enforce License.IsSeatCountEnforced if set (#31354)

* enforce License.IsSeatCountEnforced if set If a license sets `IsSeatCountEnforced`, enforce the user limit therein as a hard cap. Fixes: https://mattermost.atlassian.net/browse/CLD-9260 * remove duplicate tests * Improve user limit error messages and display - Add separate error messages for licensed vs unlicensed servers - Licensed servers: "Server exceeds maximum licensed users. ERROR_LICENSED_USERS_LIMITS" - Unlicensed servers: "Server exceeds safe user limit. ERROR_SAFETY_LIMITS_EXCEEDED" - Remove redundant "Contact administrator" text from activation errors shown to admins - Fix system console to display actual server error messages instead of generic "Failed to activate user" 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Add license nil check and test coverage - Add license != nil check in GetServerLimits to prevent panic - Add test case to verify graceful handling of license being set to nil - Ensures fallback to hard-coded limits when license becomes nil Co-authored-by: lieut-data <lieut-data@users.noreply.github.com> * Fix user limits tests to expect license-specific error IDs Update test expectations to use the new license-specific error IDs: - app.user.update_active.license_user_limit.exceeded for licensed server user activation - api.user.create_user.license_user_limits.exceeded for licensed server user creation Also update frontend to show actual server error messages instead of generic ones in system console. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Remove redundant license nil test The test couldn't meaningfully verify nil license behavior since it relied on hard-coded constants that can't be modified in the test. Co-authored-by: lieut-data <lieut-data@users.noreply.github.com> * Fix whitespace issue in limits_test.go Remove unnecessary trailing newline to pass style checks. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * updated i18n * s/ERROR_LICENSED_USERS_LIMITS/ERROR_LICENSED_USERS_LIMIT_EXCEEDED/, expand warning log * Add 5% grace period for licensed user limits - Add calculateGraceLimit() function with 5% or +1 minimum grace - Apply grace period only to licensed servers with seat count enforcement - Handle zero user licenses by returning zero grace limit - Add comprehensive test coverage for grace period scenarios - Unlicensed servers maintain existing hard-coded limits without grace 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Fix TestCreateUserOrGuestSeatCountEnforcement to account for 5% grace period The test was failing because it expected user creation to fail at exactly the license limit, but the implementation now includes a 5% grace period before enforcement kicks in. Changes: - Update test cases to create users up to the grace limit (6 for a 5-user license) - Add comments explaining the grace period calculation - Both regular user and guest user creation tests now properly validate enforcement at the grace limit rather than the base license limit 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Fix TestUpdateActiveWithUserLimits to account for 5% grace period Update test expectations to match the new grace period behavior: - At base limit (100) but below grace limit (105): should succeed - At grace limit (105): should fail - Above grace limit (106): should fail This aligns the tests with the license enforcement implementation that includes a 5% grace period above the licensed user count. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: lieut-data <lieut-data@users.noreply.github.com> Co-authored-by: Mattermost Build <build@mattermost.com>
2025-06-13 17:12:05 -03:00
--- a/server/channels/app/limits.go
+++ b/server/channels/app/limits.go
@@ -6,8 +6,6 @@ package app
 import (
 	"net/http"

-	"github.com/mattermost/mattermost/server/public/shared/mlog"
-
 	"github.com/mattermost/mattermost/server/public/model"
 )

@@ -16,37 +14,54 @@ const (
 	maxUsersHardLimit = 5_000
 )

+// calculateGraceLimit calculates a grace limit that is 5% above the base limit
+// or at least 1 user above the base limit, whichever is higher.
+// Special case: if baseLimit is 0, returns 0.
+func calculateGraceLimit(baseLimit int64) int64 {
+	if baseLimit == 0 {
+		return 0
+	}
+	graceFromPercentage := int64(float64(baseLimit) * 1.05)
+	graceFromFloor := baseLimit + 1
+	if graceFromPercentage > graceFromFloor {
+		return graceFromPercentage
+	}
+	return graceFromFloor
+}
+
 func (a *App) GetServerLimits() (*model.ServerLimits, *model.AppError) {
-	var limits = &model.ServerLimits{}
+	limits := &model.ServerLimits{}
+	license := a.License()

-	if a.shouldShowUserLimits() {
-		activeUserCount, appErr := a.Srv().Store().User().Count(model.UserCountOptions{})
-		if appErr != nil {
-			mlog.Error("Failed to get active user count from database", mlog.String("error", appErr.Error()))
-			return nil, model.NewAppError("GetServerLimits", "app.limits.get_app_limits.user_count.store_error", nil, "", http.StatusInternalServerError).Wrap(appErr)
-		}
-
-		limits.ActiveUserCount = activeUserCount
+	if license == nil && maxUsersLimit > 0 {
+		// Enforce hard-coded limits for unlicensed servers (no grace period).
 		limits.MaxUsersLimit = maxUsersLimit
 		limits.MaxUsersHardLimit = maxUsersHardLimit
+	} else if license != nil && license.IsSeatCountEnforced && license.Features != nil && license.Features.Users != nil {
+		// Enforce license limits as required by the license with grace period.
+		licenseUserLimit := int64(*license.Features.Users)
+		limits.MaxUsersLimit = licenseUserLimit
+		limits.MaxUsersHardLimit = calculateGraceLimit(licenseUserLimit)
 	}

+	activeUserCount, appErr := a.Srv().Store().User().Count(model.UserCountOptions{})
+	if appErr != nil {
+		return nil, model.NewAppError("GetServerLimits", "app.limits.get_app_limits.user_count.store_error", nil, "", http.StatusInternalServerError).Wrap(appErr)
+	}
+	limits.ActiveUserCount = activeUserCount
+
 	return limits, nil
 }

