@oneuptime/common 14.0.9 → 14.0.11

package/Server/API/StatusPageAPI.ts

@@ -44,7 +44,6 @@ import {
   ExpressResponse,
   NextFunction,
 } from "../Utils/Express";
-import EditionEnforcement from "../Utils/EditionEnforcement";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import {
   SEARCH_ENGINE_INDEXING_FLAG_NAME,
@@ -1131,24 +1130,16 @@ export default class StatusPageAPI extends BaseAPI<
             select.footerHTML = true;
           }
 
-          /*
-           * The status page app offers SSO sign-in when this is non-zero.
-           * While SSO is not active - the Community Edition serves no status
-           * page SSO routes, and on a lapsed Enterprise license they refuse -
-           * it reports none rather than send visitors into a dead end.
-           */
           const hasEnabledSSO: PositiveNumber =
-            EditionEnforcement.areSsoRoutesServed()
-              ? await StatusPageSsoService.countBy({
-                  query: {
-                    isEnabled: true,
-                    statusPageId: objectId,
-                  },
-                  props: {
-                    isRoot: true,
-                  },
-                })
-              : new PositiveNumber(0);
+            await StatusPageSsoService.countBy({
+              query: {
+                isEnabled: true,
+                statusPageId: objectId,
+              },
+              props: {
+                isRoot: true,
+              },
+            });
 
           const item: StatusPage | null = await this.service.findOneById({
             id: objectId,
@@ -1176,19 +1167,6 @@ export default class StatusPageAPI extends BaseAPI<
             delete item.footerHTML;
           }
 
-          /*
-           * The status page app forces SSO sign-in from this flag. Report
-           * the EFFECTIVE requirement: while SSO is not active (the
-           * Community Edition, or a lapsed Enterprise license) it is not
-           * enforced and password sign-in works, so the page must not send
-           * visitors into an SSO flow that does not exist or refuses. The
-           * stored value is untouched and applies again as soon as SSO is
-           * active.
-           */
-          if (!EditionEnforcement.isSsoEnforced()) {
-            item.requireSsoForLogin = false;
-          }
-
           const footerLinks: Array<StatusPageFooterLink> =
             await StatusPageFooterLinkService.findBy({
               query: {
@@ -1347,30 +1325,23 @@ export default class StatusPageAPI extends BaseAPI<
             req.params["statusPageId"] as string,
           );
 
-          /*
-           * Only list providers a visitor can actually sign in with: the
-           * Community Edition serves no status page SSO login routes.
-           */
-          const sso: Array<StatusPageSSO> =
-            EditionEnforcement.areSsoRoutesServed()
-              ? await StatusPageSsoService.findBy({
-                  query: {
-                    statusPageId: objectId,
-                    isEnabled: true,
-                  },
-                  select: {
-                    signOnURL: true,
-                    name: true,
-                    description: true,
-                    _id: true,
-                  },
-                  limit: LIMIT_PER_PROJECT,
-                  skip: 0,
-                  props: {
-                    isRoot: true,
-                  },
-                })
-              : [];
+          const sso: Array<StatusPageSSO> = await StatusPageSsoService.findBy({
+            query: {
+              statusPageId: objectId,
+              isEnabled: true,
+            },
+            select: {
+              signOnURL: true,
+              name: true,
+              description: true,
+              _id: true,
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+              isRoot: true,
+            },
+          });
 
           return Response.sendEntityArrayResponse(
             req,
@@ -1394,29 +1365,23 @@ export default class StatusPageAPI extends BaseAPI<
             req.params["statusPageId"] as string,
           );
 
