amadan

carlos / platform Public

plans: the per-account limits record

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude 2c327941b35f57ba4bd5da69581d761e01f4f903 parent cb19422
3 files changed, +200 −0
  • internal/domains/reconcile_test.go +8 −0
  • internal/plans/record.go +86 −0
  • internal/plans/record_test.go +106 −0
diff --git a/internal/domains/reconcile_test.go b/internal/domains/reconcile_test.go
index 7629174cf..4e72b2936 100644
--- a/internal/domains/reconcile_test.go
+++ b/internal/domains/reconcile_test.go
@@ -1434,3 +1434,11 @@ func TestReconcileLeavesAnAmbiguousCustomDomainUnstamped(t *testing.T) {
t.Errorf("account = %q, want unstamped — ambiguity is not ops's to win", rt.Account)
}
}
+
+// The plans limits record lives beside the manifest, at
+// accounts/<sqid>/limits.json. It must never be mistaken for one.
+func TestAccountManifestSqidIgnoresLimitsRecord(t *testing.T) {
+ if _, ok := domains.AccountManifestSqid("accounts/abc/limits.json"); ok {
+ t.Fatal("accounts/abc/limits.json parsed as an account manifest")
+ }
+}
diff --git a/internal/plans/record.go b/internal/plans/record.go
new file mode 100644
index 000000000..b609ffe21
--- /dev/null
+++ b/internal/plans/record.go
@@ -0,0 +1,86 @@
+package plans
+
+import (
+ "context"
+ "encoding/json"
+ "errors"
+ "fmt"
+ "os"
+ "time"
+
+ "github.com/carlosframework/platform/internal/release"
+)
+
+// RecordSchema is the limits record's wire version. Fields are only ever
+// added (omitempty), and readers ignore fields they do not know, so an
+// older box reads a newer record.
+const RecordSchema = 1
+
+// Record is one account's effective limits as published to the bucket by
+// the console, its only writer (spec §7). Boxes read it beside the
+// account's manifest, which the fleet read rule already exposes to the
+// account's own boxes (internal/edge/storedoor.go).
+type Record struct {
+ Schema int `json:"schema"`
+ Account string `json:"account"` // sqid; must equal the key's
+ CatalogID string `json:"catalog_id"`
+ Plan string `json:"plan"`
+ Source string `json:"source"`
+ Revision int64 `json:"revision"`
+ Limits Limits `json:"limits"`
+ IssuedAt time.Time `json:"issued_at"`
+}
+
+// RecordKey is where an account's limits record lives.
+func RecordKey(sqid string) string { return "accounts/" + sqid + "/limits.json" }
+
+// ParseRecord decodes a record read from sqid's key, refusing an unknown
+// schema or a body that names another account.
+func ParseRecord(b []byte, sqid string) (*Record, error) {
+ var r Record
+ if err := json.Unmarshal(b, &r); err != nil {
+ return nil, fmt.Errorf("plans: %s: %w", RecordKey(sqid), err)
+ }
+ if r.Schema != RecordSchema {
+ return nil, fmt.Errorf("plans: %s: schema %d, want %d", RecordKey(sqid), r.Schema, RecordSchema)
+ }
+ if r.Account != sqid {
+ return nil, fmt.Errorf("plans: %s: names account %q", RecordKey(sqid), r.Account)
+ }
+ return &r, nil
+}
+
+// GetRecord reads sqid's record and its etag. An absent record is nil, "",
+// nil (objstore.GetEntitlement's convention).
+func GetRecord(ctx context.Context, s release.Store, sqid string) (*Record, string, error) {
+ if !release.ValidAccount(sqid) {
+ return nil, "", fmt.Errorf("plans: invalid account %q", sqid)
+ }
+ raw, etag, err := s.Get(ctx, RecordKey(sqid))
+ if err != nil {
+ if errors.Is(err, os.ErrNotExist) {
+ return nil, "", nil
+ }
+ return nil, "", err
+ }
+ r, err := ParseRecord(raw, sqid)
+ if err != nil {
+ return nil, "", err
+ }
+ return r, etag, nil
+}
+
+// PutRecord CAS-writes r under its account's key: ifMatch "" is
+// create-only, otherwise replace-only. Schema is stamped here, not trusted
