ObjectID from "../../../Types/ObjectID";
 
 /*
- * AuditLogService caches each project's audit settings (enabled, retention,
- * system events, plan) for a minute. Nothing ever invalidated that cache, so
+ * The audit-log recorder (Enterprise Edition, behind core's AuditLogService)
+ * caches each project's audit settings (enabled, retention, system events,
+ * plan) for a minute. Nothing ever invalidated that cache, so
  * for up to a minute after an admin turned audit logging on, the process that
  * saved the setting went on recording nothing - exactly when someone is
  * watching the empty audit page to check that it works. ProjectService now
@@ -34,10 +35,14 @@ jest.mock(
 
 import AuditLogService from "../../../Server/Services/AuditLogService";
 import ProjectService from "../../../Server/Services/ProjectService";
-import Monitor from "../../../Models/DatabaseModels/Monitor";
 import Project from "../../../Models/DatabaseModels/Project";
 import { PlanType } from "../../../Types/Billing/SubscriptionPlan";
-import UserType from "../../../Types/UserType";
+import {
+  createAuditLogRecorderSpy,
+  installFakeEnterpriseModule,
+  MockedAuditLogRecorder,
+  uninstallEnterpriseModule,
+} from "../Enterprise/FakeEnterpriseModule";
 
 type HookCallable = {
   onUpdateSuccess: (
@@ -65,9 +70,11 @@ const updateProject: UpdateProjectFunction = async (
 
 beforeEach(() => {
   jest.clearAllMocks();
+  uninstallEnterpriseModule();
 });
 
 afterEach(() => {
+  uninstallEnterpriseModule();
   jest.restoreAllMocks();
 });
 
@@ -135,42 +142,31 @@ describe("ProjectService invalidates the audit log settings cache", () => {
     expect(invalidate).toHaveBeenCalledTimes(1);
   });
 
-  test("the next audit write in this process reads the new setting", async () => {
+  /*
+   * The cache itself lives in the Enterprise audit-log recorder (ee/), so
+   * "the next write reads the new setting" is pinned there, end to end
+   * (ee/Tests/Server/AuditLog/AuditLogSettingsInvalidation.test.ts). What
+   * core owns is that the invalidation reaches whichever recorder is
+   * registered, and is harmless when none is.
+   */
+  test("the invalidation reaches the Enterprise audit-log recorder", async () => {
+    const recorder: MockedAuditLogRecorder = createAuditLogRecorderSpy();
+    installFakeEnterpriseModule({ auditLogRecorder: recorder });
+
     const projectId: ObjectID = ObjectID.generate();
-    const project: Project = new Project();
-    project._id = projectId.toString();
-    project.enableAuditLogs = true;
-
-    const findProject: jest.SpyInstance = jest
-      .spyOn(ProjectService, "findOneById")
-      .mockResolvedValue(project as never);
-    jest.spyOn(AuditLogService, "create").mockResolvedValue(undefined as never);
-
-    const monitor: Monitor = new Monitor();
-    monitor._id = ObjectID.generate().toString();
-    monitor.name = "Checkout API";
-
-    type RecordFunction = () => Promise<void>;
-
-    const recordMonitorCreate: RecordFunction = async (): Promise<void> => {
-      await AuditLogService.recordCreate({
-        model: new Monitor(),
-        createdItem: monitor,
-        // An API-key actor needs no user lookup.
-        props: { tenantId: projectId, userType: UserType.API },
-      });
-    };
 
-    await recordMonitorCreate();
-    await recordMonitorCreate();
+    await updateProject({ enableAuditLogs: false }, [projectId]);
 
-    // Cached: the second write did not read the project again.
-    expect(findProject).toHaveBeenCalledTimes(1);
+    expect(recorder.invalidateProjectSettings).toHaveBeenCalledTimes(1);
+    expect(recorder.invalidateProjectSettings).toHaveBeenCalledWith(projectId);
+  });
 
-    await updateProject({ enableAuditLogs: false }, [projectId]);
-    await recordMonitorCreate();
+  test("on the Community Edition there is no cache to drop, and the update still succeeds", async () => {
+    uninstallEnterpriseModule();
 