-func (a *App) shouldShowUserLimits() bool {
-	if maxUsersLimit == 0 {
-		return false
-	}
-
-	return a.License() == nil
-}
-
-func (a *App) isHardUserLimitExceeded() (bool, *model.AppError) {
+func (a *App) isAtUserLimit() (bool, *model.AppError) {
 	userLimits, appErr := a.GetServerLimits()
 	if appErr != nil {
 		return false, appErr
 	}

-	return userLimits.ActiveUserCount > userLimits.MaxUsersHardLimit, appErr
+	if userLimits.MaxUsersHardLimit == 0 {
+		return false, nil
+	}
+
+	return userLimits.ActiveUserCount >= userLimits.MaxUsersHardLimit, appErr
 }
--- a/server/channels/app/limits_test.go
+++ b/server/channels/app/limits_test.go
@@ -7,27 +7,35 @@ import (
 	"testing"

 	"github.com/mattermost/mattermost/server/public/model"
+	storemocks "github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )

 func TestGetServerLimits(t *testing.T) {
 	mainHelper.Parallel(t)
-	t.Run("base case", func(t *testing.T) {
+
+	t.Run("unlicensed server shows hard-coded limits", func(t *testing.T) {
 		th := Setup(t).InitBasic()
 		defer th.TearDown()

+		th.App.Srv().SetLicense(nil)
+
 		serverLimits, appErr := th.App.GetServerLimits()
 		require.Nil(t, appErr)

 		// InitBasic creates 3 users by default
 		require.Equal(t, int64(3), serverLimits.ActiveUserCount)
 		require.Equal(t, int64(2500), serverLimits.MaxUsersLimit)
+		require.Equal(t, int64(5000), serverLimits.MaxUsersHardLimit)
 	})

 	t.Run("user count should increase on creating new user and decrease on permanently deleting", func(t *testing.T) {
 		th := Setup(t).InitBasic()
 		defer th.TearDown()

+		th.App.Srv().SetLicense(nil)
+
 		serverLimits, appErr := th.App.GetServerLimits()
 		require.Nil(t, appErr)
 		require.Equal(t, int64(3), serverLimits.ActiveUserCount)
@@ -50,6 +58,8 @@ func TestGetServerLimits(t *testing.T) {
 		th := Setup(t).InitBasic()
 		defer th.TearDown()

+		th.App.Srv().SetLicense(nil)
+
 		serverLimits, appErr := th.App.GetServerLimits()
 		require.Nil(t, appErr)
 		require.Equal(t, int64(3), serverLimits.ActiveUserCount)
@@ -72,6 +82,8 @@ func TestGetServerLimits(t *testing.T) {
 		th := Setup(t).InitBasic()
 		defer th.TearDown()

+		th.App.Srv().SetLicense(nil)
+
 		serverLimits, appErr := th.App.GetServerLimits()
 		require.Nil(t, appErr)
 		require.Equal(t, int64(3), serverLimits.ActiveUserCount)
@@ -95,6 +107,8 @@ func TestGetServerLimits(t *testing.T) {
 		th := Setup(t).InitBasic()
 		defer th.TearDown()

+		th.App.Srv().SetLicense(nil)
+
 		serverLimits, appErr := th.App.GetServerLimits()
 		require.Nil(t, appErr)
 		require.Equal(t, int64(3), serverLimits.ActiveUserCount)
@@ -118,6 +132,8 @@ func TestGetServerLimits(t *testing.T) {
 		th := Setup(t).InitBasic()
 		defer th.TearDown()

+		th.App.Srv().SetLicense(nil)
+
 		serverLimits, appErr := th.App.GetServerLimits()
 		require.Nil(t, appErr)
 		require.Equal(t, int64(3), serverLimits.ActiveUserCount)
@@ -136,16 +152,391 @@ func TestGetServerLimits(t *testing.T) {
 		require.Equal(t, int64(3), serverLimits.ActiveUserCount)
 	})

-	t.Run("limits should be empty when there is a license", func(t *testing.T) {
+	t.Run("licensed server without seat count enforcement shows no limits", func(t *testing.T) {
 		th := Setup(t).InitBasic()
 		defer th.TearDown()

-		th.App.Srv().SetLicense(model.NewTestLicense())
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = false
+		th.App.Srv().SetLicense(license)

 		serverLimits, appErr := th.App.GetServerLimits()
 		require.Nil(t, appErr)

