@oneuptime/common 13.0.8 → 14.0.1

package/Server/Infrastructure/Postgres/SchemaMigrations/1794100000000-AddSloLabelAndOwnerRules.ts

@@ -0,0 +1,248 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration. SLO label rules and SLO
+ * owner rules: the two rule tables plus their label, owner user and owner team
+ * join tables. New, empty tables only - nothing existing is touched.
+ */
+export class AddSloLabelAndOwnerRules1794100000000
+  implements MigrationInterface
+{
+  public name: string = "AddSloLabelAndOwnerRules1794100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "ServiceLevelObjectiveOwnerRule" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "criteria" jsonb, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "isEnabled" boolean NOT NULL DEFAULT true, "notifyOwners" boolean NOT NULL DEFAULT true, "serviceLevelObjectiveNamePattern" character varying(500), "serviceLevelObjectiveDescriptionPattern" character varying(500), "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_fcca76effc951a34efbbac08262" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_52a12c08da9cfed82a6d55ee2a" ON "ServiceLevelObjectiveOwnerRule" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_675d55cd050bae45ead9bc5a76" ON "ServiceLevelObjectiveOwnerRule" ("name") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_887a6293429f3079055ca2f593" ON "ServiceLevelObjectiveOwnerRule" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "ServiceLevelObjectiveLabelRule" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "criteria" jsonb, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "isEnabled" boolean NOT NULL DEFAULT true, "serviceLevelObjectiveNamePattern" character varying(500), "serviceLevelObjectiveDescriptionPattern" character varying(500), "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_243e193d772af6b2268c50bc546" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_7bf2cb71d4eadd777dca39d2e5" ON "ServiceLevelObjectiveLabelRule" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_f590d00d3ce34582a752bd8dca" ON "ServiceLevelObjectiveLabelRule" ("name") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_bc184754b090db18209d325dc3" ON "ServiceLevelObjectiveLabelRule" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "ServiceLevelObjectiveOwnerRuleServiceLevelObjectiveLabel" ("serviceLevelObjectiveOwnerRuleId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_abc4ed3e95319b9eddda678fbf2" PRIMARY KEY ("serviceLevelObjectiveOwnerRuleId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_8f61365ab62fb2cda9cabfba6a" ON "ServiceLevelObjectiveOwnerRuleServiceLevelObjectiveLabel" ("serviceLevelObjectiveOwnerRuleId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_a53d5afa239072fbbcd830ee1e" ON "ServiceLevelObjectiveOwnerRuleServiceLevelObjectiveLabel" ("labelId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "ServiceLevelObjectiveOwnerRuleOwnerUser" ("serviceLevelObjectiveOwnerRuleId" uuid NOT NULL, "userId" uuid NOT NULL, CONSTRAINT "PK_815cbebe01771c4cb5391e6c746" PRIMARY KEY ("serviceLevelObjectiveOwnerRuleId", "userId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_bb2984cb07f49c10c2b43a2a71" ON "ServiceLevelObjectiveOwnerRuleOwnerUser" ("serviceLevelObjectiveOwnerRuleId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_0151b4abffe8e16c9ebdd3b4cf" ON "ServiceLevelObjectiveOwnerRuleOwnerUser" ("userId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "ServiceLevelObjectiveOwnerRuleOwnerTeam" ("serviceLevelObjectiveOwnerRuleId" uuid NOT NULL, "teamId" uuid NOT NULL, CONSTRAINT "PK_beb34d84842d0daf68f77cfa1ae" PRIMARY KEY ("serviceLevelObjectiveOwnerRuleId", "teamId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_12919a82600bbabd2ed7554526" ON "ServiceLevelObjectiveOwnerRuleOwnerTeam" ("serviceLevelObjectiveOwnerRuleId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6082f2cc1e7d70c21314f8571b" ON "ServiceLevelObjectiveOwnerRuleOwnerTeam" ("teamId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "ServiceLevelObjectiveLabelRuleServiceLevelObjectiveLabel" ("serviceLevelObjectiveLabelRuleId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_7118b5b1431e0c11443c93b7ee0" PRIMARY KEY ("serviceLevelObjectiveLabelRuleId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5a4fed4da4bd53243128e78ced" ON "ServiceLevelObjectiveLabelRuleServiceLevelObjectiveLabel" ("serviceLevelObjectiveLabelRuleId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_f97e9f9b0f0f138be034ecefe7" ON "ServiceLevelObjectiveLabelRuleServiceLevelObjectiveLabel" ("labelId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "ServiceLevelObjectiveLabelRuleLabelToAdd" ("serviceLevelObjectiveLabelRuleId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_8ed516417c4aabb76de7f4082f6" PRIMARY KEY ("serviceLevelObjectiveLabelRuleId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6511777681392a31b0d8e3ad1d" ON "ServiceLevelObjectiveLabelRuleLabelToAdd" ("serviceLevelObjectiveLabelRuleId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_b41fe48b6a5df099dfe513717d" ON "ServiceLevelObjectiveLabelRuleLabelToAdd" ("labelId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRule" ADD CONSTRAINT "FK_52a12c08da9cfed82a6d55ee2a6" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRule" ADD CONSTRAINT "FK_60f95ff7a6d32473e16dd7a9d96" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRule" ADD CONSTRAINT "FK_7a1bb4246c7029fb5eec8dfbc1c" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRule" ADD CONSTRAINT "FK_7bf2cb71d4eadd777dca39d2e55" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRule" ADD CONSTRAINT "FK_1de61bef2e13d1e25394360ba2e" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRule" ADD