From b006637bd8d22f79c939071df3116c8e2ed69b9c Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Tue, 25 Nov 2025 16:55:12 +0000
Subject: [PATCH] enterprise only for SSO

---
 .../service/UserLicenseSettingsService.java   | 25 +++++++++++++++----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java
index cc810a1839..3313d46038 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java
@@ -329,7 +329,7 @@ public class UserLicenseSettingsService {
      *
      * <ul>
      *   <li>They are grandfathered for OAuth (existing user before policy change), OR
-     *   <li>The system has a paid license (SERVER or ENTERPRISE)
+     *   <li>The system has an ENTERPRISE license (SSO is enterprise-only)
      * </ul>
      *
      * @param user The user to check
@@ -342,10 +342,10 @@ public class UserLicenseSettingsService {
             return true;
         }
 
-        // Users can use OAuth if system has a paid license (SERVER or ENTERPRISE)
-        boolean hasPaidLicense = hasPaidLicense();
-        log.debug("OAuth eligibility check: hasPaidLicense={}", hasPaidLicense);
-        return hasPaidLicense;
+        // Users can use OAuth/SAML only if system has ENTERPRISE license
+        boolean hasEnterpriseLicense = hasEnterpriseLicense();
+        log.debug("OAuth eligibility check: hasEnterpriseLicense={}", hasEnterpriseLicense);
+        return hasEnterpriseLicense;
     }
 
     /**
@@ -490,4 +490,19 @@ public class UserLicenseSettingsService {
         License license = checker.getPremiumLicenseEnabledResult();
         return license == License.SERVER || license == License.ENTERPRISE;
     }
+
+    /**
+     * Checks if the system has an ENTERPRISE license.
+     * Used for enterprise-only features like SSO (OAuth/SAML).
+     *
+     * @return true if ENTERPRISE license is active
+     */
+    private boolean hasEnterpriseLicense() {
+        LicenseKeyChecker checker = licenseKeyChecker.getIfAvailable();
+        if (checker == null) {
+            return false;
+        }
+        License license = checker.getPremiumLicenseEnabledResult();
+        return license == License.ENTERPRISE;
+    }
 }