@oneuptime/common 14.0.10 → 14.0.11

package/Tests/Server/API/KubernetesClusterAiAccessAPI.test.ts

@@ -739,7 +739,8 @@ describe("KubernetesClusterAiAccessAPI", () => {
 
       await callRoute(TEST_ROUTE);
 
-      expect(redact).toHaveBeenCalledWith("Client Version: v1.31.4");
+      // The access test keeps the shared default cap (no paging there).
+      expect(redact).toHaveBeenCalledWith("Client Version: v1.31.4", undefined);
     });
 
     test("still runs when only the project AI switch or the LLM provider is missing (neither is transport)", async () => {

package/Tests/Server/API/{SsoProviderListingsEdition.test.ts → SsoProviderListings.test.ts}

@@ -23,8 +23,10 @@ import ProjectSSO from "../../../Models/DatabaseModels/ProjectSso";
 import StatusPage from "../../../Models/DatabaseModels/StatusPage";
 import StatusPageOIDC from "../../../Models/DatabaseModels/StatusPageOidc";
 import StatusPageSSO from "../../../Models/DatabaseModels/StatusPageSso";
+import EnterpriseEdition from "../../../Server/Enterprise/EnterpriseEdition";
 import FakeEnterpriseModule, {
   createEditionStateCases,
+  createLicenseSnapshot,
   createLicenseSnapshotWithStatus,
   EditionStateCase,
   installFakeEnterpriseModule,
@@ -82,16 +84,14 @@ jest.mock("../../../Server/EnvironmentConfig", () => {
  * The provider lists that sign-in pages offer, and the status page's own
  * "should I force SSO / offer SSO" flags.
  *
- * The SAML/OIDC login routes answer only while SSO is ACTIVE
- * (EnterpriseEdition.isFeatureActive(SSO), through EditionEnforcement): the
- * Enterprise Edition with billing on, or with a license that covers SSO
- * (valid, grace, trial), or while the license state is unknown. So:
- *   - SSO active: providers are listed as configured, and a status page's
- *     SSO requirement is reported.
- *   - SSO not active - the Community Edition, or an Enterprise install whose
- *     license lapsed: every list is empty and the status page reports no SSO,
- *     so no client sends a user into a route that answers 404 or refuses.
- *     Nothing is even read from the provider tables.
+ * Single sign-on is part of the Community Edition: the SAML/OIDC sign-in
+ * routes answer in every edition, so in EVERY edition and license state - the
+ * Community Edition (billing off and on), the Enterprise Edition licensed, in
+ * its trial or grace, lapsed, with a license that leaves SCIM and audit logs
+ * out, or in an unknown license state, and OneUptime Cloud - these routes
+ * list the enabled providers, and the master page reports the stored "Require
+ * SSO for login" and the real number of enabled SAML providers. Nothing here
+ * asks the license.
  *
  * Billing and the edition are pinned in every test. This suite runs without
  * ee/: it uses the fake enterprise module only.
@@ -193,7 +193,36 @@ const listedItems: () => Array<unknown> = (): Array<unknown> => {
   return items;
 };
 
-describe("SSO provider listings and status page SSO flags, by edition", () => {
+// The master page's payload for a status page as stored.
+const readMasterPage: (stored: {
+  requireSsoForLogin: boolean;
+}) => Promise<JSONObject> = async (stored: {
+  requireSsoForLogin: boolean;
+}): Promise<JSONObject> => {
+  const statusPage: StatusPage = new StatusPage();
+  statusPage.id = STATUS_PAGE_ID;
+  statusPage.pageTitle = "Customer Status";
+  statusPage.requireSsoForLogin = stored.requireSsoForLogin;
+
+  getJestSpyOn(StatusPageService, "findOneById").mockResolvedValue(statusPage);
+  getJestSpyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
+  getJestSpyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
+  getJestSpyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(null);
+
+  (Response.sendJsonObjectResponse as jest.Mock).mockClear();
+
+  await invoke({
+    route: MASTER_PAGE_ROUTE,
+    params: { statusPageId: STATUS_PAGE_ID.toString() },
+  });
+
+  expect(Response.sendJsonObjectResponse).toHaveBeenCalledTimes(1);
+
+  return (Response.sendJsonObjectResponse as jest.Mock).mock
+    .calls[0]![2] as JSONObject;
+};
+
+describe("SSO provider listings and status page SSO flags in every edition", () => {
   const originalHost: string | undefined = process.env["HOST"];
 