-		require.Equal(t, int64(0), serverLimits.ActiveUserCount)
+		require.Greater(t, serverLimits.ActiveUserCount, int64(0))
 		require.Equal(t, int64(0), serverLimits.MaxUsersLimit)
+		require.Equal(t, int64(0), serverLimits.MaxUsersHardLimit)
+	})
+
+	t.Run("licensed server with seat count enforcement shows license limits with grace period", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		userLimit := 100
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = &userLimit
+		th.App.Srv().SetLicense(license)
+
+		serverLimits, appErr := th.App.GetServerLimits()
+		require.Nil(t, appErr)
+
+		// InitBasic creates 3 users by default
+		require.Equal(t, int64(3), serverLimits.ActiveUserCount)
+		require.Equal(t, int64(100), serverLimits.MaxUsersLimit)
+		require.Equal(t, int64(105), serverLimits.MaxUsersHardLimit) // 100 + 5% = 105
+	})
+
+	t.Run("licensed server with seat count enforcement but no Users feature shows no limits", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = nil
+		th.App.Srv().SetLicense(license)
+
+		serverLimits, appErr := th.App.GetServerLimits()
+		require.Nil(t, appErr)
+
+		require.Greater(t, serverLimits.ActiveUserCount, int64(0))
+		require.Equal(t, int64(0), serverLimits.MaxUsersLimit)
+		require.Equal(t, int64(0), serverLimits.MaxUsersHardLimit)
+	})
+
+	t.Run("licensed server with seat count enforcement and zero Users shows zero limits", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		userLimit := 0
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = &userLimit
+		th.App.Srv().SetLicense(license)
+
+		serverLimits, appErr := th.App.GetServerLimits()
+		require.Nil(t, appErr)
+
+		require.Greater(t, serverLimits.ActiveUserCount, int64(0))
+		require.Equal(t, int64(0), serverLimits.MaxUsersLimit)
+		require.Equal(t, int64(0), serverLimits.MaxUsersHardLimit) // No grace for 0 users
 	})
 }
+
+func TestIsAtUserLimit(t *testing.T) {
+	mainHelper.Parallel(t)
+
+	t.Run("unlicensed server", func(t *testing.T) {
+		t.Run("below hard limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			th.App.Srv().SetLicense(nil)
+
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(4000), nil) // Under hard limit of 5000
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.False(t, atLimit)
+		})
+
+		t.Run("at hard limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			th.App.Srv().SetLicense(nil)
+
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(5000), nil) // At hard limit of 5000
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.True(t, atLimit)
+		})
+
+		t.Run("above hard limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			th.App.Srv().SetLicense(nil)
+
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(6000), nil) // Over hard limit of 5000
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.True(t, atLimit)
+		})
+	})
+
+	t.Run("licensed server with seat count enforcement", func(t *testing.T) {
+		t.Run("below base limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = true
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// InitBasic creates 3 users, so we're below the base limit of 5 and grace limit of 6
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.False(t, atLimit)
+		})
+
+		t.Run("at base limit but below grace limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = true
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Create 2 additional users to have 5 total (at base limit of 5, but below grace limit of 6)
+			th.CreateUser()
+			th.CreateUser()
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.False(t, atLimit) // Should be false due to grace period
+		})
+
+		t.Run("at grace limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = true
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(6), nil) // At grace limit of 6 (5 + 1)
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.True(t, atLimit)
+		})
+
+		t.Run("above grace limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = true
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(7), nil) // Above grace limit of 6
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.True(t, atLimit)
+		})
+	})
+
+	t.Run("licensed server without seat count enforcement", func(t *testing.T) {
+		t.Run("below unenforced limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = false
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Create 2 additional users to have 3 total (below limit of 5)
+			th.CreateUser()
+			th.CreateUser()
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.False(t, atLimit)
+		})
+
+		t.Run("at unenforced limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = false
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Create 4 additional users to have 5 total (at limit of 5)
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.False(t, atLimit)
+		})
+
+		t.Run("above unenforced limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = false
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Create 5 additional users to have 6 total (above limit of 5)
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+
+			atLimit, appErr := th.App.isAtUserLimit()
+			require.Nil(t, appErr)
+			require.False(t, atLimit)
+		})
+	})
+}
+
+func TestGracePeriodBehavior(t *testing.T) {
+	mainHelper.Parallel(t)
+
+	t.Run("grace period examples", func(t *testing.T) {
+		tests := []struct {
+			name               string
+			licenseUserLimit   int
+			expectedBaseLimit  int64
+			expectedGraceLimit int64
+		}{
+			{
+				name:               "zero license users gets zero grace",
+				licenseUserLimit:   0,
+				expectedBaseLimit:  0,
+				expectedGraceLimit: 0, // Special case: 0 users = 0 grace limit
+			},
+			{
+				name:               "small license uses floor (10 users)",
+				licenseUserLimit:   10,
+				expectedBaseLimit:  10,
+				expectedGraceLimit: 11, // 10 + max(5%, 1) = 10 + 1
+			},
+			{
+				name:               "medium license uses percentage (100 users)",
+				licenseUserLimit:   100,
+				expectedBaseLimit:  100,
+				expectedGraceLimit: 105, // 100 + max(5%, 1) = 100 + 5
+			},
+			{
+				name:               "large license uses percentage (1000 users)",
+				licenseUserLimit:   1000,
+				expectedBaseLimit:  1000,
+				expectedGraceLimit: 1050, // 1000 + max(5%, 1) = 1000 + 50
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				th := Setup(t).InitBasic()
+				defer th.TearDown()
+
+				license := model.NewTestLicense("")
+				license.IsSeatCountEnforced = true
+				license.Features.Users = &tt.licenseUserLimit
+				th.App.Srv().SetLicense(license)
+
+				serverLimits, appErr := th.App.GetServerLimits()
+				require.Nil(t, appErr)
+
+				require.Equal(t, tt.expectedBaseLimit, serverLimits.MaxUsersLimit)
+				require.Equal(t, tt.expectedGraceLimit, serverLimits.MaxUsersHardLimit)
+			})
+		}
+	})
+
+	t.Run("unlicensed server has no grace period", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		th.App.Srv().SetLicense(nil)
+
+		serverLimits, appErr := th.App.GetServerLimits()
+		require.Nil(t, appErr)
+
+		// Unlicensed servers should not get grace period
+		require.Equal(t, int64(2500), serverLimits.MaxUsersLimit)
+		require.Equal(t, int64(5000), serverLimits.MaxUsersHardLimit) // No grace, stays at 5000
+	})
+}
+
+func TestCalculateGraceLimit(t *testing.T) {
+	mainHelper.Parallel(t)
+
+	tests := []struct {
+		name      string
+		baseLimit int64
+		expected  int64
+	}{
+		{
+			name:      "zero base limit",
+			baseLimit: 0,
+			expected:  0, // Special case: 0 users = 0 grace limit
+		},
+		{
+			name:      "one user base limit",
+			baseLimit: 1,
+			expected:  2, // max(1 * 1.05, 1 + 1) = max(1.05 -> 1, 2) = 2
+		},
+		{
+			name:      "small base limit where floor applies",
+			baseLimit: 10,
+			expected:  11, // max(10 * 1.05, 10 + 1) = max(10.5 -> 10, 11) = 11
+		},
+		{
+			name:      "small base limit where percentage applies",
+			baseLimit: 20,
+			expected:  21, // max(20 * 1.05, 20 + 1) = max(21, 21) = 21
+		},
+		{
+			name:      "medium base limit where percentage applies",
+			baseLimit: 100,
+			expected:  105, // max(100 * 1.05, 100 + 1) = max(105, 101) = 105
+		},
+		{
+			name:      "large base limit where percentage applies",
+			baseLimit: 1000,
+			expected:  1050, // max(1000 * 1.05, 1000 + 1) = max(1050, 1001) = 1050
+		},
+		{
+			name:      "very large base limit",
+			baseLimit: 5000,
+			expected:  5250, // max(5000 * 1.05, 5000 + 1) = max(5250, 5001) = 5250
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := calculateGraceLimit(tt.baseLimit)
+			require.Equal(t, tt.expected, result, "calculateGraceLimit(%d) = %d, expected %d", tt.baseLimit, result, tt.expected)
+		})
+	}
+}
--- a/server/channels/app/user.go
+++ b/server/channels/app/user.go
@@ -236,12 +236,16 @@ func (a *App) CreateGuest(c request.CTX, user *model.User) (*model.User, *model.
 }