CONSTRAINT "FK_72ab545b8be48bcae655b1c83d2" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleServiceLevelObjectiveLabel" ADD CONSTRAINT "FK_8f61365ab62fb2cda9cabfba6a9" FOREIGN KEY ("serviceLevelObjectiveOwnerRuleId") REFERENCES "ServiceLevelObjectiveOwnerRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleServiceLevelObjectiveLabel" ADD CONSTRAINT "FK_a53d5afa239072fbbcd830ee1eb" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleOwnerUser" ADD CONSTRAINT "FK_bb2984cb07f49c10c2b43a2a716" FOREIGN KEY ("serviceLevelObjectiveOwnerRuleId") REFERENCES "ServiceLevelObjectiveOwnerRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleOwnerUser" ADD CONSTRAINT "FK_0151b4abffe8e16c9ebdd3b4cf6" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleOwnerTeam" ADD CONSTRAINT "FK_12919a82600bbabd2ed7554526e" FOREIGN KEY ("serviceLevelObjectiveOwnerRuleId") REFERENCES "ServiceLevelObjectiveOwnerRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleOwnerTeam" ADD CONSTRAINT "FK_6082f2cc1e7d70c21314f8571b9" FOREIGN KEY ("teamId") REFERENCES "Team"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRuleServiceLevelObjectiveLabel" ADD CONSTRAINT "FK_5a4fed4da4bd53243128e78ced0" FOREIGN KEY ("serviceLevelObjectiveLabelRuleId") REFERENCES "ServiceLevelObjectiveLabelRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRuleServiceLevelObjectiveLabel" ADD CONSTRAINT "FK_f97e9f9b0f0f138be034ecefe7c" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRuleLabelToAdd" ADD CONSTRAINT "FK_6511777681392a31b0d8e3ad1de" FOREIGN KEY ("serviceLevelObjectiveLabelRuleId") REFERENCES "ServiceLevelObjectiveLabelRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRuleLabelToAdd" ADD CONSTRAINT "FK_b41fe48b6a5df099dfe513717d8" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRuleLabelToAdd" DROP CONSTRAINT "FK_b41fe48b6a5df099dfe513717d8"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRuleLabelToAdd" DROP CONSTRAINT "FK_6511777681392a31b0d8e3ad1de"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRuleServiceLevelObjectiveLabel" DROP CONSTRAINT "FK_f97e9f9b0f0f138be034ecefe7c"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRuleServiceLevelObjectiveLabel" DROP CONSTRAINT "FK_5a4fed4da4bd53243128e78ced0"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleOwnerTeam" DROP CONSTRAINT "FK_6082f2cc1e7d70c21314f8571b9"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleOwnerTeam" DROP CONSTRAINT "FK_12919a82600bbabd2ed7554526e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleOwnerUser" DROP CONSTRAINT "FK_0151b4abffe8e16c9ebdd3b4cf6"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleOwnerUser" DROP CONSTRAINT "FK_bb2984cb07f49c10c2b43a2a716"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleServiceLevelObjectiveLabel" DROP CONSTRAINT "FK_a53d5afa239072fbbcd830ee1eb"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRuleServiceLevelObjectiveLabel" DROP CONSTRAINT "FK_8f61365ab62fb2cda9cabfba6a9"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRule" DROP CONSTRAINT "FK_72ab545b8be48bcae655b1c83d2"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRule" DROP CONSTRAINT "FK_1de61bef2e13d1e25394360ba2e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveLabelRule" DROP CONSTRAINT "FK_7bf2cb71d4eadd777dca39d2e55"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRule" DROP CONSTRAINT "FK_7a1bb4246c7029fb5eec8dfbc1c"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRule" DROP CONSTRAINT "FK_60f95ff7a6d32473e16dd7a9d96"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveOwnerRule" DROP CONSTRAINT "FK_52a12c08da9cfed82a6d55ee2a6"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b41fe48b6a5df099dfe513717d"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6511777681392a31b0d8e3ad1d"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE "ServiceLevelObjectiveLabelRuleLabelToAdd"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_f97e9f9b0f0f138be034ecefe7"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5a4fed4da4bd53243128e78ced"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE "ServiceLevelObjectiveLabelRuleServiceLevelObjectiveLabel"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6082f2cc1e7d70c21314f8571b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_12919a82600bbabd2ed7554526"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE "ServiceLevelObjectiveOwnerRuleOwnerTeam"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0151b4abffe8e16c9ebdd3b4cf"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_bb2984cb07f49c10c2b43a2a71"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE "ServiceLevelObjectiveOwnerRuleOwnerUser"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_a53d5afa239072fbbcd830ee1e"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_8f61365ab62fb2cda9cabfba6a"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE "ServiceLevelObjectiveOwnerRuleServiceLevelObjectiveLabel"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_bc184754b090db18209d325dc3"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_f590d00d3ce34582a752bd8dca"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_7bf2cb71d4eadd777dca39d2e5"`,
+    );
+    await queryRunner.query(`DROP TABLE "ServiceLevelObjectiveLabelRule"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_887a6293429f3079055ca2f593"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_675d55cd050bae45ead9bc5a76"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_52a12c08da9cfed82a6d55ee2a"`,
+    );
+    await queryRunner.query(`DROP TABLE "ServiceLevelObjectiveOwnerRule"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794200000000-AddSloMonitorRuleMonitorType.ts