   let projectSsoFind: SpyInstance;
@@ -214,6 +243,12 @@ describe("SSO provider listings and status page SSO flags, by edition", () => {
     process.env["HOST"] = "app.example.com";
     setTestBillingEnabled(false);
     uninstallEnterpriseModule();
+    getJestSpyOn(logger, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+    getJestSpyOn(logger, "info").mockImplementation((): void => {
+      return undefined;
+    });
 
     projectSsoFind = getJestSpyOn(
       ProjectSsoService,
@@ -249,12 +284,22 @@ describe("SSO provider listings and status page SSO flags, by edition", () => {
     }
   });
 
-  test("the cases include lapsed Enterprise licenses, not just the two editions", () => {
+  test("the cases include the Community Edition, lapsed Enterprise licenses and the Cloud", () => {
+    expect(
+      EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+        return !editionCase.isLoaded;
+      }),
+    ).toHaveLength(2);
     expect(
       EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
         return editionCase.isLoaded && !editionCase.isActive;
       }).length,
     ).toBeGreaterThanOrEqual(4);
+    expect(
+      EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+        return editionCase.isLoaded && editionCase.billing;
+      }).length,
+    ).toBeGreaterThan(0);
   });
 
   describe.each(
@@ -266,167 +311,176 @@ describe("SSO provider listings and status page SSO flags, by edition", () => {
   )("%s", (_label: string, editionCase: EditionStateCase) => {
     beforeEach(() => {
       editionCase.apply();
-      getJestSpyOn(logger, "warn").mockImplementation((): void => {
-        return undefined;
-      });
     });
 
-    test(`project SSO list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+    test("the project SSO list lists the enabled providers", async () => {
       await invoke({
         route: PROJECT_SSO_ROUTE,
         params: { projectId: PROJECT_ID.toString() },
       });
 
-      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
-
-      if (editionCase.isActive) {
-        expect(projectSsoFind).toHaveBeenCalledWith(
-          expect.objectContaining({
-            query: { projectId: PROJECT_ID, isEnabled: true },
-            props: { isRoot: true },
-          }),
-        );
-      } else {
-        expect(projectSsoFind).not.toHaveBeenCalled();
-      }
+      expect(listedItems()).toHaveLength(1);
+      expect(projectSsoFind).toHaveBeenCalledTimes(1);
+      expect(projectSsoFind).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: { projectId: PROJECT_ID, isEnabled: true },
+          select: { name: true, description: true, _id: true },
+          props: { isRoot: true },
+        }),
+      );
     });
 
-    test(`project OIDC list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+    test("the project OIDC list lists the enabled providers", async () => {
       await invoke({
         route: PROJECT_OIDC_ROUTE,
         params: { projectId: PROJECT_ID.toString() },
       });
 
-      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
-      expect(projectOidcFind).toHaveBeenCalledTimes(
-        editionCase.isActive ? 1 : 0,
+      expect(listedItems()).toHaveLength(1);
+      expect(projectOidcFind).toHaveBeenCalledTimes(1);
+      expect(projectOidcFind).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: { projectId: PROJECT_ID, isEnabled: true },
+          props: { isRoot: true },
+        }),
       );
     });
 
-    test(`status page SSO list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+    test("the status page SSO list lists the enabled providers", async () => {
       await invoke({
         route: STATUS_PAGE_SSO_ROUTE,
         params: { statusPageId: STATUS_PAGE_ID.toString() },
       });
 