 func (a *App) createUserOrGuest(c request.CTX, user *model.User, guest bool) (*model.User, *model.AppError) {
-	exceeded, limitErr := a.isHardUserLimitExceeded()
+	atUserLimit, limitErr := a.isAtUserLimit()
 	if limitErr != nil {
 		return nil, limitErr
 	}

-	if exceeded {
+	if atUserLimit {
+		// Use different error messages based on whether server is licensed
+		if a.License() != nil {
+			return nil, model.NewAppError("createUserOrGuest", "api.user.create_user.license_user_limits.exceeded", nil, "", http.StatusBadRequest)
+		}
 		return nil, model.NewAppError("createUserOrGuest", "api.user.create_user.user_limits.exceeded", nil, "", http.StatusBadRequest)
 	}

@@ -332,7 +336,12 @@ func (a *App) createUserOrGuest(c request.CTX, user *model.User, guest bool) (*m
 		c.Logger().Error("Error fetching user limits in createUserOrGuest", mlog.Err(limitErr))
 	} else {
 		if userLimits.ActiveUserCount > userLimits.MaxUsersLimit {
-			c.Logger().Warn("ERROR_SAFETY_LIMITS_EXCEEDED: Created user exceeds the total activated users limit.", mlog.Int("user_limit", userLimits.MaxUsersLimit))
+			// Use different warning messages based on whether server is licensed
+			if a.License() != nil {
+				c.Logger().Warn("ERROR_LICENSED_USERS_LIMIT_EXCEEDED: Created user exceeds the maximum licensed users.", mlog.Int("user_limit", userLimits.MaxUsersLimit))
+			} else {
+				c.Logger().Warn("ERROR_SAFETY_LIMITS_EXCEEDED: Created user exceeds the total activated users limit.", mlog.Int("user_limit", userLimits.MaxUsersLimit))
+			}
 		}
 	}

@@ -1013,12 +1022,16 @@ func (a *App) invalidateUserChannelMembersCaches(c request.CTX, userID string) *

 func (a *App) UpdateActive(c request.CTX, user *model.User, active bool) (*model.User, *model.AppError) {
 	if active {
-		exceeded, appErr := a.isHardUserLimitExceeded()
+		atUserLimit, appErr := a.isAtUserLimit()
 		if appErr != nil {
 			return nil, appErr
 		}