@@ -0,0 +1,19 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddSloMonitorRuleMonitorType1794200000000
+  implements MigrationInterface
+{
+  public name: string = "AddSloMonitorRuleMonitorType1794200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveMonitorRule" ADD "monitorType" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ServiceLevelObjectiveMonitorRule" DROP COLUMN "monitorType"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -1,5 +1,8 @@
 import { AddAIInvestigationDecision1793700000000 } from "./1793700000000-AddAIInvestigationDecision";
 import { RemoveMonitorDescriptionLengthLimit1793800000000 } from "./1793800000000-RemoveMonitorDescriptionLengthLimit";
+import { AddEnterpriseEditionFirstSeenAt1793900000000 } from "./1793900000000-AddEnterpriseEditionFirstSeenAt";
+import { AddSloLabelAndOwnerRules1794100000000 } from "./1794100000000-AddSloLabelAndOwnerRules";
+import { AddSloMonitorRuleMonitorType1794200000000 } from "./1794200000000-AddSloMonitorRuleMonitorType";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1200,4 +1203,7 @@ export default [
   MakeOwnerRowsUnique1793500000000,
   AddAIInvestigationDecision1793700000000,
   RemoveMonitorDescriptionLengthLimit1793800000000,
+  AddEnterpriseEditionFirstSeenAt1793900000000,
+  AddSloLabelAndOwnerRules1794100000000,
+  AddSloMonitorRuleMonitorType1794200000000,
 ];