-      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
-      expect(statusPageSsoFind).toHaveBeenCalledTimes(
-        editionCase.isActive ? 1 : 0,
+      expect(listedItems()).toHaveLength(1);
+      expect(statusPageSsoFind).toHaveBeenCalledTimes(1);
+      expect(statusPageSsoFind).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: { statusPageId: STATUS_PAGE_ID, isEnabled: true },
+          props: { isRoot: true },
+        }),
       );
     });
 
-    test(`status page OIDC list ${editionCase.isActive ? "lists the enabled providers" : "is empty"}`, async () => {
+    test("the status page OIDC list lists the enabled providers", async () => {
       await invoke({
         route: STATUS_PAGE_OIDC_ROUTE,
         params: { statusPageId: STATUS_PAGE_ID.toString() },
       });
 
-      expect(listedItems()).toHaveLength(editionCase.isActive ? 1 : 0);
-      expect(statusPageOidcFind).toHaveBeenCalledTimes(
-        editionCase.isActive ? 1 : 0,
+      expect(listedItems()).toHaveLength(1);
+      expect(statusPageOidcFind).toHaveBeenCalledTimes(1);
+      expect(statusPageOidcFind).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: { statusPageId: STATUS_PAGE_ID, isEnabled: true },
+          props: { isRoot: true },
+        }),
       );
     });
 
-    test(`master page ${editionCase.isActive ? "reports the stored SSO requirement and providers" : "reports no SSO (effective value) and leaves the stored value alone"}`, async () => {
-      const statusPage: StatusPage = new StatusPage();
-      statusPage.id = STATUS_PAGE_ID;
-      statusPage.pageTitle = "Customer Status";
-      statusPage.requireSsoForLogin = true;
-
-      const findStatusPage: SpyInstance = getJestSpyOn(
-        StatusPageService,
-        "findOneById",
-      ).mockResolvedValue(statusPage);
-      getJestSpyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
-      getJestSpyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
-      getJestSpyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(
-        null,
-      );
+    test("an empty provider table is an empty list", async () => {
+      projectSsoFind.mockResolvedValue([]);
 
       await invoke({
-        route: MASTER_PAGE_ROUTE,
-        params: { statusPageId: STATUS_PAGE_ID.toString() },
+        route: PROJECT_SSO_ROUTE,
+        params: { projectId: PROJECT_ID.toString() },
       });
 
-      expect(Response.sendJsonObjectResponse).toHaveBeenCalledTimes(1);
+      expect(listedItems()).toEqual([]);
+    });
 
-      const payload: JSONObject = (Response.sendJsonObjectResponse as jest.Mock)
-        .mock.calls[0]![2] as JSONObject;
+    test("the master page reports the stored SSO requirement and the enabled providers", async () => {
+      const payload: JSONObject = await readMasterPage({
+        requireSsoForLogin: true,
+      });
 
       expect((payload["statusPage"] as JSONObject)["requireSsoForLogin"]).toBe(
-        editionCase.isActive,
+        true,
       );
-      expect(payload["hasEnabledSSO"]).toBe(editionCase.isActive ? 2 : 0);
-      expect(statusPageSsoCount).toHaveBeenCalledTimes(
-        editionCase.isActive ? 1 : 0,
+      expect(payload["hasEnabledSSO"]).toBe(2);
+      expect(statusPageSsoCount).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: { isEnabled: true, statusPageId: STATUS_PAGE_ID },
+          props: { isRoot: true },
+        }),
       );
-
-      // The stored requirement is still read, never written.
-      expect(findStatusPage).toHaveBeenCalledWith(
+      expect(StatusPageService.findOneById).toHaveBeenCalledWith(
         expect.objectContaining({
           select: expect.objectContaining({ requireSsoForLogin: true }),
           props: { isRoot: true },
         }),
       );
     });
-  });
 
