Skip to content
Sign in

flagon-io/g1t

public
0

g1t/services/billing/src/compute.rs

1,058 lines49,259 bytesCodeBlame

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1//! Whether a workspace may start compute, and holding what it may cost.
2//!
3//! Every service that starts something that costs g1t real money asks
4//! here first (see `g1t_contracts::billing::ReserveArgs`):
5//!
6//! - **`entitlements`**: the workspace's plan, whether it may start compute
7//! at all, its caps (agents at once, a run's time and spend, an issue's
8//! spend), its ceiling and exposure, and whether compute is paused.
9//! - **`reserve`**: holds the work's estimated cost against what may pay
10//! for it (the plan's included usage, the trial, the open-source pool,
11//! then on-demand room under the ceiling and the spend limit), so starts
12//! at the same moment cannot overshoot together. Answers who pays first,
13//! or refuses with a stable code and a message for the owner.
14//! - **`settle`**: releases the hold. The charge itself goes on the ledger
15//! the usual way; a hold never settled lapses after three hours.
16//!
17//! **No card, no compute.** A free workspace's forge is free, but compute
18//! needs the plan, or a card check: it unlocks the one-time trial and g1t's
19//! open-source pool (checks, workflows and the merge queue on public
20//! repositories). The card check is what keeps g1t's free compute from
21//! being mined: one trial per card, and a real person behind each.
22//!
23//! **Spikes.** An hour's spend above `SPIKE_FACTOR` (5) times the
24//! workspace's usual hour over the last week, and at least
25//! `SPIKE_FLOOR_MICROS` ($5), pauses new compute until an owner answers:
26//! keep going (for 24 hours, or until the hour's spend doubles again) or
27//! stop. Runs already under way finish. g1t's own workspaces are watched
28//! but never paused.
29
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index30use futures_util::future::{try_join, try_join4, try_join5};
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look31use g1t_contracts::billing::{
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index32 BillingAccount, ComputeKind, ConfirmSpikeArgs, SetCapsArgs, Entitlements, EntitlementsArgs, LimitState, PaidBy, PlanKind, Reservation,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look33 ReserveArgs, SettleArgs, Spike, UNLIMITED_MICROS, UsageAlert, RESERVATION_HOURS,
34};
35use g1t_contracts::time::rfc3339;
Merge membership: owners, org roles, GitHub's repo roles, privileges, 2FA36use g1t_contracts::{FailureCode, Outcome, new_id};
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look37use g1t_kit::now_ms;
38use serde::Deserialize;
39use worker::Result;
40use worker::wasm_bindgen::JsValue;
41
42use crate::Billing;
43use crate::credits::{self, left};
44use crate::features::dollars;
45use crate::limits::alert_level;
46
47/// Agents at once in the first month or on the trial, and after.
48pub(crate) const FIRST_MONTH_AGENTS: u32 = 2;
49pub(crate) const AGENTS: u32 = 10;
50/// The longest run in the first month or on the trial, in minutes.
51pub(crate) const FIRST_MONTH_MINUTES: u32 = 60;
52/// How long "keep going" lifts a spike's pause.
53const KEEP_GOING_MS: u64 = 24 * 60 * 60 * 1000;
54/// The week a usual hour is measured over.
55const WEEK_HOURS: i64 = 7 * 24;
56
57/// What may pay for reserved work, at price, in the order it pays.
58#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
59pub(crate) struct Room {
60 pub credit: i64,
61 pub trial: i64,
62 pub oss: i64,
63 /// Under the ceiling and the spend limit; None: no bound (g1t's own).
64 pub on_demand: Option<i64>,
65}
66
67/// Why `place` could not hold an estimate.
68#[derive(Clone, Copy, Debug, PartialEq, Eq)]
69pub(crate) enum Short {
70 /// Nothing left that pays for it.
71 Empty,
72 /// Some room, but less than a paid workspace's whole estimate.
73 TooSmall,
74}
75
76/// Where a new hold of `estimate` goes, given what open holds take
77/// (`held`): the source that pays first, and what to hold. Holds fill the
78/// sources in order, so the first source with room after them pays first.
