closing gap in grandfathering logic

app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java

@@ -184,8 +184,9 @@ public class UserLicenseSettingsService {
             long oauthUsersCount = userService.countOAuthUsers();
             long grandfatheredCount = userService.countGrandfatheredOAuthUsers();
 
-            if (oauthUsersCount > 0 && grandfatheredCount == 0) {
-                // We have OAuth users but none are grandfathered - this is first run after upgrade
+            if (oauthUsersCount > 0 && grandfatheredCount < oauthUsersCount) {
+                // We have OAuth users but not all have been grandfathered - this is first run after
+                // upgrade
                 int updated = userService.grandfatherAllOAuthUsers();
                 log.warn(
                         "OAuth GRANDFATHERING: Marked {} existing OAuth/SAML users as grandfathered. "

app/proprietary/src/test/java/stirling/software/proprietary/service/UserLicenseSettingsServiceTest.java

@@ -2,6 +2,9 @@ package stirling.software.proprietary.service;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 import java.util.Optional;
@@ -198,4 +201,35 @@ class UserLicenseSettingsServiceTest {
 
         assertEquals(5, result, "Should fall back to default 5 users if grandfathered is 0");
     }
+
+    @Test
+    void grandfatherExistingOAuthUsers_runsWhenSomeUsersNotGrandfathered() {
+        when(userService.countOAuthUsers()).thenReturn(10L);
+        when(userService.countGrandfatheredOAuthUsers()).thenReturn(4L);
+        when(userService.grandfatherAllOAuthUsers()).thenReturn(6);
+
+        service.grandfatherExistingOAuthUsers();
+
+        verify(userService, times(1)).grandfatherAllOAuthUsers();
+    }
+
+    @Test
+    void grandfatherExistingOAuthUsers_skipsWhenAllUsersGrandfathered() {
+        when(userService.countOAuthUsers()).thenReturn(10L);
+        when(userService.countGrandfatheredOAuthUsers()).thenReturn(10L);
+
+        service.grandfatherExistingOAuthUsers();
+
+        verify(userService, never()).grandfatherAllOAuthUsers();
+    }
+
+    @Test
+    void grandfatherExistingOAuthUsers_skipsWhenNoOAuthUsers() {
+        when(userService.countOAuthUsers()).thenReturn(0L);
+        when(userService.countGrandfatheredOAuthUsers()).thenReturn(0L);
+
+        service.grandfatherExistingOAuthUsers();
+
+        verify(userService, never()).grandfatherAllOAuthUsers();
+    }
 }