-  test("the lists follow the license at request time: empty while lapsed, listed again after renewal", async () => {
-    getJestSpyOn(logger, "warn").mockImplementation((): void => {
-      return undefined;
-    });
-    getJestSpyOn(logger, "info").mockImplementation((): void => {
-      return undefined;
+    test("the master page reports a page that does not require SSO, with no providers, as such", async () => {
+      statusPageSsoCount.mockResolvedValue(new PositiveNumber(0));
+
+      const payload: JSONObject = await readMasterPage({
+        requireSsoForLogin: false,
+      });
+
+      expect((payload["statusPage"] as JSONObject)["requireSsoForLogin"]).toBe(
+        false,
+      );
+      expect(payload["hasEnabledSSO"]).toBe(0);
     });
+  });
 
+  test("license changes never empty the lists or hide the requirement", async () => {
     const fake: FakeEnterpriseModule = installFakeEnterpriseModule({
-      snapshot: createLicenseSnapshotWithStatus("expired"),
+      snapshot: createLicenseSnapshotWithStatus("valid"),
     });
 
-    await invoke({
-      route: PROJECT_SSO_ROUTE,
-      params: { projectId: PROJECT_ID.toString() },
-    });
+    for (const snapshot of [
+      createLicenseSnapshotWithStatus("expired"),
+      createLicenseSnapshotWithStatus("valid"),
+      createLicenseSnapshotWithStatus("invalid"),
+      createLicenseSnapshot({ features: [] }),
+      null,
+    ]) {
+      fake.setSnapshot(snapshot);
+      (Response.sendEntityArrayResponse as jest.Mock).mockClear();
 
-    expect(listedItems()).toHaveLength(0);
-    expect(projectSsoFind).not.toHaveBeenCalled();
+      await invoke({
+        route: PROJECT_SSO_ROUTE,
+        params: { projectId: PROJECT_ID.toString() },
+      });
 
-    fake.setSnapshot(createLicenseSnapshotWithStatus("valid"));
-    (Response.sendEntityArrayResponse as jest.Mock).mockClear();
+      expect(listedItems()).toHaveLength(1);
 
-    await invoke({
-      route: PROJECT_SSO_ROUTE,
-      params: { projectId: PROJECT_ID.toString() },
-    });
+      const payload: JSONObject = await readMasterPage({
+        requireSsoForLogin: true,
+      });
 
-    expect(listedItems()).toHaveLength(1);
-    expect(projectSsoFind).toHaveBeenCalledTimes(1);
-  });
+      expect((payload["statusPage"] as JSONObject)["requireSsoForLogin"]).toBe(
+        true,
+      );
+      expect(payload["hasEnabledSSO"]).toBe(2);
+    }
 
-  test("the master page reports a page that does not require SSO the same way on both editions", async () => {
-    const statusPage: StatusPage = new StatusPage();
-    statusPage.id = STATUS_PAGE_ID;
-    statusPage.requireSsoForLogin = false;
+    expect(projectSsoFind).toHaveBeenCalledTimes(5);
+  });
 
-    getJestSpyOn(StatusPageService, "findOneById").mockResolvedValue(
-      statusPage,
+  test("no listing asks the enterprise facade", async () => {
+    installFakeEnterpriseModule({
+      snapshot: createLicenseSnapshotWithStatus("expired"),
+    });
+    const isFeatureActive: SpyInstance = getJestSpyOn(
+      EnterpriseEdition,
+      "isFeatureActive",
     );
-    getJestSpyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
-    getJestSpyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
-    getJestSpyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(null);
 
-    installFakeEnterpriseModule();
-
-    await invoke({
-      route: MASTER_PAGE_ROUTE,
-      params: { statusPageId: STATUS_PAGE_ID.toString() },
-    });
+    for (const [route, params] of [
+      [PROJECT_SSO_ROUTE, { projectId: PROJECT_ID.toString() }],
+      [PROJECT_OIDC_ROUTE, { projectId: PROJECT_ID.toString() }],
+      [STATUS_PAGE_SSO_ROUTE, { statusPageId: STATUS_PAGE_ID.toString() }],
+      [STATUS_PAGE_OIDC_ROUTE, { statusPageId: STATUS_PAGE_ID.toString() }],
+    ] as Array<[string, Record<string, string>]>) {
+      await invoke({ route, params });
+    }
 