79/// A paid workspace's whole estimate must fit, so the ceiling cannot be
80/// overshot; a free workspace may use its last bit of trial, and what the
81/// run costs past it is g1t's.
82pub(crate) fn place(room: &Room, held: i64, estimate: i64, whole: bool) -> std::result::Result<(PaidBy, i64), Short> {
83 let sources = [
84 (PaidBy::Credit, room.credit.max(0)),
85 (PaidBy::Trial, room.trial.max(0)),
86 (PaidBy::Oss, room.oss.max(0)),
87 ];
88 let pools: i64 = sources.iter().map(|(_, room)| room).sum();
89 let remaining = match room.on_demand {
90 None => i64::MAX,
91 Some(on_demand) => pools + on_demand.max(0) - held.max(0),
92 };
93 if remaining <= 0 {
94 return Err(Short::Empty);
95 }
96 let estimate = estimate.max(0);
97 if whole && estimate > remaining {
98 return Err(Short::TooSmall);
99 }
100 let hold = estimate.min(remaining);
101 let mut end = 0;
102 for (source, size) in sources {
103 end += size;
104 if held.max(0) < end {
105 return Ok((source, hold));
106 }
107 }
108 Ok((PaidBy::OnDemand, hold))
109}
110
111/// Whether the last hour is a spike: above `factor` times the usual hour,
112/// and at least `floor`.
113pub(crate) fn is_spike(last_hour: i64, usual_hour: i64, factor: i64, floor: i64) -> bool {
114 last_hour >= floor.max(1) && last_hour > usual_hour.max(0) * factor
115}
116
117/// Whether a spike an owner said to keep going on still lets work start:
118/// within its 24 hours, and the hour's spend not doubled again.
119pub(crate) fn still_continued(until: Option<&str>, now: &str, hour_at_spike: i64, last_hour: i64) -> bool {
120 until.is_some_and(|until| now < until) && last_hour < hour_at_spike.max(1) * 2
121}
122
123/// A workspace's caps, from its plan.
124pub(crate) fn caps(plan: PlanKind, first_month: bool, on_trial: bool, agents: Option<u32>) -> (u32, u32) {
125 let tight = first_month || (plan == PlanKind::Free && on_trial) || plan == PlanKind::Free;
126 let default_agents = if tight { FIRST_MONTH_AGENTS } else { AGENTS };
127 let minutes = if tight { FIRST_MONTH_MINUTES } else { g1t_contracts::guardrails::MAX_MINUTES };
128 (agents.unwrap_or(default_agents), minutes)
129}
130
131/// The refusal for a start that cannot be held, with what to do.
132pub(crate) fn refusal(code: FailureCode, workspace: &str, kind: ComputeKind, detail: &str) -> Outcome<Reservation> {
133 let link = format!("/{workspace}/-/billing");
134 let what = match kind {
135 ComputeKind::Agent => "Agents",
136 ComputeKind::Check => "Checks",
137 ComputeKind::Workflow => "Workflows",
138 ComputeKind::Queue => "The merge queue",
139 ComputeKind::Deploy => "Deployments",
140 ComputeKind::Embedding => "Semantic search",
141 };
142 let message = match code {
143 FailureCode::NotPaid if kind.open_source_pool() => format!(
144 "{what} run in g1t's sandboxes, which cost real money, so they need the g1t plan ($20 a month) or a card check. A card check gives public repositories g1t's open-source pool and starts the $5 trial; it is never charged. Both are at {link}."
145 ),
146 FailureCode::NotPaid => format!(
147 "{what} cost real money to run, so they need the g1t plan ($20 a month, with $10 of usage included) or the one-time $5 trial, which starts with a card check that is never charged. Both are at {link}."
148 ),
149 FailureCode::TrialUsed => format!(
150 "This workspace has used its $5 trial. Start the g1t plan ($20 a month, with $10 of usage included) to keep going: {link}."
151 ),
152 FailureCode::OssPoolEmpty => format!(
153 "g1t's open-source pool for this month is used up{detail}, so checks and workflows on public repositories wait until the 1st. The g1t plan runs them now: {link}."