-    expect(findProject).toHaveBeenCalledTimes(2);
+    await expect(
+      updateProject({ enableAuditLogs: true }, [ObjectID.generate()]),
+    ).resolves.toBeUndefined();
   });
 
   test("a failure to invalidate never fails the project update", async () => {

package/Tests/Server/Services/RuleRun/LabelRuleEnginesGroupBRun.test.ts

@@ -28,6 +28,10 @@ import ServiceFeedService from "../../../../Server/Services/ServiceFeedService";
 import ServiceLabelRuleEngineService from "../../../../Server/Services/ServiceLabelRuleEngineService";
 import ServiceLabelRuleService from "../../../../Server/Services/ServiceLabelRuleService";
 import ServiceService from "../../../../Server/Services/ServiceService";
+import ServiceLevelObjectiveFeedService from "../../../../Server/Services/ServiceLevelObjectiveFeedService";
+import ServiceLevelObjectiveLabelRuleEngineService from "../../../../Server/Services/ServiceLevelObjectiveLabelRuleEngineService";
+import ServiceLevelObjectiveLabelRuleService from "../../../../Server/Services/ServiceLevelObjectiveLabelRuleService";
+import ServiceLevelObjectiveService from "../../../../Server/Services/ServiceLevelObjectiveService";
 import StatusPageLabelRuleEngineService from "../../../../Server/Services/StatusPageLabelRuleEngineService";
 import StatusPageLabelRuleService from "../../../../Server/Services/StatusPageLabelRuleService";
 import StatusPageService from "../../../../Server/Services/StatusPageService";
@@ -61,6 +65,8 @@ import ServerlessFunction from "../../../../Models/DatabaseModels/ServerlessFunc
 import ServerlessFunctionLabelRule from "../../../../Models/DatabaseModels/ServerlessFunctionLabelRule";
 import Service from "../../../../Models/DatabaseModels/Service";
 import ServiceLabelRule from "../../../../Models/DatabaseModels/ServiceLabelRule";
+import ServiceLevelObjective from "../../../../Models/DatabaseModels/ServiceLevelObjective";
+import ServiceLevelObjectiveLabelRule from "../../../../Models/DatabaseModels/ServiceLevelObjectiveLabelRule";
 import StatusPage from "../../../../Models/DatabaseModels/StatusPage";
 import StatusPageLabelRule from "../../../../Models/DatabaseModels/StatusPageLabelRule";
 import VMwareVCenter from "../../../../Models/DatabaseModels/VMwareVCenter";
@@ -397,6 +403,47 @@ const cases: Array<LabelEngineCase> = [
     },
     feedResourceIdKey: "serviceId",
   }),
+  labelEngineCase<ServiceLevelObjective, ServiceLevelObjectiveLabelRule>({
+    name: "ServiceLevelObjectiveLabelRuleEngineService",
+    engine: ServiceLevelObjectiveLabelRuleEngineService,
+    applyOnCreate: (resource: ServiceLevelObjective): Promise<void> => {
+      return ServiceLevelObjectiveLabelRuleEngineService.applyRulesToServiceLevelObjective(
+        resource,
+      );
+    },
+    ruleService:
+      ServiceLevelObjectiveLabelRuleService as unknown as RuleReadService,
+    resourceService: ServiceLevelObjectiveService as unknown as ResourceService,
+    resourceModel: ServiceLevelObjective,
+    textField: "name",
+    patternField: "serviceLevelObjectiveNamePattern",
+    labelMatchField: "serviceLevelObjectiveLabels",
+    matchesHandedResource: false,
+    syncsInMemoryLabels: true,
+    severity: null,
+    expectedRuleSelect: {
+      _id: true,
+      name: true,
+      criteria: true,
+      serviceLevelObjectiveLabels: { _id: true },
+      serviceLevelObjectiveNamePattern: true,
+      serviceLevelObjectiveDescriptionPattern: true,
+      labelsToAdd: { _id: true },
+    },
+    expectedResourceSelect: IDS_ONLY_RESOURCE_SELECT,
+    mockFeed: (): jest.SpyInstance => {
+      jest
+        .spyOn(ServiceLevelObjectiveService, "getSloMarkdownLink")
+        .mockResolvedValue(MARKDOWN_LINK);
+      return jest
+        .spyOn(
+          ServiceLevelObjectiveFeedService,
+          "createServiceLevelObjectiveFeedItem",
+        )
+        .mockResolvedValue(undefined);
+    },
+    feedResourceIdKey: "serviceLevelObjectiveId",
+  }),
   labelEngineCase<StatusPage, StatusPageLabelRule>({
     name: "StatusPageLabelRuleEngineService",
     engine: StatusPageLabelRuleEngineService,
@@ -797,7 +844,7 @@ describe("label rule engines (group B) - applying a rule to existing resources",
       cases.map((c: LabelEngineCase) => {
         return c.name;
       }),
-    ).toHaveLength(11);
+    ).toHaveLength(12);
   });
 