-    const payload: JSONObject = (Response.sendJsonObjectResponse as jest.Mock)
-      .mock.calls[0]![2] as JSONObject;
+    await readMasterPage({ requireSsoForLogin: true });
 
-    expect((payload["statusPage"] as JSONObject)["requireSsoForLogin"]).toBe(
-      false,
-    );
+    expect(isFeatureActive).not.toHaveBeenCalled();
   });
 });

package/Tests/Server/Enterprise/EnterpriseEdition.test.ts

@@ -9,7 +9,9 @@ import {
 } from "@jest/globals";
 import fs from "fs";
 import path from "path";
-import EnterpriseEdition from "../../../Server/Enterprise/EnterpriseEdition";
+import EnterpriseEdition, {
+  RUNTIME_ENTERPRISE_FEATURES,
+} from "../../../Server/Enterprise/EnterpriseEdition";
 import EnterpriseFeature, {
   ALL_ENTERPRISE_FEATURES,
 } from "../../../Server/Enterprise/EnterpriseFeature";
@@ -353,10 +355,10 @@ describe("EnterpriseEdition fails closed on an unknown license", () => {
     installFakeEnterpriseModule({ snapshot: null });
 
     expect(
-      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SSO),
+      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SCIM),
     ).toBe(false);
     expect(() => {
-      EnterpriseEdition.assertFeatureAvailableSync(EnterpriseFeature.SSO);
+      EnterpriseEdition.assertFeatureAvailableSync(EnterpriseFeature.SCIM);
     }).toThrow(EnterpriseEdition.LICENSE_REQUIRED_MESSAGE);
   });
 
@@ -411,10 +413,10 @@ describe("EnterpriseEdition fails closed on an unknown license", () => {
     });
 
     expect(
-      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SSO),
+      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SCIM),
     ).toBe(false);
     expect(
-      await EnterpriseEdition.isFeatureAvailable(EnterpriseFeature.SSO),
+      await EnterpriseEdition.isFeatureAvailable(EnterpriseFeature.SCIM),
     ).toBe(true);
   });
 
@@ -426,7 +428,7 @@ describe("EnterpriseEdition fails closed on an unknown license", () => {
     });
 
     expect(
-      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SSO),
+      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SCIM),
     ).toBe(false);
   });
 
@@ -438,10 +440,10 @@ describe("EnterpriseEdition fails closed on an unknown license", () => {
     fake.licensing.getSnapshotError = new Error("never asked");
 
     expect(
-      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SSO),
+      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SCIM),
     ).toBe(true);
     expect(
-      await EnterpriseEdition.isFeatureAvailable(EnterpriseFeature.SSO),
+      await EnterpriseEdition.isFeatureAvailable(EnterpriseFeature.SCIM),
     ).toBe(true);
   });
 });
@@ -455,17 +457,17 @@ describe("EnterpriseEdition reads billing at call time", () => {
     setTestBillingEnabled(false);
     expect(isTestBillingEnabled()).toBe(false);
     expect(
-      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SSO),
+      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SCIM),
     ).toBe(false);
 
     setTestBillingEnabled(true);
     expect(
-      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SSO),
+      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SCIM),
     ).toBe(true);
 
     setTestBillingEnabled(false);
     expect(
-      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SSO),
+      EnterpriseEdition.isFeatureAvailableSync(EnterpriseFeature.SCIM),
     ).toBe(false);
   });
 
@@ -518,10 +520,10 @@ describe("EnterpriseEdition unavailable messages", () => {
   test("the license message never claims existing configuration keeps working", () => {
     /*
      * Every configuration write refused on a lapsed license answers with
-     * this message - SSO, OIDC and SCIM models, and the audit log settings -
-     * and for those features nothing keeps working: SSO, SCIM and audit
-     * logging stop (EnterpriseEdition.isFeatureActive). The configuration is
-     * only kept.
+     * this message - SCIM and team compliance models, and the audit log
+     * settings - and for those features nothing keeps working: SCIM and
+     * audit logging stop (EnterpriseEdition.isFeatureActive). The
+     * configuration is only kept.
      */
     expect(EnterpriseEdition.LICENSE_REQUIRED_MESSAGE).not.toMatch(
       /keeps? (?:on )?working|keeps? running|continues? to work/i,
@@ -563,14 +565,16 @@ describe("EnterpriseEdition unavailable messages", () => {
 