-		if exceeded {
+		if atUserLimit {
+			// Use different error messages based on whether server is licensed
+			if a.License() != nil {
+				return nil, model.NewAppError("UpdateActive", "app.user.update_active.license_user_limit.exceeded", nil, "", http.StatusBadRequest)
+			}
 			return nil, model.NewAppError("UpdateActive", "app.user.update_active.user_limit.exceeded", nil, "", http.StatusBadRequest)
 		}
 	}
@@ -1076,7 +1089,12 @@ func (a *App) UpdateActive(c request.CTX, user *model.User, active bool) (*model
 			c.Logger().Error("Error fetching user limits in UpdateActive", mlog.Err(appErr))
 		} else {
 			if userLimits.ActiveUserCount > userLimits.MaxUsersLimit {
-				c.Logger().Warn("ERROR_SAFETY_LIMITS_EXCEEDED: Activated user exceeds the total active user limit.", mlog.Int("user_limit", userLimits.MaxUsersLimit))
+				// Use different warning messages based on whether server is licensed
+				if a.License() != nil {
+					c.Logger().Warn("ERROR_LICENSED_USERS_LIMIT_EXCEEDED: Activated user exceeds the maximum licensed users.", mlog.Int("user_limit", userLimits.MaxUsersLimit))
+				} else {
+					c.Logger().Warn("ERROR_SAFETY_LIMITS_EXCEEDED: Activated user exceeds the total active user limit.", mlog.Int("user_limit", userLimits.MaxUsersLimit))
+				}
 			}
 		}
 	}
--- a/server/channels/app/user_limits_test.go
+++ b/server/channels/app/user_limits_test.go
@@ -0,0 +1,496 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package app
+
+import (
+	"testing"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	storemocks "github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateActiveWithUserLimits(t *testing.T) {
+	mainHelper.Parallel(t)
+
+	t.Run("unlicensed server", func(t *testing.T) {
+		t.Run("reactivation allowed below hard limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			th.App.Srv().SetLicense(nil)
+
+			// Deactivate user
+			deactivatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false)
+			require.Nil(t, appErr)
+			require.NotEqual(t, 0, deactivatedUser.DeleteAt)
+
+			// Reactivate user (should succeed - below hard limit)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true)
+			require.Nil(t, appErr)
+			require.Equal(t, int64(0), updatedUser.DeleteAt)
+		})
+
+		t.Run("reactivation blocked at hard limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			th.App.Srv().SetLicense(nil)
+
+			// Mock user count at hard limit
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(5000), nil) // At 5000 hard limit
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			user := &model.User{
+				Id:       model.NewId(),
+				Email:    "test@example.com",
+				Username: "testuser",
+				DeleteAt: model.GetMillis(),
+			}
+
+			// Try to reactivate user (should fail)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, user, true)
+			require.NotNil(t, appErr)
+			require.Nil(t, updatedUser)
+			require.Equal(t, "app.user.update_active.user_limit.exceeded", appErr.Id)
+		})
+
+		t.Run("reactivation blocked above hard limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			th.App.Srv().SetLicense(nil)
+
+			// Mock user count to exceed hard limit
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(6000), nil) // Over 5000 hard limit
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			user := &model.User{
+				Id:       model.NewId(),
+				Email:    "test@example.com",
+				Username: "testuser",
+				DeleteAt: model.GetMillis(),
+			}
+
+			// Try to reactivate user (should fail)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, user, true)
+			require.NotNil(t, appErr)
+			require.Nil(t, updatedUser)
+			require.Equal(t, "app.user.update_active.user_limit.exceeded", appErr.Id)
+		})
+	})
+
+	t.Run("licensed server with seat count enforcement", func(t *testing.T) {
+		t.Run("reactivation allowed below limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 100
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = true
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Deactivate user
+			_, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false)
+			require.Nil(t, appErr)
+
+			// Reactivate user (should succeed - below limit)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true)
+			require.Nil(t, appErr)
+			require.Equal(t, int64(0), updatedUser.DeleteAt)
+		})
+
+		t.Run("reactivation blocked at grace limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			userLimit := 100
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = true
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Mock user count at grace limit (105 = 100 + 5% grace period)
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(105), nil) // At grace limit
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			user := &model.User{
+				Id:       model.NewId(),
+				Email:    "test@example.com",
+				Username: "testuser",
+				DeleteAt: model.GetMillis(),
+			}
+
+			// Try to reactivate user (should fail)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, user, true)
+			require.NotNil(t, appErr)
+			require.Nil(t, updatedUser)
+			require.Equal(t, "app.user.update_active.license_user_limit.exceeded", appErr.Id)
+		})
+
+		t.Run("reactivation allowed at base limit but below grace limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5 // Grace limit will be 6 (5 + 1 minimum)
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = true
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// InitBasic creates 3 users, create 2 more to reach base limit of 5
+			th.CreateUser()
+			th.CreateUser()
+
+			// Deactivate a user
+			_, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false)
+			require.Nil(t, appErr)
+
+			// Reactivate user (should succeed - we're at base limit 5 but below grace limit 6)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true)
+			require.Nil(t, appErr)
+			require.Equal(t, int64(0), updatedUser.DeleteAt)
+		})
+
+		t.Run("reactivation blocked above grace limit", func(t *testing.T) {
+			th := SetupWithStoreMock(t)
+			defer th.TearDown()
+
+			userLimit := 100
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = true
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Mock user count above grace limit (106 > 105 grace limit)
+			mockUserStore := storemocks.UserStore{}
+			mockUserStore.On("Count", mock.Anything).Return(int64(106), nil) // Above grace limit
+			mockStore := th.App.Srv().Store().(*storemocks.Store)
+			mockStore.On("User").Return(&mockUserStore)
+
+			user := &model.User{
+				Id:       model.NewId(),
+				Email:    "test@example.com",
+				Username: "testuser",
+				DeleteAt: model.GetMillis(),
+			}
+
+			// Try to reactivate user (should fail)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, user, true)
+			require.NotNil(t, appErr)
+			require.Nil(t, updatedUser)
+			require.Equal(t, "app.user.update_active.license_user_limit.exceeded", appErr.Id)
+		})
+	})
+
+	t.Run("licensed server without seat count enforcement", func(t *testing.T) {
+		t.Run("reactivation allowed below unenforced limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = false
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Create 2 additional users to have 3 total (below limit of 5)
+			th.CreateUser()
+			th.CreateUser()
+
+			// Deactivate user
+			_, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false)
+			require.Nil(t, appErr)
+
+			// Reactivate user (should succeed - enforcement disabled and below limit)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true)
+			require.Nil(t, appErr)
+			require.Equal(t, int64(0), updatedUser.DeleteAt)
+		})
+
+		t.Run("reactivation allowed at unenforced limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = false
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Create 4 additional users to have 5 total (at limit of 5)
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+
+			// Create a user and then deactivate them
+			testUser := th.CreateUser()
+			_, appErr := th.App.UpdateActive(th.Context, testUser, false)
+			require.Nil(t, appErr)
+
+			// Reactivate user (should succeed - enforcement disabled)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, testUser, true)
+			require.Nil(t, appErr)
+			require.Equal(t, int64(0), updatedUser.DeleteAt)
+		})
+
+		t.Run("reactivation allowed above unenforced limit", func(t *testing.T) {
+			th := Setup(t).InitBasic()
+			defer th.TearDown()
+
+			userLimit := 5
+			license := model.NewTestLicense("")
+			license.IsSeatCountEnforced = false
+			license.Features.Users = &userLimit
+			th.App.Srv().SetLicense(license)
+
+			// Create 5 additional users to have 6 total (above limit of 5)
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+			th.CreateUser()
+
+			// Create a user and then deactivate them
+			testUser := th.CreateUser()
+			_, appErr := th.App.UpdateActive(th.Context, testUser, false)
+			require.Nil(t, appErr)
+
+			// Reactivate user (should succeed - enforcement disabled)
+			updatedUser, appErr := th.App.UpdateActive(th.Context, testUser, true)
+			require.Nil(t, appErr)
+			require.Equal(t, int64(0), updatedUser.DeleteAt)
+		})
+	})
+}
+
+func TestCreateUserOrGuestSeatCountEnforcement(t *testing.T) {
+	mainHelper.Parallel(t)
+
+	t.Run("seat count enforced - allows user creation when under limit", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		userLimit := 5
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = &userLimit
+		th.App.Srv().SetLicense(license)
+
+		// InitBasic creates 3 users, so we're under the limit of 5
+		user := &model.User{
+			Email:         "TestCreateUserOrGuest@example.com",
+			Username:      "username_123",
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+
+		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
+		require.Nil(t, appErr)
+		require.NotNil(t, createdUser)
+		require.Equal(t, "username_123", createdUser.Username)
+	})
+
+	t.Run("seat count enforced - blocks user creation when at limit", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		userLimit := 5
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = &userLimit
+		th.App.Srv().SetLicense(license)
+
+		// Create 3 additional users to reach the grace limit of 6 (3 from InitBasic + 3)
+		// Grace limit for 5 users is 6 (5% grace period)
+		th.CreateUser()
+		th.CreateUser()
+		th.CreateUser()
+
+		// Now at grace limit - attempting to create another user should fail
+		user := &model.User{
+			Email:         "TestSeatCount@example.com",
+			Username:      "seat_test_user",
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+
+		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
+		require.NotNil(t, appErr)
+		require.Nil(t, createdUser)
+		require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id)
+	})
+
+	t.Run("seat count enforced - blocks user creation when over limit", func(t *testing.T) {
+		// Use mocks for this test since we can't actually create users beyond the safety limit
+		th := SetupWithStoreMock(t)
+		defer th.TearDown()
+
+		userLimit := 5
+		currentUserCount := int64(6) // Over limit
+
+		mockUserStore := storemocks.UserStore{}
+		mockUserStore.On("Count", mock.Anything).Return(currentUserCount, nil)
+		mockUserStore.On("IsEmpty", true).Return(false, nil)
+
+		mockGroupStore := storemocks.GroupStore{}
+		mockGroupStore.On("GetByName", "seat_test_user", mock.Anything).Return(nil, nil)
+
+		mockStore := th.App.Srv().Store().(*storemocks.Store)
+		mockStore.On("User").Return(&mockUserStore)
+		mockStore.On("Group").Return(&mockGroupStore)
+