154 ),
155 FailureCode::Limit => format!("{detail} An owner can raise the limit, prepay, or ask g1t for more at {link}."),
156 FailureCode::Paused => format!("New compute is paused: {detail} An owner can see why and answer at {link}."),
157 _ => detail.to_owned(),
158 };
159 Outcome::fail(code, message)
160}
161
162#[derive(Deserialize)]
163struct SpikeRow {
164 id: String,
165 status: String,
166 hour_micros: i64,
167 average_micros: i64,
168 detected_at: String,
169 decided_by: Option<String>,
170 decided_at: Option<String>,
171 until: Option<String>,
172}
173
174impl From<SpikeRow> for Spike {
175 fn from(row: SpikeRow) -> Self {
176 Spike {
177 id: row.id,
178 status: row.status,
179 hour_micros: row.hour_micros,
180 average_micros: row.average_micros,
181 detected_at: row.detected_at,
182 decided_by: row.decided_by,
183 decided_at: row.decided_at,
184 until: row.until,
185 }
186 }
187}
188
189/// A workspace's pace: the last hour, the usual hour over the last week,
190/// the last day, at price (what was charged plus what paid for it first).
191#[derive(Clone, Copy, Debug, Default)]
192pub(crate) struct Pace {
193 pub last_hour: i64,
194 pub usual_hour: i64,
195 pub last_day: i64,
196}
197
198impl Billing {
199 /// Spend at price over the last hour, day and week.
200 pub(crate) async fn pace(&self, workspace: &str) -> Result<Pace> {
201 #[derive(Deserialize)]
202 struct Row {
203 hour: Option<i64>,
204 day: Option<i64>,
205 week: Option<i64>,
206 }
207 let now = now_ms();
208 let hour_ago = rfc3339(now - 60 * 60 * 1000);
209 let day_ago = rfc3339(now - 24 * 60 * 60 * 1000);
210 let week_ago = rfc3339(now - 7 * 24 * 60 * 60 * 1000);
211 let gross = "(-amount_micros + credit_micros + trial_micros + oss_micros + given_micros)";
212 let row = self
213 .db
214 .prepare(format!(
215 "SELECT SUM(CASE WHEN created_at >= ?2 THEN {gross} END) AS hour,
216 SUM(CASE WHEN created_at >= ?3 THEN {gross} END) AS day,
217 SUM(CASE WHEN created_at < ?2 THEN {gross} END) AS week
218 FROM ledger WHERE workspace = ?1 AND kind = 'usage' AND created_at >= ?4"
219 ))
220 .bind(&[workspace.into(), hour_ago.into(), day_ago.into(), week_ago.into()])?
221 .first::<Row>(None)
222 .await?;
223 Ok(row.map_or_else(Pace::default, |r| Pace {
224 last_hour: r.hour.unwrap_or(0).max(0),
225 usual_hour: r.week.unwrap_or(0).max(0) / (WEEK_HOURS - 1),
226 last_day: r.day.unwrap_or(0).max(0),
227 }))
228 }
229
230 /// The workspace's latest spike, if any.
231 pub(crate) async fn latest_spike(&self, workspace: &str) -> Result<Option<Spike>> {
232 Ok(self
233 .db
234 .prepare(
235 "SELECT id, status, hour_micros, average_micros, detected_at, decided_by, decided_at, until
236 FROM spikes WHERE workspace = ? ORDER BY detected_at DESC LIMIT 1",
237 )
238 .bind(&[workspace.into()])?
239 .first::<SpikeRow>(None)
240 .await?
241 .map(Spike::from))
242 }
243
244 /// The spike pausing the workspace now, found or new. Never for g1t's
245 /// own workspaces, which are watched in sudo but never paused.