   test("a valid license that does not include the feature gets the license message", () => {
     installFakeEnterpriseModule({
-      snapshot: createLicenseSnapshot({ features: [EnterpriseFeature.SSO] }),
+      snapshot: createLicenseSnapshot({
+        features: [EnterpriseFeature.AuditLogs],
+      }),
     });
 
     expect(() => {
       EnterpriseEdition.assertFeatureAvailableSync(EnterpriseFeature.SCIM);
     }).toThrow(EnterpriseEdition.LICENSE_REQUIRED_MESSAGE);
     expect(() => {
-      EnterpriseEdition.assertFeatureAvailableSync(EnterpriseFeature.SSO);
+      EnterpriseEdition.assertFeatureAvailableSync(EnterpriseFeature.AuditLogs);
     }).not.toThrow();
   });
 
@@ -578,7 +582,7 @@ describe("EnterpriseEdition unavailable messages", () => {
     let caught: unknown = undefined;
 
     try {
-      EnterpriseEdition.assertFeatureAvailableSync(EnterpriseFeature.SSO);
+      EnterpriseEdition.assertFeatureAvailableSync(EnterpriseFeature.SCIM);
     } catch (err) {
       caught = err;
     }
@@ -701,27 +705,43 @@ describe("EnterpriseEdition audit log recorder", () => {
 describe("EnterpriseEdition runtime state (isFeatureActive)", () => {
   /*
    * The full matrix, the unknown-state rule and the lapse log live in
-   * EnterpriseFeatureActive.test.ts. The old shouldEnforceSso() ("enforce SSO
-   * whenever ee is loaded, whatever the license says") is gone on purpose:
-   * SSO enforcement now follows isFeatureActive(SSO), so it relaxes when the
-   * license lapses.
+   * EnterpriseFeatureActive.test.ts. The facade never decides single
+   * sign-on: it is part of the Community Edition and works whatever the
+   * license says, so there is no SSO question here at all (the old
+   * shouldEnforceSso() is gone too).
    */
-  test("shouldEnforceSso no longer exists", () => {
-    expect(
-      (EnterpriseEdition as unknown as Record<string, unknown>)[
-        "shouldEnforceSso"
-      ],
-    ).toBeUndefined();
+  test("the facade has no single sign-on question", () => {
+    for (const name of [
+      "shouldEnforceSso",
+      "isSsoEnforced",
+      "isSsoActive",
+      "areSsoRoutesServed",
+    ]) {
+      expect(
+        (EnterpriseEdition as unknown as Record<string, unknown>)[name],
+      ).toBeUndefined();
+    }
+  });
+
+  test("the runtime features are SCIM, audit logging and retention overrides, in lapse-log order", () => {
+    expect([...RUNTIME_ENTERPRISE_FEATURES]).toEqual([
+      EnterpriseFeature.SCIM,
+      EnterpriseFeature.AuditLogs,
+      EnterpriseFeature.TelemetryRetention,
+    ]);
+    expect(RUNTIME_ENTERPRISE_FEATURES as ReadonlyArray<string>).not.toContain(
+      "sso",
+    );
   });
 
   test.each(ALL_STATUSES)(
-    "billing off, %s license: SSO is active exactly when the license entitles it",
+    "billing off, %s license: SCIM is active exactly when the license entitles it",
     (status: EnterpriseLicenseStatus) => {
       installFakeEnterpriseModule({
         snapshot: createLicenseSnapshotWithStatus(status),
       });
 