-          /*
-           * Only list providers a visitor can actually sign in with: the
-           * Community Edition serves no status page OIDC login routes.
-           */
           const oidc: Array<StatusPageOIDC> =
-            EditionEnforcement.areSsoRoutesServed()
-              ? await StatusPageOidcService.findBy({
-                  query: {
-                    statusPageId: objectId,
-                    isEnabled: true,
-                  },
-                  select: {
-                    name: true,
-                    description: true,
-                    _id: true,
-                  },
-                  limit: LIMIT_PER_PROJECT,
-                  skip: 0,
-                  props: {
-                    isRoot: true,
-                  },
-                })
-              : [];
+            await StatusPageOidcService.findBy({
+              query: {
+                statusPageId: objectId,
+                isEnabled: true,
+              },
+              select: {
+                name: true,
+                description: true,
+                _id: true,
+              },
+              limit: LIMIT_PER_PROJECT,
+              skip: 0,
+              props: {
+                isRoot: true,
+              },
+            });
 
           return Response.sendEntityArrayResponse(
             req,

package/Server/Enterprise/EnterpriseEdition.ts

@@ -27,27 +27,80 @@ import PaymentRequiredException from "../../Types/Exception/PaymentRequiredExcep
  */
 const ENTERPRISE_FEATURE_BY_TABLE_NAME: ReadonlyMap<string, EnterpriseFeature> =
   new Map<string, EnterpriseFeature>([
-    ["GlobalSSO", EnterpriseFeature.SSO],
-    ["GlobalOIDC", EnterpriseFeature.SSO],
-    ["GlobalSSOProject", EnterpriseFeature.SSO],
-    ["GlobalOIDCProject", EnterpriseFeature.SSO],
-    ["ProjectSSO", EnterpriseFeature.SSO],
-    ["ProjectOIDC", EnterpriseFeature.SSO],
-    ["StatusPageSSO", EnterpriseFeature.SSO],
-    ["StatusPageOIDC", EnterpriseFeature.SSO],
     ["ProjectSCIM", EnterpriseFeature.SCIM],
     ["StatusPageSCIM", EnterpriseFeature.SCIM],
     ["TeamComplianceSetting", EnterpriseFeature.TeamCompliance],
   ]);
 
+/*
+ * The resource tables whose telemetry retention can be overridden: every
+ * table with both a retainTelemetryDataForDays and a telemetryRetentionConfig
+ * column (a guard test keeps this list complete).
+ */
+export const TELEMETRY_RETENTION_RESOURCE_TABLE_NAMES: ReadonlyArray<string> = [
+  "Service",
+  "Host",
+  "DockerHost",
+  "PodmanHost",
+  "DockerSwarmCluster",
+  "KubernetesCluster",
+  "ProxmoxCluster",
+  "CephCluster",
+  "VMwareVCenter",
+  "IoTFleet",
+  "CloudResource",
+  "ServerlessFunction",
+  "DatabaseServer",
+  "RumApplication",
+];
+
+/*
+ * Enterprise configuration kept in COLUMNS of core models rather than in a
+ * model of its own, keyed by table name and then column. Writing a value to
+ * one of these columns needs the column's feature, exactly as creating or
+ * updating an enterprise model does (see EditionPermissions); clearing it
+ * does not.
+ *
+ *   Project.telemetryRetentionConfig       retention by telemetry type,
+ *                                          project-wide. The project's
+ *                                          default retention
+ *                                          (defaultTelemetryRetentionInDays)
+ *                                          is not listed: every edition has it.
+ *   <resource>.retainTelemetryDataForDays  per-service and per-resource
+ *   <resource>.telemetryRetentionConfig    retention, and their retention by
+ *                                          telemetry type.
+ */
+const ENTERPRISE_FEATURE_BY_TABLE_COLUMN: ReadonlyMap<
+  string,
+  Readonly<Record<string, EnterpriseFeature>>
+> = new Map<string, Readonly<Record<string, EnterpriseFeature>>>([
+  [
+    "Project",
+    { telemetryRetentionConfig: EnterpriseFeature.TelemetryRetention },
+  ],
+  ...TELEMETRY_RETENTION_RESOURCE_TABLE_NAMES.map(
+    (
+      tableName: string,
+    ): [string, Readonly<Record<string, EnterpriseFeature>>] => {
+      return [
+        tableName,
+        {
+          retainTelemetryDataForDays: EnterpriseFeature.TelemetryRetention,
+          telemetryRetentionConfig: EnterpriseFeature.TelemetryRetention,
+        },
+      ];
+    },
+  ),
+]);
+
 /*
  * The features whose RUNTIME behaviour stops when a self-hosted license
  * lapses (see isFeatureActive), in the order the lapse log names them.
  */
 export const RUNTIME_ENTERPRISE_FEATURES: ReadonlyArray<EnterpriseFeature> = [
-  EnterpriseFeature.SSO,
   EnterpriseFeature.SCIM,
   EnterpriseFeature.AuditLogs,
+  EnterpriseFeature.TelemetryRetention,
 ];
 