246 async fn spike_pause(&self, workspace: &str, plan: PlanKind) -> Result<Option<Spike>> {
247 let latest = self.latest_spike(workspace).await?;
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept248 if let Some(spike) = &latest
249 && (spike.status == "open" || spike.status == "stopped") {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look250 return Ok(latest);
251 }
252 if plan == PlanKind::Internal || self.stripe.is_none() {
253 return Ok(None);
254 }
255 let pace = self.pace(workspace).await?;
256 let now = rfc3339(now_ms());
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept257 if let Some(spike) = &latest
258 && spike.status == "continued" && still_continued(spike.until.as_deref(), &now, spike.hour_micros, pace.last_hour) {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look259 return Ok(None);
260 }
261 if !is_spike(pace.last_hour, pace.usual_hour, self.plans.spike_factor, self.plans.spike_floor_micros) {
262 return Ok(None);
263 }
264 let id = new_id("spk", now_ms());
265 self.db
266 .prepare(
267 "INSERT INTO spikes (id, workspace, status, hour_micros, average_micros, detected_at)
268 SELECT ?1, ?2, 'open', ?3, ?4, ?5
269 WHERE NOT EXISTS (SELECT 1 FROM spikes WHERE workspace = ?2 AND status = 'open')",
270 )
271 .bind(&[id.as_str().into(), workspace.into(), (pace.last_hour as f64).into(), (pace.usual_hour as f64).into(), now.as_str().into()])?
272 .run()
273 .await?;
274 self.latest_spike(workspace).await
275 }
276
277 /// The alerts a workspace has reached this month: its plan's included
278 /// usage, its spend limit and g1t's ceiling, from 50%.
279 pub(crate) async fn alerts_for(&self, workspace: &str) -> Result<Vec<UsageAlert>> {
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index280 let account = self.account_of(workspace).await?;
281 let plan = self.plan_kind_for(workspace, &account).await?;
282 let has_plan = plan != PlanKind::Free;
283 let month = credits::month_of(&rfc3339(now_ms()));
284 let (limit, used) = try_join(self.limit_with(workspace, &account, plan), async {
285 if has_plan { self.allowance_used("plan_credit", workspace, &month).await } else { Ok(0) }
286 })
287 .await?;
288 Ok(alerts_from(workspace, &limit, has_plan, used, self.plans.plan_included_micros))
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look289 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index290}
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look291
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index292/// The alerts reached, from a limit already worked out, whether the
293/// workspace has the plan, and what of its included usage it has used.
294fn alerts_from(
295 workspace: &str,
296 limit: &g1t_contracts::billing::Limit,
297 has_plan: bool,
298 used: i64,
299 included: i64,
300) -> Vec<UsageAlert> {
301 let mut alerts = vec![];
302 if has_plan && limit.trust != g1t_contracts::billing::Trust::Internal {
303 let level = alert_level(used, included);
304 if level > 0 {
305 alerts.push(UsageAlert {
306 meter: "included".into(),
307 level,
308 used_micros: used,
309 limit_micros: included,
310 message: if level >= 100 {
311 format!("{workspace} has used all {} of this month's included usage. Usage from here is charged at cost plus 20%, up to your spend limit.", dollars(included))
312 } else {
313 format!("{workspace} has used {} of this month's {} included usage ({level}%). Past it, usage is charged at cost plus 20%, up to your spend limit.", dollars(used), dollars(included))
314 },
315 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look316 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index317 }
318 if let Some(spend_limit) = limit.spend_limit_micros {
Usage, Billing settings and prepaid AI credit; fixes from the UX audit319 let level = crate::limits::alert_level_in(limit.spent_micros, spend_limit, &limit.alert_levels);
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index320 if level > 0 {
321 alerts.push(UsageAlert {
322 meter: "spend_limit".into(),
323 level,
324 used_micros: limit.spent_micros,
325 limit_micros: spend_limit,
326 message: format!(
327 "{workspace} has spent {} of its {} monthly spend limit ({level}%). At the limit, new sandboxes, builds and agents stop until the month turns or an owner raises it.",
328 dollars(limit.spent_micros),
329 dollars(spend_limit)
330 ),
331 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look332 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index333 }
334 if let Some(ceiling) = limit.ceiling_micros.filter(|_| limit.trust != g1t_contracts::billing::Trust::New) {
335 let level = alert_level(limit.exposure_micros, ceiling);
336 if level > 0 {
337 alerts.push(UsageAlert {
338 meter: "ceiling".into(),
339 level,
340 used_micros: limit.exposure_micros,
341 limit_micros: ceiling,
342 message: format!(
343 "{workspace} has {} of usage not yet paid for, of the {} g1t allows ({level}%). With a card on file g1t charges it as the limit nears; prepaying raises it at once.",
344 dollars(limit.exposure_micros),
345 dollars(ceiling)
346 ),
347 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look348 }
349 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index350 alerts
351}
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look352
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index353impl Billing {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look354 /// Whether a card check was done for the workspace.