-      expect(EnterpriseEdition.isFeatureActive(EnterpriseFeature.SSO)).toBe(
+      expect(EnterpriseEdition.isFeatureActive(EnterpriseFeature.SCIM)).toBe(
         status === "valid" || status === "grace",
       );
     },
@@ -730,14 +750,6 @@ describe("EnterpriseEdition runtime state (isFeatureActive)", () => {
 
 describe("EnterpriseEdition model to feature map", () => {
   test.each([
-    ["GlobalSSO", EnterpriseFeature.SSO],
-    ["GlobalOIDC", EnterpriseFeature.SSO],
-    ["GlobalSSOProject", EnterpriseFeature.SSO],
-    ["GlobalOIDCProject", EnterpriseFeature.SSO],
-    ["ProjectSSO", EnterpriseFeature.SSO],
-    ["ProjectOIDC", EnterpriseFeature.SSO],
-    ["StatusPageSSO", EnterpriseFeature.SSO],
-    ["StatusPageOIDC", EnterpriseFeature.SSO],
     ["ProjectSCIM", EnterpriseFeature.SCIM],
     ["StatusPageSCIM", EnterpriseFeature.SCIM],
     ["TeamComplianceSetting", EnterpriseFeature.TeamCompliance],
@@ -748,33 +760,38 @@ describe("EnterpriseEdition model to feature map", () => {
     },
   );
 
-  test("maps exactly the eleven enterprise configuration tables", () => {
+  test("maps exactly the three enterprise configuration tables", () => {
     expect(EnterpriseEdition.getMappedTableNames().sort()).toEqual(
-      [
-        "GlobalOIDC",
-        "GlobalOIDCProject",
-        "GlobalSSO",
-        "GlobalSSOProject",
-        "ProjectOIDC",
-        "ProjectSCIM",
-        "ProjectSSO",
-        "StatusPageOIDC",
-        "StatusPageSCIM",
-        "StatusPageSSO",
-        "TeamComplianceSetting",
-      ].sort(),
+      ["ProjectSCIM", "StatusPageSCIM", "TeamComplianceSetting"].sort(),
     );
   });
 
+  // Single sign-on configuration is Community Edition configuration.
+  test.each([
+    "GlobalSSO",
+    "GlobalOIDC",
+    "GlobalSSOProject",
+    "GlobalOIDCProject",
+    "ProjectSSO",
+    "ProjectOIDC",
+    "StatusPageSSO",
+    "StatusPageOIDC",
+  ])("the single sign-on table %s maps to no feature", (tableName: string) => {
+    expect(EnterpriseEdition.getFeatureForTableName(tableName)).toBeNull();
+  });
+
   test("unknown, empty and missing table names map to nothing", () => {
     expect(EnterpriseEdition.getFeatureForTableName("Monitor")).toBeNull();
     expect(EnterpriseEdition.getFeatureForTableName("")).toBeNull();
     expect(EnterpriseEdition.getFeatureForTableName(null)).toBeNull();
     expect(EnterpriseEdition.getFeatureForTableName(undefined)).toBeNull();
-    expect(EnterpriseEdition.getFeatureForTableName("globalsso")).toBeNull();
+    expect(EnterpriseEdition.getFeatureForTableName("projectscim")).toBeNull();
   });
 
   test("getModelFeature reads the table name off a model instance", () => {
+    class FakeScimModel {
+      public tableName: string | null = "ProjectSCIM";
+    }
     class FakeSsoModel {
       public tableName: string | null = "ProjectSSO";
     }
@@ -789,11 +806,16 @@ describe("EnterpriseEdition model to feature map", () => {
       typeof EnterpriseEdition.getModelFeature
     >[0];
 
+    expect(
+      EnterpriseEdition.getModelFeature(
+        FakeScimModel as unknown as ModelTypeArgument,
+      ),
+    ).toBe(EnterpriseFeature.SCIM);
     expect(
       EnterpriseEdition.getModelFeature(
         FakeSsoModel as unknown as ModelTypeArgument,
       ),
-    ).toBe(EnterpriseFeature.SSO);
+    ).toBeNull();
     expect(
       EnterpriseEdition.getModelFeature(
         FakePlainModel as unknown as ModelTypeArgument,