package/Server/Middleware/UserAuthorization.ts

@@ -41,6 +41,7 @@ import Permission, {
 } from "../../Types/Permission";
 import UserType from "../../Types/UserType";
 import UserPermissionUtil from "../Utils/UserPermission/UserPermission";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 
 export default class UserMiddleware {
   /*
@@ -881,10 +882,21 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
+    /*
+     * SSO requirements are enforced while SSO is active: the Enterprise
+     * Edition is loaded and its license covers SSO (or billing is on). The
+     * Community Edition, which has no SSO login routes, and an Enterprise
+     * install whose license lapsed, where those routes refuse, relax them.
+     * Errors and an unknown license state answer "enforce".
+     */
+    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
+
     /*
      * Resolve the SSO requirement and the tenant permission in parallel.
      * `getRequireSsoForLogin` is cached in-process for 60s, so this is
-     * usually free; the tenant permission lookup is the expensive call.
+     * usually free; the tenant permission lookup is the expensive call. It
+     * runs on the Community Edition too: it is also what turns an unknown
+     * project into TenantNotFoundException.
      */
     const [projectRequireSsoForLogin, tenantPermission]: [
       boolean,
@@ -909,8 +921,9 @@ export default class UserMiddleware {
      * can't lock them out — a project's own requireSsoForLogin still applies to
      * them. Only checked when the project doesn't already enforce SSO.
      */
-    let requireSsoForLogin: boolean = projectRequireSsoForLogin;
-    if (!requireSsoForLogin && !isMasterAdmin) {
+    let requireSsoForLogin: boolean =
+      isSsoEnforced && projectRequireSsoForLogin;
+    if (isSsoEnforced && !requireSsoForLogin && !isMasterAdmin) {
       requireSsoForLogin =
         await GlobalConfigService.getRequireSsoForLogin().catch(() => {
           return false;
@@ -957,15 +970,23 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
+    /*
+     * Same rule as the single-tenant path: SSO requirements are enforced
+     * while SSO is active and relaxed on the Community Edition and while the
+     * license does not cover SSO. Decided once for the whole fan-out.
+     */
+    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
+
     /*
      * Instance-wide "Require SSO for Login" forces SSO on every project. Master
      * admins are exempt. Resolved once (cached) rather than per project.
      */
-    const globalRequireSsoForLogin: boolean = isMasterAdmin
-      ? false
-      : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
-          return false;
-        });
+    const globalRequireSsoForLogin: boolean =
+      isMasterAdmin || !isSsoEnforced
+        ? false
+        : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
+            return false;
+          });
 
     /*
      * Resolve permissions for every project in parallel. A project's own
@@ -977,14 +998,15 @@ export default class UserMiddleware {
       permission: UserTenantAccessPermission | null;
     }> = await Promise.all(
       projectIds.map(async (projectId: ObjectID) => {
-        const projectRequireSsoForLogin: boolean =
-          await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
-            /*
-             * Unknown/inaccessible project: do not enforce SSO here. Actual
-             * access is still gated by AccessTokenService below.
-             */
-            return false;
-          });
+        const projectRequireSsoForLogin: boolean = !isSsoEnforced
+          ? false
+          : await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
+              /*
+               * Unknown/inaccessible project: do not enforce SSO here. Actual
+               * access is still gated by AccessTokenService below.
+               */
+              return false;
+            });
 
         const requireSsoForLogin: boolean =
           projectRequireSsoForLogin || globalRequireSsoForLogin;