Make tenancy quotas (workspaces/user, environments/workspace) configurable via LIMITS_* env vars#144
Open
andhus wants to merge 1 commit into
Open
Make tenancy quotas (workspaces/user, environments/workspace) configurable via LIMITS_* env vars#144andhus wants to merge 1 commit into
andhus wants to merge 1 commit into
Conversation
3 tasks
andhus
force-pushed
the
bump-env-limit-to-15
branch
from
12f1a33 to
5e57283
Compare
The two hardcoded class constants on Workspace — MAX_WORKSPACES_PER_USER and MAX_ENVIRONMENTS_PER_WORKSPACE — couldn't be tuned per deployment without a code release. Move them into the existing LimitsSettings (pydantic-settings, env prefix LIMITS_) so they follow the same OSS-safe + env-overridable pattern as the other SaaS guardrails in limits.py: - Defaults to None (unlimited) for OSS / self-hosted users. - Production sets concrete caps via env vars on the ECS task definition (added to infra/aws-cdk/lib/api-stack.ts). Production values (3 workspaces/user, 15 envs/workspace) are added to the api-stack.ts environment block alongside the other LIMITS_* values. The 15 env cap raises the previous hardcoded 6, which a deployed workspace had hit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
andhus
force-pushed
the
bump-env-limit-to-15
branch
from
5e57283 to
0d850c1
Compare
andhus
changed the title
There was a problem hiding this comment.
Pull request overview
This PR moves two tenancy quota limits (workspaces per user, environments per workspace) out of hardcoded Workspace model constants and into the existing LimitsSettings configuration, making them configurable via LIMITS_* environment variables and defaulting to OSS-safe “disabled” (None) when unset.
Changes:
- Added
max_workspaces_per_userandmax_environments_per_workspacetoLimitsSettings(defaultNone). - Updated workspace/environment creation routes to enforce these limits only when configured.
- Updated the AWS CDK ECS task environment to set the new
LIMITS_MAX_*variables.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| infra/aws-cdk/lib/api-stack.ts | Adds tenancy quota env vars to the API container environment. |
| app/stardag-api/src/stardag_api/routes/workspaces.py | Switches quota enforcement from model constants to limits_settings with None disabling. |
| app/stardag-api/src/stardag_api/models/workspace.py | Removes hardcoded quota constants from the ORM model. |
| app/stardag-api/src/stardag_api/limits.py | Adds new configurable tenancy quota fields to LimitsSettings. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
209
to
+213
| LIMITS_MAX_ASSETS_PER_WORKSPACE_24H: "1000", | ||
| LIMITS_MAX_DEPENDENCY_IDS_PER_TASK: "500", | ||
| LIMITS_MAX_ASSETS_PER_TASK: "10", | ||
| LIMITS_MAX_WORKSPACES_PER_USER: "3", | ||
| LIMITS_MAX_ENVIRONMENTS_PER_WORKSPACE: "15", |
Comment on lines
234
to
240
| workspace_count = workspace_count_result.scalar() or 0 | ||
| if workspace_count >= Workspace.MAX_WORKSPACES_PER_USER: | ||
| max_workspaces = limits_settings.max_workspaces_per_user | ||
| if max_workspaces is not None and workspace_count >= max_workspaces: | ||
| raise HTTPException( | ||
| status_code=status.HTTP_403_FORBIDDEN, | ||
| detail=f"You can create at most {Workspace.MAX_WORKSPACES_PER_USER} workspaces", | ||
| detail=f"You can create at most {max_workspaces} workspaces", | ||
| ) |
Comment on lines
764
to
770
| environment_count = environment_count_result.scalar() or 0 | ||
| if environment_count >= Workspace.MAX_ENVIRONMENTS_PER_WORKSPACE: | ||
| max_environments = limits_settings.max_environments_per_workspace | ||
| if max_environments is not None and environment_count >= max_environments: | ||
| raise HTTPException( | ||
| status_code=status.HTTP_403_FORBIDDEN, | ||
| detail=f"Workspace can have at most {Workspace.MAX_ENVIRONMENTS_PER_WORKSPACE} environments", | ||
| detail=f"Workspace can have at most {max_environments} environments", | ||
| ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the two hardcoded class constants on
Workspace—MAX_WORKSPACES_PER_USER(3) andMAX_ENVIRONMENTS_PER_WORKSPACE(6) —into the existing
LimitsSettings(pydantic-settings,LIMITS_*envvars), so they follow the same OSS-safe + env-overridable pattern as
the other SaaS guardrails in
app/stardag-api/src/stardag_api/limits.py.Why
Re-using
LimitsSettingsinstead of constants:None= no enforcement, matching the rest ofthe file's "all limits default to disabled" contract. Self-hosted
users hit no hidden cap.
code release.
next to
max_*_per_workspace_24hetc., not as anonymous class-levelints inside an ORM model.
What changed
app/stardag-api/src/stardag_api/limits.pymax_workspaces_per_userandmax_environments_per_workspacefields toLimitsSettings(None default).app/stardag-api/src/stardag_api/models/workspace.pyMAX_*class constants.app/stardag-api/src/stardag_api/routes/workspaces.pylimits_settings.max_*increate_workspaceandcreate_environment; skip the check when value is None.infra/aws-cdk/lib/api-stack.tsLIMITS_MAX_WORKSPACES_PER_USER: "3"andLIMITS_MAX_ENVIRONMENTS_PER_WORKSPACE: "15"to the ECS taskenvironmentblock, next to the otherLIMITS_*values.Backwards-compat
LIMITS_*set: behaviourchanges from "3 workspaces, 6 environments" to "unlimited". This
matches the documented contract for
limits.py("all limits defaultto None / disabled for OSS-safe operation").
3/15values. The env-cap goes from 6 → 15.Notes
workspace had hit the old cap.
Test plan
POST /api/v1/ui/workspaces/{id}/environmentssucceeds in a workspace that previously had exactly 6 envs.LIMITS_MAX_ENVIRONMENTS_PER_WORKSPACElocally → no env cap enforced.🤖 Generated with Claude Code