 // How the lapse log names each feature.
@@ -55,11 +108,11 @@ const FEATURE_NAMES: ReadonlyMap<EnterpriseFeature, string> = new Map<
   EnterpriseFeature,
   string
 >([
-  [EnterpriseFeature.SSO, "single sign-on (SSO)"],
   [EnterpriseFeature.SCIM, "SCIM provisioning"],
   [EnterpriseFeature.AuditLogs, "audit logging"],
   [EnterpriseFeature.TeamCompliance, "team compliance"],
   [EnterpriseFeature.InstanceHealth, "the OneUptime Health dashboards"],
+  [EnterpriseFeature.TelemetryRetention, "retention overrides"],
 ]);
 
 /*
@@ -90,8 +143,7 @@ export type EnterpriseFeatureStateListener = (
  *                         jobs exist and which edition operators are told they
  *                         run.
  *   isFeatureActive()     the ee code is present AND the feature is licensed
- *                         right now. Governs RUNTIME behaviour: SSO sign-in
- *                         and "Require SSO for login" enforcement, SCIM
+ *                         right now. Governs RUNTIME behaviour: SCIM
  *                         provisioning and its team locks, audit-log
  *                         recording. When a self-hosted license lapses these
  *                         stop, exactly as on the Community Edition, and they
@@ -181,11 +233,11 @@ export default class EnterpriseEdition {
   }
 
   /*
-   * Whether the feature's runtime behaviour runs right now: SSO sign-in and
-   * "Require SSO for login" enforcement (SSO), SCIM provisioning and its team
-   * locks (SCIM), audit-log recording (AuditLogs). Synchronous, because it is
-   * asked on every request that could need it; the license changes at runtime
-   * and routers are mounted once, so callers ask per request.
+   * Whether the feature's runtime behaviour runs right now: SCIM provisioning
+   * and its team locks (SCIM), audit-log recording (AuditLogs). Synchronous,
+   * because it is asked on every request that could need it; the license
+   * changes at runtime and routers are mounted once, so callers ask per
+   * request.
    *
    *   no enterprise module        false (the Community Edition)
    *   billing on                  true (OneUptime Cloud: plan tiers gate)
@@ -196,8 +248,8 @@ export default class EnterpriseEdition {
    *                               read or written yet, so whether the trial
    *                               is over is not known; see
    *                               EnterpriseLicenseSnapshotUtil.isTrialStartUnknown).
-   *                               An unknown state must never lock anyone out
-   *                               or switch SSO enforcement off. The loader
+   *                               An unknown state must never stop SCIM
+   *                               provisioning or audit logging. The loader
    *                               waits (bounded) for the first snapshot
    *                               before any router is mounted, so the window
    *                               is small. Warned about once per process.
@@ -228,7 +280,7 @@ export default class EnterpriseEdition {
       if (!EnterpriseEdition.hasWarnedAboutUnreadableLicense) {
         EnterpriseEdition.hasWarnedAboutUnreadableLicense = true;
         logger.warn(
-          "EnterpriseEdition: could not read the cached license snapshot. Until it can be read, SSO, SCIM and audit logging keep running as if licensed. This warning is logged once per process.",
+          "EnterpriseEdition: could not read the cached license snapshot. Until it can be read, SCIM and audit logging keep running as if licensed. This warning is logged once per process.",
         );
         logger.warn(err);
       }
@@ -240,7 +292,7 @@ export default class EnterpriseEdition {
       if (!EnterpriseEdition.hasWarnedAboutUnreadLicense) {
         EnterpriseEdition.hasWarnedAboutUnreadLicense = true;
         logger.warn(
-          "EnterpriseEdition: the license has not been read yet. Until it is, SSO, SCIM and audit logging keep running as if licensed. This warning is logged once per process.",
+          "EnterpriseEdition: the license has not been read yet. Until it is, SCIM and audit logging keep running as if licensed. This warning is logged once per process.",
         );
       }
 