355 pub(crate) async fn card_checked(&self, workspace: &str) -> Result<bool> {
356 Ok(self
357 .db
358 .prepare("SELECT workspace FROM card_checks WHERE workspace = ?")
359 .bind(&[workspace.into()])?
360 .first::<serde_json::Value>(None)
361 .await?
362 .is_some())
363 }
364
365 /// What open reservations hold across `members`, at price.
366 async fn held(&self, members: &[String]) -> Result<i64> {
367 #[derive(Deserialize)]
368 struct Row {
369 held: Option<i64>,
370 }
371 let marks = vec!["?"; members.len().max(1)].join(", ");
372 let mut values: Vec<JsValue> = members.iter().map(|m| JsValue::from(m.as_str())).collect();
373 if values.is_empty() {
374 values.push("".into());
375 }
376 values.push(rfc3339(now_ms()).into());
377 Ok(self
378 .db
379 .prepare(format!(
380 "SELECT SUM(hold_micros) AS held FROM reservations
381 WHERE workspace IN ({marks}) AND settled_at IS NULL AND expires_at > ?"
382 ))
383 .bind(&values)?
384 .first::<Row>(None)
385 .await?
386 .and_then(|r| r.held)
387 .unwrap_or(0))
388 }
389
390 /// Why new compute is paused, if it is: a staff hold, a spike waiting
391 /// for an owner (or stopped by one), or the limit reached.
392 async fn pause_reason(
393 &self,
394 workspace: &str,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index395 account: &BillingAccount,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look396 plan: PlanKind,
397 limit: Option<&g1t_contracts::billing::Limit>,
398 ) -> Result<(Option<String>, Option<Spike>, Option<FailureCode>)> {
399 if let Some(hold) = account.allowances.hold.as_deref().filter(|h| !h.trim().is_empty()) {
400 return Ok((Some(format!("g1t staff put a hold on new compute ({}).", hold.trim())), None, Some(FailureCode::Paused)));
401 }
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays402 // A comped account past its monthly budget (`budget`).
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index403 if let Some(why) = self.comped_stop(account).await? {
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays404 return Ok((Some(why), None, Some(FailureCode::Paused)));
405 }
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look406 let spike = self.spike_pause(workspace, plan).await?;
407 if let Some(spike) = &spike {
408 let why = if spike.status == "stopped" {
409 format!(
410 "an owner stopped new compute after a spend spike ({} in an hour). An owner can choose Keep going.",
411 dollars(spike.hour_micros)
412 )
413 } else {
414 format!(
415 "{} was spent in an hour, more than {} times the usual {} an hour, so new compute waits for an owner to confirm.",
416 dollars(spike.hour_micros),
417 self.plans.spike_factor,
418 dollars(spike.average_micros)
419 )
420 };
421 return Ok((Some(why), Some(spike.clone()), Some(FailureCode::Paused)));
422 }
423 let latest = self.latest_spike(workspace).await?;
424 if plan != PlanKind::Internal && self.stripe.is_some() {
425 let worked_out;
426 let limit = match limit {
427 Some(limit) => limit,
428 None => {
429 worked_out = self.limit_of(workspace).await?;
430 &worked_out
431 }
432 };
433 if limit.state == LimitState::Stopped {
434 return Ok((limit.message.clone(), latest, Some(FailureCode::Limit)));
435 }
436 }
437 Ok((None, latest, None))
438 }
439
440 /// `entitlements`: what the workspace may do now.
441 pub(crate) async fn entitlements(&self, a: EntitlementsArgs) -> Result<Entitlements> {
442 let workspace = a.workspace.to_lowercase();
443 let account = self.account_of(&workspace).await?;
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index444 let plan = self.plan_kind_for(&workspace, &account).await?;
445 let has_plan = plan != PlanKind::Free;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look446 let now = rfc3339(now_ms());
447 let month = credits::month_of(&now);
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index448 // Every signed-in page asks for this, so what does not need another
449 // answer is read at once: the limit (and the pause, from it), the
450 // trial, and the month's counts.
