Merge pull request #4516 from Infisical/fix-plan-seat-limit-logic-for-sso-logins

fix(sso): SSO login plan seat limit check correction

backend/src/ee/services/ldap-config/ldap-config-service.ts

@@ -5,6 +5,7 @@ import { OrgMembershipStatus, TableName, TLdapConfigsUpdate, TUsers } from "@app
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
 import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee/services/group/group-fns";
 import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
+import { throwOnPlanSeatLimitReached } from "@app/ee/services/license/license-fns";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -417,14 +418,6 @@ export const ldapConfigServiceFactory = ({
         }
       });
     } else {
-      const plan = await licenseService.getPlan(orgId);
-      if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
-        // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
-        throw new BadRequestError({
-          message: "Failed to create new member via LDAP due to member limit reached. Upgrade plan to add more members."
-        });
-      }
-
       userAlias = await userDAL.transaction(async (tx) => {
         let newUser: TUsers | undefined;
         newUser = await userDAL.findOne(
@@ -473,6 +466,8 @@ export const ldapConfigServiceFactory = ({
         );
 
         if (!orgMembership) {
+          await throwOnPlanSeatLimitReached(licenseService, orgId, UserAliasType.LDAP);
+
           const { role, roleId } = await getDefaultOrgMembershipRole(organization.defaultMembershipRole);
 
           await orgMembershipDAL.create(

backend/src/ee/services/license/license-fns.ts

@@ -1,8 +1,11 @@
 import axios, { AxiosError } from "axios";
 
+import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { UserAliasType } from "@app/services/user-alias/user-alias-types";
 
 import { TFeatureSet } from "./license-types";
 
@@ -133,3 +136,18 @@ export const setupLicenseRequestWithStore = (
 
   return { request: licenseReq, refreshLicense };
 };
+
+export const throwOnPlanSeatLimitReached = async (
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">,
+  orgId: string,
+  type?: UserAliasType
+) => {
+  const plan = await licenseService.getPlan(orgId);
+
+  if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
+    // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
+    throw new BadRequestError({
+      message: `Failed to create new member${type ? ` via ${type.toUpperCase()}` : ""} due to member limit reached. Upgrade plan to add more members.`
+    });
+  }
+};

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -8,6 +8,7 @@ import { EventType, TAuditLogServiceFactory } from "@app/ee/services/audit-log/a
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
 import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee/services/group/group-fns";
 import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
+import { throwOnPlanSeatLimitReached } from "@app/ee/services/license/license-fns";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
@@ -294,6 +295,8 @@ export const oidcConfigServiceFactory = ({
         );
 
         if (!orgMembership) {
+          await throwOnPlanSeatLimitReached(licenseService, orgId, UserAliasType.OIDC);
+
           const { role, roleId } = await getDefaultOrgMembershipRole(organization.defaultMembershipRole);
 
           await orgMembershipDAL.create(

backend/src/ee/services/saml-config/saml-config-service.ts

@@ -1,6 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { OrgMembershipStatus, TableName, TSamlConfigs, TSamlConfigsUpdate, TUsers } from "@app/db/schemas";
+import { throwOnPlanSeatLimitReached } from "@app/ee/services/license/license-fns";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -336,14 +337,6 @@ export const samlConfigServiceFactory = ({
         return foundUser;
       });
     } else {
-      const plan = await licenseService.getPlan(orgId);
-      if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
-        // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
-        throw new BadRequestError({
-          message: "Failed to create new member via SAML due to member limit reached. Upgrade plan to add more members."
-        });
-      }
-
       user = await userDAL.transaction(async (tx) => {
         let newUser: TUsers | undefined;
         newUser = await userDAL.findOne(
@@ -391,6 +384,8 @@ export const samlConfigServiceFactory = ({
         );
 
         if (!orgMembership) {
+          await throwOnPlanSeatLimitReached(licenseService, orgId, UserAliasType.SAML);
+
           const { role, roleId } = await getDefaultOrgMembershipRole(organization.defaultMembershipRole);
 
           await orgMembershipDAL.create(