@@ -257,7 +309,7 @@ export default class EnterpriseEdition {
            * trial (LicenseToken's classifyUnverifiedWithoutExpiry), so this
            * must not assert that nothing is installed.
            */
-          `EnterpriseEdition: there is no license this installation can date, and the start of the ${ENTERPRISE_LICENSE_TRIAL_PERIOD_IN_DAYS}-day trial has not been recorded yet, so it is not known whether the trial is over. Until it is recorded, SSO, SCIM and audit logging keep running as if licensed. This warning is logged once per process.`,
+          `EnterpriseEdition: there is no license this installation can date, and the start of the ${ENTERPRISE_LICENSE_TRIAL_PERIOD_IN_DAYS}-day trial has not been recorded yet, so it is not known whether the trial is over. Until it is recorded, SCIM and audit logging keep running as if licensed. This warning is logged once per process.`,
         );
       }
 
@@ -481,6 +533,25 @@ export default class EnterpriseEdition {
     return ENTERPRISE_FEATURE_BY_TABLE_NAME.get(tableName) || null;
   }
 
+  /*
+   * The enterprise columns of a table, as column -> feature, or null when
+   * the table has none (see ENTERPRISE_FEATURE_BY_TABLE_COLUMN).
+   */
+  public static getEnterpriseColumnsForTableName(
+    tableName: string | null | undefined,
+  ): Readonly<Record<string, EnterpriseFeature>> | null {
+    if (!tableName) {
+      return null;
+    }
+
+    return ENTERPRISE_FEATURE_BY_TABLE_COLUMN.get(tableName) || null;
+  }
+
+  // Every table with enterprise columns (for guard tests).
+  public static getTableNamesWithEnterpriseColumns(): Array<string> {
+    return Array.from(ENTERPRISE_FEATURE_BY_TABLE_COLUMN.keys());
+  }
+
   // Every table name the facade maps to a feature (for guard tests).
   public static getMappedTableNames(): Array<string> {
     return Array.from(ENTERPRISE_FEATURE_BY_TABLE_NAME.keys());
@@ -513,12 +584,6 @@ export default class EnterpriseEdition {
         : `The OneUptime Enterprise license has lapsed (status: ${snapshot.status}): ${names} ${verb} stopped until a license is activated.`,
     ];
 
-    if (stopped.includes(EnterpriseFeature.SSO)) {
-      parts.push(
-        '"Require SSO for login" is not enforced meanwhile: users sign in with their password, and users who only ever signed in with SSO can reset their password.',
-      );
-    }
-
     if (snapshot.message) {
       parts.push(`License status: ${snapshot.message}`);
     }