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = &userLimit
+		th.App.Srv().SetLicense(license)
+
+		user := &model.User{
+			Email:         "TestSeatCount@example.com",
+			Username:      "seat_test_user",
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+
+		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
+		require.NotNil(t, appErr)
+		require.Nil(t, createdUser)
+		require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id)
+	})
+
+	t.Run("seat count not enforced - allows user creation even when over limit", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		userLimit := 5
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = false
+		license.Features.Users = &userLimit
+		th.App.Srv().SetLicense(license)
+
+		// Create additional users to exceed the limit (3 from InitBasic + 3 = 6, over limit of 5)
+		th.CreateUser()
+		th.CreateUser()
+		th.CreateUser()
+
+		// Should still allow creation since enforcement is disabled
+		user := &model.User{
+			Email:         "TestSeatCount@example.com",
+			Username:      "seat_test_user",
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+
+		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
+		require.Nil(t, appErr)
+		require.NotNil(t, createdUser)
+		require.Equal(t, "seat_test_user", createdUser.Username)
+	})
+
+	t.Run("no license - uses existing hard limit logic", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		th.App.Srv().SetLicense(nil)
+
+		// Should allow creation under hard limit
+		user := &model.User{
+			Email:         "TestSeatCount@example.com",
+			Username:      "seat_test_user",
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+
+		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
+		require.Nil(t, appErr)
+		require.NotNil(t, createdUser)
+		require.Equal(t, "seat_test_user", createdUser.Username)
+	})
+
+	t.Run("license without Users feature - no seat count enforcement", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = nil
+		th.App.Srv().SetLicense(license)
+
+		// Should allow creation since Users feature is nil
+		user := &model.User{
+			Email:         "TestSeatCount@example.com",
+			Username:      "seat_test_user",
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+
+		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
+		require.Nil(t, appErr)
+		require.NotNil(t, createdUser)
+		require.Equal(t, "seat_test_user", createdUser.Username)
+	})
+
+	t.Run("guest creation with seat count enforcement - blocks when at limit", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		userLimit := 5
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = &userLimit
+		th.App.Srv().SetLicense(license)
+
+		// Create 3 additional users to reach the grace limit of 6 (3 from InitBasic + 3)
+		// Grace limit for 5 users is 6 (5% grace period)
+		th.CreateUser()
+		th.CreateUser()
+		th.CreateUser()
+
+		// Now at grace limit - attempting to create a guest should fail
+		user := &model.User{
+			Email:         "TestSeatCountGuest@example.com",
+			Username:      "seat_test_guest",
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+
+		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, true)
+		require.NotNil(t, appErr)
+		require.Nil(t, createdUser)
+		require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id)
+	})
+
+	t.Run("guest creation with seat count enforcement - allows when under limit", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		userLimit := 5
+		license := model.NewTestLicense("")
+		license.IsSeatCountEnforced = true
+		license.Features.Users = &userLimit
+		th.App.Srv().SetLicense(license)
+
+		// InitBasic creates 3 users, so we're under the limit of 5
+		user := &model.User{
+			Email:         "TestSeatCountGuest@example.com",
+			Username:      "seat_test_guest",
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+
+		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, true)
+		require.Nil(t, appErr)
+		require.NotNil(t, createdUser)
+		require.Equal(t, "seat_test_guest", createdUser.Username)
+	})
+}
--- a/server/channels/app/user_test.go
+++ b/server/channels/app/user_test.go
@@ -21,7 +21,6 @@ import (
 	"github.com/mattermost/mattermost/server/public/model"
 	"github.com/mattermost/mattermost/server/public/shared/request"
 	oauthgitlab "github.com/mattermost/mattermost/server/v8/channels/app/oauthproviders/gitlab"
-	"github.com/mattermost/mattermost/server/v8/channels/app/users"
 	"github.com/mattermost/mattermost/server/v8/channels/store"
 	storemocks "github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks"
 	"github.com/mattermost/mattermost/server/v8/channels/utils/testutils"
@@ -2292,161 +2291,3 @@ func TestGetUsersForReporting(t *testing.T) {
 		require.NotNil(t, userReports)
 	})
 }
-
-func TestCreateUserOrGuest(t *testing.T) {
-	mainHelper.Parallel(t)
-	t.Run("base case - you can create a user", func(t *testing.T) {
-		th := Setup(t)
-		defer th.TearDown()
-
-		user := &model.User{
-			Email:         "TestCreateUserOrGuest@example.com",
-			Username:      "username_123",
-			Nickname:      "nn_username_123",
-			Password:      "Password1",
-			EmailVerified: true,
-		}
-		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
-		require.Nil(t, appErr)
-		require.Equal(t, "username_123", createdUser.Username)
-	})
-
-	t.Run("cannot create user when user count has exceeded the permissible limit", func(t *testing.T) {
-		th := SetupWithStoreMock(t)
-		defer th.TearDown()
-
-		mockUserStore := storemocks.UserStore{}
-		mockUserStore.On("Count", mock.Anything).Return(int64(12000), nil)
-
-		mockStore := th.App.Srv().Store().(*storemocks.Store)
-		mockStore.On("User").Return(&mockUserStore)
-
-		user := &model.User{
-			Email:         "TestCreateUserOrGuest@example.com",
-			Username:      "username_123",
-			Nickname:      "nn_username_123",
-			Password:      "Password1",
-			EmailVerified: true,
-		}
-		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
-		require.NotNil(t, appErr)
-		require.Nil(t, createdUser)
-	})
-
-	t.Run("can create user when server is exactly on limit", func(t *testing.T) {
-		th := SetupWithStoreMock(t)
-		defer th.TearDown()
-
-		id := NewTestId()
-		userCreationMocks(t, th, id, 5000)
-
-		user := &model.User{
-			Email:         "TestCreateUserOrGuest@example.com",
-			Username:      "username_123",
-			Nickname:      "nn_username_123",
-			Password:      "Password1",
-			EmailVerified: true,
-		}
-		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
-		require.Nil(t, appErr)
-		require.Equal(t, "username_123", createdUser.Username)
-	})
-
-	t.Run("licensed server can create user when server is OVER limit", func(t *testing.T) {
-		th := SetupWithStoreMock(t)
-		defer th.TearDown()
-
-		id := NewTestId()
-		userCreationMocks(t, th, id, 20000)
-
-		user := &model.User{
-			Email:         "TestCreateUserOrGuest@example.com",
-			Username:      "username_123",
-			Nickname:      "nn_username_123",
-			Password:      "Password1",
-			EmailVerified: true,
-		}
-
-		th.App.Srv().SetLicense(model.NewTestLicense(""))
-		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
-		require.Nil(t, appErr)
-		require.Equal(t, "username_123", createdUser.Username)
-	})
-
-	t.Run("licensed server can create user when server is UNDER limit", func(t *testing.T) {
-		th := SetupWithStoreMock(t)
-		defer th.TearDown()
-
-		id := NewTestId()
-		userCreationMocks(t, th, id, 10)
-
-		user := &model.User{
-			Email:         "TestCreateUserOrGuest@example.com",
-			Username:      "username_123",
-			Nickname:      "nn_username_123",
-			Password:      "Password1",
-			EmailVerified: true,
-		}
-
-		th.App.Srv().SetLicense(model.NewTestLicense(""))
-		createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
-		require.Nil(t, appErr)
-		require.Equal(t, "username_123", createdUser.Username)
-	})
-}
-
-func userCreationMocks(t *testing.T, th *TestHelper, userID string, activeUserCount int64) {
-	mockUserStore := storemocks.UserStore{}
-	mockUserStore.On("Count", mock.Anything).Return(activeUserCount, nil)
-	mockUserStore.On("IsEmpty", mock.Anything).Return(false, nil)
-	mockUserStore.On("VerifyEmail", mock.Anything, "TestCreateUserOrGuest@example.com").Return("", nil)
-	mockUserStore.On("InvalidateProfilesInChannelCacheByUser", mock.Anything).Return()
-	mockUserStore.On("InvalidateProfileCacheForUser", mock.Anything).Return()
-	mockUserStore.On("Save", mock.Anything, mock.Anything).Return(&model.User{
-		Id:            userID,
-		Email:         "TestCreateUserOrGuest@example.com",
-		Username:      "username_123",
-		Nickname:      "nn_username_123",
-		Password:      "Password1",
-		EmailVerified: true,
-	}, nil)
-
-	mockUserStore.On("Get", mock.Anything, userID).Return(&model.User{
-		Id:            userID,
-		Email:         "TestCreateUserOrGuest@example.com",
-		Username:      "username_123",
-		Nickname:      "nn_username_123",
-		Password:      "Password1",
-		EmailVerified: true,
-	}, nil)
-
-	mockGroupStore := storemocks.GroupStore{}
-	mockGroupStore.On("GetByName", "username_123", mock.Anything).Return(nil, nil)
-
-	mockChannelStore := storemocks.ChannelStore{}
-	mockChannelStore.On("InvalidateAllChannelMembersForUser", mock.Anything).Return()
-
-	mockPreferencesStore := storemocks.PreferenceStore{}
-	mockPreferencesStore.On("Save", mock.Anything).Return(nil)
-
-	mockProductNoticeStore := storemocks.ProductNoticesStore{}
-	mockProductNoticeStore.On("View", userID, mock.Anything).Return(nil)
-
-	mockStore := th.App.Srv().Store().(*storemocks.Store)
-	mockStore.On("User").Return(&mockUserStore)
-	mockStore.On("Group").Return(&mockGroupStore)
-	mockStore.On("Channel").Return(&mockChannelStore)
-	mockStore.On("Preference").Return(&mockPreferencesStore)
-	mockStore.On("ProductNotices").Return(&mockProductNoticeStore)
-
-	var err error
-	th.App.ch.srv.userService, err = users.New(users.ServiceConfig{
-		UserStore:    &mockUserStore,
-		SessionStore: &storemocks.SessionStore{},
-		OAuthStore:   &storemocks.OAuthStore{},
-		ConfigFn:     th.App.ch.srv.platform.Config,
-		LicenseFn:    th.App.ch.srv.License,
-	})
-
-	require.NoError(t, err)
-}
--- a/server/i18n/en.json
+++ b/server/i18n/en.json
@@ -4042,6 +4042,10 @@
    "id": "api.user.create_user.invalid_invitation_type.app_error",
    "translation": "Unable to create the user, invalid invitation."
  },
+  {
+    "id": "api.user.create_user.license_user_limits.exceeded",
+    "translation": "Can't create user. Server exceeds maximum licensed users. Contact your administrator with: ERROR_LICENSED_USERS_LIMIT_EXCEEDED."
+  },
  {
    "id": "api.user.create_user.no_open_server",
    "translation": "This server does not allow open signups.  Please speak with your Administrator to receive an invitation."
@@ -7540,9 +7544,13 @@
    "id": "app.user.update.lastAdmin.app_error",
    "translation": "Cannot demote last System Admin."
  },
+  {
+    "id": "app.user.update_active.license_user_limit.exceeded",
+    "translation": "Can't activate user. Server exceeds maximum licensed users. ERROR_LICENSED_USERS_LIMIT_EXCEEDED."
+  },
  {
    "id": "app.user.update_active.user_limit.exceeded",
-    "translation": "Can't activate user. Server exceeds safe user limit. Contact your administrator with: ERROR_SAFETY_LIMITS_EXCEEDED."
+    "translation": "Can't activate user. Server exceeds safe user limit. ERROR_SAFETY_LIMITS_EXCEEDED."
  },
  {
    "id": "app.user.update_active_for_multiple_users.updating.app_error",
--- a/server/public/model/license.go
+++ b/server/public/model/license.go
@@ -57,17 +57,18 @@ type LicenseRecord struct {
 }