451 let standing = async {
452 let limit = self.limit_with(&workspace, &account, plan).await?;
453 let pause = self.pause_reason(&workspace, &account, plan, Some(&limit)).await?;
454 Ok::<_, worker::Error>((limit, pause))
455 };
456 let trial = async {
457 let (checked, grant) = try_join(
458 async {
459 if matches!(plan, PlanKind::Internal | PlanKind::Enterprise) { Ok(true) } else { self.card_checked(&workspace).await }
460 },
461 self.grant_of(&workspace),
462 )
463 .await?;
464 // A card checked while the month's pool was empty: granted once
465 // it has room.
466 let grant = match grant {
467 Some(grant) => Some(grant),
468 None if checked && plan == PlanKind::Free && self.trial_allowed(&workspace).await? => self.ensure_grant(&workspace).await?,
469 None => None,
470 };
471 Ok::<_, worker::Error>((checked, grant))
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look472 };
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index473 let counts = try_join5(
474 self.owner_caps(&workspace),
475 self.private_storage(&workspace),
476 self.oss_paid(&workspace, &month),
477 self.held(&account.workspaces),
478 async { if has_plan { self.allowance_used("plan_credit", &workspace, &month).await } else { Ok(0) } },
479 );
480 let more = try_join(self.allowance_used("build_seconds", &workspace, &month), self.git_operations_this_month(&workspace));
481 let ((limit, (paused, spike, _)), (verified, grant), (owners, stored, oss, held, included_used), (build_seconds, git_operations)) =
482 try_join4(standing, trial, counts, more).await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look483 let trial_left = grant.as_ref().map_or(0, |g| left(g.granted_micros, g.used_micros));
484 let first_month = limit.first_month;
485 let (max_agents, max_minutes) = caps(plan, first_month, trial_left > 0, account.allowances.max_concurrent_agents);
486 let ceiling = match plan {
487 PlanKind::Free => 0,
488 PlanKind::Internal => UNLIMITED_MICROS,
489 _ => limit.ceiling_micros.unwrap_or(UNLIMITED_MICROS),
490 };
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index491 let alerts = alerts_from(&workspace, &limit, has_plan, included_used, self.plans.plan_included_micros);
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look492 Ok(Entitlements {
493 plan,
494 compute: has_plan || trial_left > 0,
495 trial_micros_left: trial_left,
496 trial_verified: verified,
497 first_month,
498 max_concurrent_agents: max_agents,
499 max_run_minutes: max_minutes,
500 run_cap_micros: account.allowances.run_cap_micros.or(owners.0).unwrap_or(self.plans.run_cap_micros),
501 issue_cap_micros: account.allowances.issue_cap_micros.or(owners.1).unwrap_or(self.plans.issue_cap_micros),
502 ceiling_micros: ceiling,
503 exposure_micros: limit.exposure_micros,
504 paused,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index505 held_micros: held,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look506 prepaid_micros: limit.prepaid_micros,
507 included_micros: if has_plan { self.plans.plan_included_micros } else { 0 },
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index508 included_used_micros: included_used,
Audit logs are kept by plan: a week on free, 90 days on the plan, and what staff set for an account in sudo509 audit_retention_days: crate::retention::effective_days(&self.plans, plan, account.allowances.audit_retention_days),
510 audit_retention_custom: account.allowances.audit_retention_days.is_some(),
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas511 free_private_storage_bytes: self.plans.free_storage_bytes,
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member512 // For the packages service: on the plan nothing is refused; without it,
513 // pushes past these amounts are.
514 has_plan,
515 package_public_free_bytes: self.plans.public_package_free_bytes,
516 package_private_free_bytes: self.plans.private_package_free_bytes,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look517 private_storage_bytes: stored,
518 oss_paid_micros: oss,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index519 build_seconds_used: build_seconds.max(0) as u32,
520 git_operations,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look521 git_operations_included: self.plans.git_included,
522 min_charge_micros: self.plans.min_charge_micros,
523 spike,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index524 alerts,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look525 workspace,
526 })
527 }
528
529 /// `reserve`: holds a start's estimated cost, or says why not.