   describe.each(cases)("$name", (c: LabelEngineCase) => {

package/Tests/Server/Services/RuleRun/OwnerRuleEnginesGroupBRun.test.ts

@@ -43,6 +43,12 @@ import ServiceOwnerRuleService from "../../../../Server/Services/ServiceOwnerRul
 import ServiceOwnerTeamService from "../../../../Server/Services/ServiceOwnerTeamService";
 import ServiceOwnerUserService from "../../../../Server/Services/ServiceOwnerUserService";
 import ServiceService from "../../../../Server/Services/ServiceService";
+import ServiceLevelObjectiveFeedService from "../../../../Server/Services/ServiceLevelObjectiveFeedService";
+import ServiceLevelObjectiveOwnerRuleEngineService from "../../../../Server/Services/ServiceLevelObjectiveOwnerRuleEngineService";
+import ServiceLevelObjectiveOwnerRuleService from "../../../../Server/Services/ServiceLevelObjectiveOwnerRuleService";
+import ServiceLevelObjectiveOwnerTeamService from "../../../../Server/Services/ServiceLevelObjectiveOwnerTeamService";
+import ServiceLevelObjectiveOwnerUserService from "../../../../Server/Services/ServiceLevelObjectiveOwnerUserService";
+import ServiceLevelObjectiveService from "../../../../Server/Services/ServiceLevelObjectiveService";
 import StatusPageOwnerRuleEngineService from "../../../../Server/Services/StatusPageOwnerRuleEngineService";
 import StatusPageOwnerRuleService from "../../../../Server/Services/StatusPageOwnerRuleService";
 import StatusPageOwnerTeamService from "../../../../Server/Services/StatusPageOwnerTeamService";
@@ -78,6 +84,8 @@ import ServerlessFunctionOwnerTeam from "../../../../Models/DatabaseModels/Serve
 import ServerlessFunctionOwnerUser from "../../../../Models/DatabaseModels/ServerlessFunctionOwnerUser";
 import ServiceOwnerTeam from "../../../../Models/DatabaseModels/ServiceOwnerTeam";
 import ServiceOwnerUser from "../../../../Models/DatabaseModels/ServiceOwnerUser";
+import ServiceLevelObjectiveOwnerTeam from "../../../../Models/DatabaseModels/ServiceLevelObjectiveOwnerTeam";
+import ServiceLevelObjectiveOwnerUser from "../../../../Models/DatabaseModels/ServiceLevelObjectiveOwnerUser";
 import StatusPageOwnerTeam from "../../../../Models/DatabaseModels/StatusPageOwnerTeam";
 import StatusPageOwnerUser from "../../../../Models/DatabaseModels/StatusPageOwnerUser";
 import VMwareVCenterOwnerTeam from "../../../../Models/DatabaseModels/VMwareVCenterOwnerTeam";
@@ -336,6 +344,28 @@ const ENGINE_CASES: Array<EngineCase> = [
     }),
     prepare: noop,
   },
+  {
+    name: "SLO",
+    engine: ServiceLevelObjectiveOwnerRuleEngineService,
+    createHook: "applyRulesToServiceLevelObjective",
+    ruleService: ServiceLevelObjectiveOwnerRuleService,
+    rereadService: ServiceLevelObjectiveService,
+    ownerUserService: ServiceLevelObjectiveOwnerUserService,
+    ownerTeamService: ServiceLevelObjectiveOwnerTeamService,
+    ownerUserModel: ServiceLevelObjectiveOwnerUser,
+    ownerTeamModel: ServiceLevelObjectiveOwnerTeam,
+    resourceIdColumn: "serviceLevelObjectiveId",
+    namePatternField: "serviceLevelObjectiveNamePattern",
+    hasNotificationFlag: true,
+    addOwnersService: null,
+    mockFeed: feedMock({
+      linkService: ServiceLevelObjectiveService,
+      linkMethod: "getSloMarkdownLink",
+      feedService: ServiceLevelObjectiveFeedService,
+      feedMethod: "createServiceLevelObjectiveFeedItem",
+    }),
+    prepare: noop,
+  },
   {
     name: "status page",
     engine: StatusPageOwnerRuleEngineService,