 type License struct {
-	Id           string    `json:"id"`
-	IssuedAt     int64     `json:"issued_at"`
-	StartsAt     int64     `json:"starts_at"`
-	ExpiresAt    int64     `json:"expires_at"`
-	Customer     *Customer `json:"customer"`
-	Features     *Features `json:"features"`
-	SkuName      string    `json:"sku_name"`
-	SkuShortName string    `json:"sku_short_name"`
-	IsTrial      bool      `json:"is_trial"`
-	IsGovSku     bool      `json:"is_gov_sku"`
-	SignupJWT    *string   `json:"signup_jwt"`
+	Id                  string    `json:"id"`
+	IssuedAt            int64     `json:"issued_at"`
+	StartsAt            int64     `json:"starts_at"`
+	ExpiresAt           int64     `json:"expires_at"`
+	Customer            *Customer `json:"customer"`
+	Features            *Features `json:"features"`
+	SkuName             string    `json:"sku_name"`
+	SkuShortName        string    `json:"sku_short_name"`
+	IsTrial             bool      `json:"is_trial"`
+	IsGovSku            bool      `json:"is_gov_sku"`
+	IsSeatCountEnforced bool      `json:"is_seat_count_enforced"`
+	SignupJWT           *string   `json:"signup_jwt"`
 }