+// from the caller.
+func PutRecord(ctx context.Context, s release.Store, r *Record, ifMatch string) (string, error) {
+ if !release.ValidAccount(r.Account) {
+ return "", fmt.Errorf("plans: invalid account %q", r.Account)
+ }
+ r.Schema = RecordSchema
+ body, err := json.MarshalIndent(r, "", " ")
+ if err != nil {
+ return "", err
+ }
+ return s.Put(ctx, RecordKey(r.Account), append(body, '\n'), ifMatch)
+}
diff --git a/internal/plans/record_test.go b/internal/plans/record_test.go
new file mode 100644
index 000000000..4a922acf1
--- /dev/null
+++ b/internal/plans/record_test.go
@@ -0,0 +1,106 @@
+package plans
+
+import (
+ "context"
+ "errors"
+ "testing"
+ "time"
+
+ "github.com/carlosframework/platform/internal/domains"
+ "github.com/carlosframework/platform/internal/release"
+)
+
+func TestRecordKey(t *testing.T) {
+ if got := RecordKey("abc"); got != "accounts/abc/limits.json" {
+ t.Fatalf("RecordKey = %q", got)
+ }
+}
+
+func sampleRecord(sqid string) *Record {
+ return &Record{
+ Account: sqid,
+ CatalogID: "v1@0123456789ab",
+ Plan: "free",
+ Source: "default",
+ Revision: 1,
+ Limits: Limits{RunningThings: 3, IdleSeconds: 90, MemoryTier: MemorySmall},
+ IssuedAt: time.Unix(1_800_000_000, 0).UTC(),
+ }
+}
+
+func TestRecordRoundTrip(t *testing.T) {
+ ctx := context.Background()
+ s := release.NewDirStore(t.TempDir())
+ sqid := domains.Sqid(42)
+ want := sampleRecord(sqid)
+ etag, err := PutRecord(ctx, s, want, "")
+ if err != nil || etag == "" {
+ t.Fatalf("put: %q, %v", etag, err)
+ }
+ got, getEtag, err := GetRecord(ctx, s, sqid)
+ if err != nil {
+ t.Fatal(err)
+ }
+ if getEtag == "" || got.Schema != RecordSchema {
+ t.Fatalf("etag %q, schema %d", getEtag, got.Schema)
+ }
+ want.Schema = RecordSchema
+ if *got != *want {
+ t.Fatalf("got %+v, want %+v", got, want)
+ }
+}
+
+func TestGetRecordAbsent(t *testing.T) {
+ got, etag, err := GetRecord(context.Background(), release.NewDirStore(t.TempDir()), domains.Sqid(42))
+ if got != nil || etag != "" || err != nil {
+ t.Fatalf("got %+v, %q, %v; want nil, \"\", nil", got, etag, err)
+ }
+}
+
+func TestParseRecordRefuses(t *testing.T) {
+ cases := map[string]string{
+ "schema 2": `{"schema": 2, "account": "abc"}`,
+ "wrong account": `{"schema": 1, "account": "other"}`,
+ "malformed": `{"schema": 1,`,
+ }
+ for name, body := range cases {
+ if _, err := ParseRecord([]byte(body), "abc"); err == nil {
+ t.Errorf("%s: accepted", name)
+ }
+ }
+}
+
+func TestParseRecordIgnoresUnknownFields(t *testing.T) {
+ r, err := ParseRecord([]byte(`{"schema": 1, "account": "abc", "plan": "free", "throttled": true}`), "abc")
+ if err != nil || r.Plan != "free" {
+ t.Fatalf("got %+v, %v", r, err)
+ }
+}
+
+func TestPutRecordIsCAS(t *testing.T) {
+ ctx := context.Background()
+ s := release.NewDirStore(t.TempDir())
+ sqid := domains.Sqid(42)
+ first, err := PutRecord(ctx, s, sampleRecord(sqid), "")
+ if err != nil {
+ t.Fatal(err)
+ }
+ if _, err := PutRecord(ctx, s, sampleRecord(sqid), ""); !errors.Is(err, release.ErrCASConflict) {
+ t.Fatalf("second create-only put: %v", err)
+ }
+ r := sampleRecord(sqid)
+ r.Revision = 2
+ if _, err := PutRecord(ctx, s, r, first); err != nil {
+ t.Fatalf("put with the current etag: %v", err)
+ }
+ if _, err := PutRecord(ctx, s, r, first); !errors.Is(err, release.ErrCASConflict) {
+ t.Fatalf("put with a stale etag: %v", err)
+ }
+}
+
+func TestPutRecordRefusesAnInvalidAccount(t *testing.T) {
+ r := sampleRecord("../escape")
+ if _, err := PutRecord(context.Background(), release.NewDirStore(t.TempDir()), r, ""); err == nil {
+ t.Fatal("accepted an invalid account")
+ }
+}