package/Tests/Server/Services/ScimPushGroupsTeamLocksEdition.test.ts

@@ -0,0 +1,431 @@
+import TeamService from "../../../Server/Services/TeamService";
+import TeamMemberService from "../../../Server/Services/TeamMemberService";
+import ProjectSCIMService from "../../../Server/Services/ProjectSCIMService";
+import TeamPermissionService from "../../../Server/Services/TeamPermissionService";
+import OnCallDutyPolicyTimeLogService from "../../../Server/Services/OnCallDutyPolicyTimeLogService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import ModelPermission from "../../../Server/Types/Database/Permissions/Index";
+import Errors from "../../../Server/Utils/Errors";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import Team from "../../../Models/DatabaseModels/Team";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import FakeEnterpriseModule, {
+  createEditionStateCases,
+  createLicenseSnapshotWithStatus,
+  EditionStateCase,
+  installFakeEnterpriseModule,
+  uninstallEnterpriseModule,
+} from "../Enterprise/FakeEnterpriseModule";
+import logger from "../../../Server/Utils/Logger";
+import { setTestBillingEnabled } from "../Enterprise/TestBillingFlag";
+import { getJestSpyOn } from "../../Spy";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+type SpyInstance = ReturnType<typeof getJestSpyOn>;
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  const billingFlag: typeof import("../Enterprise/TestBillingFlag") =
+    jest.requireActual(
+      "../Enterprise/TestBillingFlag",
+    ) as typeof import("../Enterprise/TestBillingFlag");
+
+  return billingFlag.withLiveBillingFlag(
+    jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >,
+  );
+});
+
+/*
+ * SCIM Push Groups team locks. While a project's SCIM configuration has Push
+ * Groups on, its identity provider owns team membership, so OneUptime refuses
+ * to create or delete teams, invite or remove members, and lifts the
+ * "at least one member" guard (the IdP may empty a team).
+ *
+ * The locks follow the RUNTIME state of SCIM
+ * (EnterpriseEdition.isFeatureActive(SCIM), through EditionEnforcement):
+ *   - SCIM active (the Enterprise Edition with billing on, or with a license
+ *     that covers SCIM - valid, grace, trial - or an unknown license state):
+ *     locks ON, the identity provider owns the teams.
+ *   - SCIM not active (the Community Edition, or an Enterprise install whose
+ *     license lapsed): locks OFF. No SCIM endpoint answers the identity
+ *     provider there, so a Push Groups setting left on would leave teams
+ *     nobody can manage.
+ * A license change applies to the next write, without a restart.
+ *
+ * Billing and the edition are pinned in every test.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const TEAM_ID: ObjectID = new ObjectID("44444444-4444-4444-8444-444444444444");
+const USER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const INVITEE_ID: ObjectID = new ObjectID(
+  "55555555-5555-4555-8555-555555555555",
+);
+
+const EDITION_CASES: Array<EditionStateCase> = createEditionStateCases();
+
+const toMatrix: (
+  cases: Array<EditionStateCase>,
+) => Array<[string, EditionStateCase]> = (
+  cases: Array<EditionStateCase>,
+): Array<[string, EditionStateCase]> => {
+  return cases.map(
+    (editionCase: EditionStateCase): [string, EditionStateCase] => {
+      return [editionCase.label, editionCase];
+    },
+  );
+};
+
+// Every state in which SCIM is active, so Push Groups locks the teams.
+const LOCKED_MATRIX: Array<[string, EditionStateCase]> = toMatrix(
+  EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+    return editionCase.isActive;
+  }),
+);
+
+// The Community Edition and every lapsed Enterprise license: not locked.