 type Customer struct {
--- a/webapp/channels/src/components/admin_console/system_user_detail/system_user_detail.tsx
+++ b/webapp/channels/src/components/admin_console/system_user_detail/system_user_detail.tsx
@@ -147,7 +147,9 @@ export class SystemUserDetail extends PureComponent<Props, State> {
        } catch (err) {
            console.error('SystemUserDetails-handleActivateUser', err); // eslint-disable-line no-console

-            this.setState({error: this.props.intl.formatMessage({id: 'admin.user_item.userActivateFailed', defaultMessage: 'Failed to activate user'})});
+            // Show the actual server error message instead of generic message
+            const errorMessage = (err as Error).message || this.props.intl.formatMessage({id: 'admin.user_item.userActivateFailed', defaultMessage: 'Failed to activate user'});
+            this.setState({error: errorMessage});
        }
    };

@@ -166,7 +168,9 @@ export class SystemUserDetail extends PureComponent<Props, State> {
        } catch (err) {
            console.error('SystemUserDetails-handleDeactivateMember', err); // eslint-disable-line no-console

-            this.setState({error: this.props.intl.formatMessage({id: 'admin.user_item.userDeactivateFailed', defaultMessage: 'Failed to deactivate user'})});
+            // Show the actual server error message instead of generic message
+            const errorMessage = (err as Error).message || this.props.intl.formatMessage({id: 'admin.user_item.userDeactivateFailed', defaultMessage: 'Failed to deactivate user'});
+            this.setState({error: errorMessage});
        }

        this.toggleCloseModalDeactivateMember();