https://sonarly.com/issue/28801?type=bug
Self-hosted users who previously enabled SSO by setting an ENTERPRISE_KEY environment variable can no longer log in via OIDC/SAML SSO after upgrading, because the enterprise validity check now requires a paid subscription token.
Fix: ## Fix
Restored the legacy `ENTERPRISE_KEY` environment variable fallback in `EnterprisePlanService.isValid()`.
**What changed:**
In `enterprise-plan.service.ts`, line 150:
```typescript
// Before (broken):
isValid(): boolean {
return this.hasValidEnterpriseValidityToken();
}
// After (fixed):
isValid(): boolean {
return this.hasValidEnterpriseValidityToken() || this.checkLegacyKey();
}
```
This restores the behavior that existed between commits `c1da7be6d7` (March 12) and `2fccd194f3` (April 15), where `isValid()` accepted either:
1. A valid signed `ENTERPRISE_VALIDITY_TOKEN` from a paid subscription, **or**
2. Any defined `ENTERPRISE_KEY` environment variable (legacy path)
The commit `2fccd194f3` that removed this fallback explicitly stated in its message: "Re-using hasValidEnterpriseKey to avoid breaking changes. This will be entirely removed in the next versions." However, the implementation contradicted this intent — `hasValidEnterpriseKey()` (which retains the legacy check) is only used in a workspace resolver field, while the guard that gates all enterprise features calls `isValid()`, which had the legacy check removed.
**Test update:**
Updated the test case in `enterprise-plan.service.spec.ts` from `should return false with unsigned legacy key` to `should return true with unsigned legacy key`, correctly reflecting that a legacy ENTERPRISE_KEY should enable enterprise features.
**Impact:**
Self-hosted users who set `ENTERPRISE_KEY` to any value will once again have SSO (OIDC/SAML), row-level security, and audit log features enabled — restoring the behavior they had before the April 15 update.
Sonarly Claude Code
d9ddca0a2f