+const UNLOCKED_MATRIX: Array<[string, EditionStateCase]> = toMatrix(
+  EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+    return !editionCase.isActive;
+  }),
+);
+
+const userProps: () => Record<string, unknown> = (): Record<
+  string,
+  unknown
+> => {
+  return { userId: USER_ID, tenantId: PROJECT_ID };
+};
+
+const buildTeam: () => Team = (): Team => {
+  const team: Team = new Team();
+  team._id = TEAM_ID.toString();
+  team.name = "Backend";
+  team.projectId = PROJECT_ID;
+  team.isTeamDeleteable = true;
+  return team;
+};
+
+const buildMember: (data: {
+  shouldHaveAtLeastOneMember: boolean;
+}) => TeamMember = (data: {
+  shouldHaveAtLeastOneMember: boolean;
+}): TeamMember => {
+  const member: TeamMember = new TeamMember();
+  member.userId = INVITEE_ID;
+  member.projectId = PROJECT_ID;
+  member.teamId = TEAM_ID;
+  member.hasAcceptedInvitation = true;
+
+  const team: Team = new Team();
+  team._id = TEAM_ID.toString();
+  team.shouldHaveAtLeastOneMember = data.shouldHaveAtLeastOneMember;
+  member.team = team;
+
+  return member;
+};
+
+let scimCount: SpyInstance;
+
+describe("SCIM Push Groups team locks by edition", () => {
+  beforeEach(() => {
+    setTestBillingEnabled(false);
+    uninstallEnterpriseModule();
+
+    getJestSpyOn(logger, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+    getJestSpyOn(logger, "info").mockImplementation((): void => {
+      return undefined;
+    });
+
+    // Push Groups is ON for the project in every test below.
+    scimCount = getJestSpyOn(ProjectSCIMService, "countBy").mockResolvedValue(
+      new PositiveNumber(1),
+    );
+  });
+
+  afterEach(() => {
+    uninstallEnterpriseModule();
+    setTestBillingEnabled(false);
+    jest.restoreAllMocks();
+  });
+
+  describe("TeamService: creating and deleting teams", () => {
+    const createTeam: (props: Record<string, unknown>) => Promise<unknown> = (
+      props: Record<string, unknown>,
+    ): Promise<unknown> => {
+      const team: Team = new Team();
+      team.projectId = PROJECT_ID;
+      team.name = "Backend";
+
+      return (TeamService as any).onBeforeCreate({
+        data: team,
+        props: props,
+      });
+    };
+
+    const deleteTeam: (props: Record<string, unknown>) => Promise<unknown> = (
+      props: Record<string, unknown>,
+    ): Promise<unknown> => {
+      return (TeamService as any).onBeforeDelete({
+        query: { _id: TEAM_ID },
+        props: props,
+      });
+    };
+
+    let memberDelete: SpyInstance;
+
+    beforeEach(() => {
+      getJestSpyOn(TeamService, "findBy").mockResolvedValue([buildTeam()]);
+      getJestSpyOn(
+        ModelPermission,
+        "checkDeleteQueryPermission",
+      ).mockImplementation(
+        async (_modelType: unknown, query: unknown): Promise<unknown> => {
+          return query;
+        },
+      );
+      memberDelete = getJestSpyOn(
+        TeamMemberService,
+        "deleteBy",
+      ).mockResolvedValue(0);
+    });
+
+    test.each(LOCKED_MATRIX)(
+      "SCIM active (%s): creating a team is locked",
+      async (_label: string, editionCase: EditionStateCase) => {
+        editionCase.apply();
+
+        await expect(createTeam(userProps())).rejects.toThrow(
+          "Cannot create teams while SCIM Push Groups is enabled for this project",
+        );
+      },
+    );
+
+    test.each(LOCKED_MATRIX)(
+      "SCIM active (%s): deleting a team is locked before any member is removed",
+      async (_label: string, editionCase: EditionStateCase) => {
+        editionCase.apply();
+
+        await expect(deleteTeam(userProps())).rejects.toThrow(
+          "Cannot delete teams while SCIM Push Groups is enabled for this project",