package/Server/Enterprise/EnterpriseFeature.ts

@@ -4,19 +4,40 @@
  * The string values are part of the license format: a signed license carries
  * a `features` claim that is either ["*"] (everything) or a subset of these
  * values. Renaming a value therefore silently revokes that feature from every
- * license already issued, so values are append-only.
+ * license already issued, so values are append-only. A value that stops
+ * naming a feature is retired for good (RETIRED_ENTERPRISE_FEATURE_VALUES)
+ * and never names another one.
  */
 enum EnterpriseFeature {
-  SSO = "sso",
   SCIM = "scim",
   TeamCompliance = "team-compliance",
   AuditLogs = "audit-logs",
   InstanceHealth = "instance-health",
+  /*
+   * Retention overrides: retention by telemetry type (Project, and every
+   * service and resource), and per-service and per-resource retention.
+   * The project-wide default retention is not part of it.
+   */
+  TelemetryRetention = "telemetry-retention",
 }
 
 export const ALL_ENTERPRISE_FEATURES: ReadonlyArray<EnterpriseFeature> =
   Object.values(EnterpriseFeature);
 
+/*
+ * License claim values that once named a feature and must never name one
+ * again. Licenses already issued can still carry them: they parse like any
+ * unknown name (parseEnterpriseFeature returns null) and grant nothing.
+ * Giving one of them to a new feature would silently grant that feature to
+ * every such license.
+ *
+ *   "sso"  single sign-on (SAML, OIDC, global SSO and "Require SSO for
+ *          login"), which is part of the Community Edition and needs no
+ *          license. Releases up to 14.0.10 still gate single sign-on on this
+ *          claim or on "*".
+ */
+export const RETIRED_ENTERPRISE_FEATURE_VALUES: ReadonlyArray<string> = ["sso"];
+
 /*
  * The license claim value that entitles every feature, including ones added
  * after the license was issued.
@@ -27,7 +48,8 @@ export const ENTERPRISE_FEATURE_WILDCARD: string = "*";
  * Narrows an untrusted string (a license claim, a request body) to a feature.
  * Unknown values return null rather than throwing, so a license issued by a
  * newer license server that names a feature this build has never heard of is
- * still readable: the unknown name is simply not granted.
+ * still readable: the unknown name is simply not granted. A retired value
+ * (RETIRED_ENTERPRISE_FEATURE_VALUES) is read the same way.
  */
 export const parseEnterpriseFeature: (
   value: unknown,

package/Server/Enterprise/EnterpriseLicenseSnapshot.ts

@@ -108,7 +108,7 @@ export interface EnterpriseLicenseSnapshot {
  * GlobalConfig.enterpriseEditionFirstSeenAt.
  *
  * Until either ends nothing changes; after it, enterprise configuration
- * becomes read-only and SSO, SCIM and audit logging stop
+ * becomes read-only and SCIM provisioning and audit logging stop
  * (EnterpriseEdition.isFeatureActive) until a license is activated. They are
  * defined in Common/Types so the browser copy derives the same numbers.
  */

package/Server/Enterprise/EnterpriseServerModule.ts

@@ -99,7 +99,10 @@ export default interface EnterpriseServerModule {
   licensing: EnterpriseLicensingProvider;
 
   /*
-   * Mounted at ["/api/identity", "/"] right after core's identity routers.
+   * The enterprise identity routers (today: SCIM provisioning). Mounted at
+   * ["/api/identity", "/"] right after core's identity routers
+   * (authentication, reseller and single sign-on, which core serves in every
+   * edition) and before the status page authentication router.
    * RULE for every router below: no layer without a route (no router.use), because
    * a path-less middleware in a router mounted at "/" or ahead of a core router
    * runs for requests meant for core routes.

package/Server/EnvironmentConfig.ts

@@ -1141,7 +1141,7 @@ export const OneUptimeEnterpriseDirectory: string | undefined =
 
 /*
  * The hosted oneuptime.com (billing enabled) must run the Enterprise image:
- * on the Community image paid SSO and audit logging would silently stop, and
+ * on the Community image paid SCIM and audit logging would silently stop, and
  * the license server self-hosted customers activate against would be gone. The
  * boot refuses that combination unless this development escape hatch is set.
  */