530 pub(crate) async fn reserve(&self, a: ReserveArgs) -> Result<Outcome<Reservation>> {
531 let workspace = a.workspace.to_lowercase();
532 let now = now_ms();
533 let expires_at = rfc3339(now + RESERVATION_HOURS * 60 * 60 * 1000);
534 let repo = format!("{}/{}", a.repo.namespace, a.repo.name).to_lowercase();
535 // A g1t that does not charge holds nothing.
536 if self.stripe.is_none() {
537 return Ok(Outcome::Ok(Reservation { id: new_id("rsv", now), paid_by: PaidBy::OnDemand, held_micros: 0, expires_at }));
538 }
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays539 let account = self.account_of(&workspace).await?;
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index540 let plan = self.plan_kind_for(&workspace, &account).await?;
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays541 // g1t's own caps (`budget`), in their own words: a comped account's
542 // monthly budget, and the daily breaker.
543 if let Some(why) = self.comped_stop(&account).await? {
544 return Ok(Outcome::fail(FailureCode::Paused, why));
545 }
546 if let Some(why) = self.breaker_refuses(plan, &account, a.kind, a.hosted_model).await? {
547 return Ok(Outcome::fail(FailureCode::Paused, why));
548 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index549 let limit = if plan == PlanKind::Internal { None } else { Some(self.limit_with(&workspace, &account, plan).await?) };
550 let (paused, _, code) = self.pause_reason(&workspace, &account, plan, limit.as_ref()).await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look551 if let (Some(why), Some(code)) = (paused, code) {
552 return Ok(refusal(code, &workspace, a.kind, &why));
553 }
554 let month = credits::month_of(&rfc3339(now));
555 let estimate = credits::with_margin(a.estimate_micros, self.margin_percent);
556 let verified = matches!(plan, PlanKind::Internal | PlanKind::Enterprise | PlanKind::Paid) || self.card_checked(&workspace).await?;
557 let has_plan = plan != PlanKind::Free;
558 let credit = if has_plan {
559 left(self.plans.plan_included_micros, self.allowance_used("plan_credit", &workspace, &month).await?)
560 } else {
561 0
562 };
563 let trial = if a.kind == ComputeKind::Deploy || !verified {
564 0
565 } else {
566 self.grant_of(&workspace).await?.map_or(0, |g| left(g.granted_micros, g.used_micros))
567 };
568 let oss_eligible = a.public && a.kind.open_source_pool() && verified;
569 let oss = if oss_eligible { self.oss_left(&workspace, &repo, &month).await? } else { 0 };
570 let on_demand = match plan {
571 PlanKind::Free => Some(0),
572 PlanKind::Internal => None,
573 _ => {
574 let Some(limit) = &limit else { unreachable!("only g1t's own workspaces skip the limit") };
575 let under_ceiling = limit.ceiling_micros.map(|c| (c - limit.exposure_micros).max(0));
576 let under_spend = limit.spend_limit_micros.map(|s| (s - limit.spent_micros).max(0));
577 match (under_ceiling, under_spend) {
578 (Some(c), Some(s)) => Some(c.min(s)),
579 (c, s) => c.or(s),
580 }
581 }
582 };
583 let room = Room { credit, trial, oss, on_demand };
584 // Optimistic: what was held is read, and the hold is written only if
585 // nothing was held meanwhile; otherwise read again.
586 for _ in 0..4 {
587 let held = self.held(&account.workspaces).await?;
588 let (paid_by, hold) = match place(&room, held, estimate, has_plan) {
589 Ok(placed) => placed,
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept590 Err(short) => return self.short(&workspace, plan, &a, verified, &room, short).await,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look591 };
592 let id = new_id("rsv", now);
593 let mut values: Vec<JsValue> = vec![
594 id.as_str().into(),
595 workspace.as_str().into(),
596 repo.as_str().into(),
597 a.kind.as_str().into(),
598 u8::from(a.public).into(),
599 (a.estimate_micros.max(0) as f64).into(),
600 (hold as f64).into(),
601 paid_by_text(paid_by).into(),
602 rfc3339(now).into(),
603 expires_at.as_str().into(),
604 (held as f64).into(),
605 ];
606 values.extend(account.workspaces.iter().map(|w| JsValue::from(w.as_str())));
607 if account.workspaces.is_empty() {
608 values.push("".into());
609 }
610 let placed = self
611 .db
612 .prepare(format!(
613 "INSERT INTO reservations (id, workspace, repo, kind, public, estimate_micros, hold_micros, paid_by, created_at, expires_at)
614 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10
615 WHERE (SELECT COALESCE(SUM(hold_micros), 0) FROM reservations
616 WHERE workspace IN ({marks}) AND settled_at IS NULL AND expires_at > ?9) = ?11
617 RETURNING id",
618 marks = (12..12 + account.workspaces.len().max(1)).map(|i| format!("?{i}")).collect::<Vec<_>>().join(", ")
619 ))
620 .bind(&values)?