+        );
+        expect(memberDelete).not.toHaveBeenCalled();
+      },
+    );
+
+    test.each(UNLOCKED_MATRIX)(
+      "SCIM not active (%s): creating a team is not locked and SCIM is not consulted",
+      async (_label: string, editionCase: EditionStateCase) => {
+        editionCase.apply();
+
+        await expect(createTeam(userProps())).resolves.toEqual(
+          expect.objectContaining({ carryForward: null }),
+        );
+        expect(scimCount).not.toHaveBeenCalled();
+      },
+    );
+
+    test.each(UNLOCKED_MATRIX)(
+      "SCIM not active (%s): deleting a team is not locked",
+      async (_label: string, editionCase: EditionStateCase) => {
+        editionCase.apply();
+
+        await expect(deleteTeam(userProps())).resolves.toEqual(
+          expect.objectContaining({ carryForward: null }),
+        );
+        expect(scimCount).not.toHaveBeenCalled();
+        expect(memberDelete).toHaveBeenCalledTimes(1);
+      },
+    );
+
+    test("internal root writes are never locked, on either edition", async () => {
+      installFakeEnterpriseModule();
+
+      await expect(createTeam({ isRoot: true })).resolves.toBeDefined();
+      await expect(deleteTeam({ isRoot: true })).resolves.toBeDefined();
+      expect(scimCount).not.toHaveBeenCalled();
+    });
+
+    test("with Push Groups off the Enterprise Edition does not lock either", async () => {
+      installFakeEnterpriseModule();
+      scimCount.mockResolvedValue(new PositiveNumber(0));
+
+      await expect(createTeam(userProps())).resolves.toBeDefined();
+      await expect(deleteTeam(userProps())).resolves.toBeDefined();
+      expect(scimCount).toHaveBeenCalled();
+    });
+  });
+
+  describe("TeamMemberService: inviting and removing members", () => {
+    const inviteMember: (props: Record<string, unknown>) => Promise<unknown> = (
+      props: Record<string, unknown>,
+    ): Promise<unknown> => {
+      const member: TeamMember = new TeamMember();
+      member.projectId = PROJECT_ID;
+      member.teamId = TEAM_ID;
+      member.userId = INVITEE_ID;
+
+      return (TeamMemberService as any).onBeforeCreate({
+        data: member,
+        props: props,
+      });
+    };
+
+    const removeMember: (props: Record<string, unknown>) => Promise<unknown> = (
+      props: Record<string, unknown>,
+    ): Promise<unknown> => {
+      return (TeamMemberService as any).onBeforeDelete({
+        query: { teamId: TEAM_ID, userId: INVITEE_ID },
+        props: props,
+      });
+    };
+
+    let memberLookup: SpyInstance;
+
+    beforeEach(() => {
+      getJestSpyOn(TeamService, "findOneBy").mockResolvedValue(buildTeam());
+      getJestSpyOn(
+        TeamPermissionService,
+        "assertCanGrantTeamPermissions",
+      ).mockResolvedValue(undefined);
+      // "Is this user already invited?" - no.
+      getJestSpyOn(TeamMemberService, "findOneBy").mockResolvedValue(null);
+      memberLookup = getJestSpyOn(
+        TeamMemberService,
+        "findBy",
+      ).mockResolvedValue([buildMember({ shouldHaveAtLeastOneMember: false })]);
+      getJestSpyOn(
+        OnCallDutyPolicyTimeLogService,
+        "endTimeForUser",
+      ).mockResolvedValue(undefined);
+      // The billing seat check (billing on) finds no seat limit.
+      getJestSpyOn(ProjectService, "findOneById").mockResolvedValue(null);
+    });
+
+    test.each(LOCKED_MATRIX)(
+      "SCIM active (%s): inviting a member is locked",
+      async (_label: string, editionCase: EditionStateCase) => {
+        editionCase.apply();
+
+        await expect(inviteMember(userProps())).rejects.toThrow(
+          "Cannot invite team members while SCIM Push Groups is enabled for this project",
+        );
+      },
+    );
+
+    test.each(LOCKED_MATRIX)(
+      "SCIM active (%s): removing a member is locked",
+      async (_label: string, editionCase: EditionStateCase) => {
+        editionCase.apply();
+
+        await expect(removeMember(userProps())).rejects.toThrow(
+          "Cannot delete team members while SCIM Push Groups is enabled for this project",
+        );
+      },
+    );
+
+    test.each(UNLOCKED_MATRIX)(
+      "SCIM not active (%s): inviting a member is not locked",
+      async (_label: string, editionCase: EditionStateCase) => {
+        editionCase.apply();
+
+        await expect(inviteMember(userProps())).resolves.toEqual(
+          expect.objectContaining({ carryForward: null }),
+        );
+        expect(scimCount).not.toHaveBeenCalled();
+      },
+    );
+
+    test.each(UNLOCKED_MATRIX)(
+      "SCIM not active (%s): removing a member is not locked",
+      async (_label: string, editionCase: EditionStateCase) => {
+        editionCase.apply();
+
+        await expect(removeMember(userProps())).resolves.toEqual(
+          expect.objectContaining({ deleteBy: expect.anything() }),
+        );
+        expect(scimCount).not.toHaveBeenCalled();
+      },
+    );
+
+    describe("the one-member guard", () => {
+      beforeEach(() => {
+        memberLookup.mockResolvedValue([
+          buildMember({ shouldHaveAtLeastOneMember: true }),
+        ]);
+        // The member being removed is the team's last accepted member.
+        getJestSpyOn(TeamMemberService, "countBy").mockResolvedValue(
+          new PositiveNumber(1),
+        );
+      });
+
+      test("is lifted while SCIM is active and Push Groups owns the team (the IdP may empty it)", async () => {
+        installFakeEnterpriseModule({
+          snapshot: createLicenseSnapshotWithStatus("grace"),
+        });
+
+        await expect(removeMember({ isRoot: true })).resolves.toBeDefined();
+      });
+
+      test("applies again once the license lapsed, because no IdP manages the team any more", async () => {
+        installFakeEnterpriseModule({
+          snapshot: createLicenseSnapshotWithStatus("expired"),
+        });
+
+        await expect(removeMember({ isRoot: true })).rejects.toThrow(
+          Errors.TeamMemberService.ONE_MEMBER_REQUIRED,
+        );
+        expect(scimCount).not.toHaveBeenCalled();
+      });
+
+      test("applies on the Community Edition, where no IdP manages the team", async () => {
+        await expect(removeMember({ isRoot: true })).rejects.toThrow(
+          Errors.TeamMemberService.ONE_MEMBER_REQUIRED,
+        );
+        expect(scimCount).not.toHaveBeenCalled();
+      });
+    });
+
+    test("internal root invites are never locked", async () => {
+      installFakeEnterpriseModule();
+
+      await expect(inviteMember({ isRoot: true })).resolves.toBeDefined();
+    });
+
+    test("the lock follows the license at write time: relaxed while lapsed, back after renewal", async () => {
+      const fake: FakeEnterpriseModule = installFakeEnterpriseModule({
+        snapshot: createLicenseSnapshotWithStatus("valid"),
+      });
+
+      await expect(inviteMember(userProps())).rejects.toThrow(
+        "Cannot invite team members while SCIM Push Groups is enabled for this project",
+      );
+
+      fake.setSnapshot(createLicenseSnapshotWithStatus("missing"));
+
+      await expect(inviteMember(userProps())).resolves.toEqual(
+        expect.objectContaining({ carryForward: null }),
+      );
+
+      fake.setSnapshot(createLicenseSnapshotWithStatus("valid"));
+
+      await expect(inviteMember(userProps())).rejects.toThrow(
+        "Cannot invite team members while SCIM Push Groups is enabled for this project",
+      );
+    });
+  });
+});