621 .first::<serde_json::Value>(None)
622 .await?;
623 if placed.is_some() {
624 // What is held, at cost, as it was asked.
625 let held_cost = if hold >= estimate { a.estimate_micros.max(0) } else { hold * 100 / i64::from(100 + self.margin_percent) };
626 return Ok(Outcome::Ok(Reservation { id, paid_by, held_micros: held_cost, expires_at }));
627 }
628 }
629 Ok(refusal(FailureCode::Limit, &workspace, a.kind, "Too many starts at once to hold this one; try again in a moment."))
630 }
631
632 /// The refusal for a start nothing pays for.
633 async fn short(
634 &self,
635 workspace: &str,
636 plan: PlanKind,
637 a: &ReserveArgs,
638 verified: bool,
639 room: &Room,
640 short: Short,
641 ) -> Result<Outcome<Reservation>> {
642 if plan != PlanKind::Free {
643 let limit = self.limit_of(workspace).await?;
644 let detail = match short {
645 Short::TooSmall => format!(
646 "This would take the workspace past its limit: about {} more could start now ({} spent of a {} spend limit, {} not yet paid of the {} g1t allows).",
647 dollars(room.credit + room.trial + room.oss + room.on_demand.unwrap_or(0)),
648 dollars(limit.spent_micros),
649 dollars(limit.spend_limit_micros.unwrap_or_default()),
650 dollars(limit.exposure_micros),
651 dollars(limit.ceiling_micros.unwrap_or_default()),
652 ),
653 Short::Empty => limit.message.unwrap_or_else(|| "The workspace reached its limit for this month.".to_owned()),
654 };
655 return Ok(refusal(FailureCode::Limit, workspace, a.kind, &detail));
656 }
657 if !verified {
658 return Ok(refusal(FailureCode::NotPaid, workspace, a.kind, ""));
659 }
660 let oss_eligible = a.public && a.kind.open_source_pool();
661 let trial = self.grant_of(workspace).await?;
662 if oss_eligible && room.oss == 0 {
663 let month = credits::month_of(&rfc3339(now_ms()));
664 let repo = format!("{}/{}", a.repo.namespace, a.repo.name).to_lowercase();
665 let pool = left(self.plans.oss_pool_micros, self.allowance_used("oss_pool", "", &month).await?);
666 let detail = if pool > 0 { format!(" for {repo} (its share is {})", dollars(self.oss_repo_cap(workspace).await?)) } else { String::new() };
667 if trial.as_ref().is_none_or(|g| g.used_micros >= g.granted_micros) {
668 return Ok(refusal(FailureCode::OssPoolEmpty, workspace, a.kind, &detail));
669 }
670 }
671 match trial {
672 Some(grant) if grant.used_micros >= grant.granted_micros => Ok(refusal(FailureCode::TrialUsed, workspace, a.kind, "")),
673 _ => Ok(refusal(FailureCode::NotPaid, workspace, a.kind, "")),
674 }
675 }
676
677 /// `settle`: releases a hold.
678 pub(crate) async fn settle_reservation(&self, a: SettleArgs) -> Result<Outcome<bool>> {
679 let now = rfc3339(now_ms());
680 let settled = self
681 .db
682 .prepare(
683 "UPDATE reservations SET settled_at = ?1, actual_micros = ?2
684 WHERE id = ?3 AND settled_at IS NULL AND expires_at > ?1 RETURNING id",
685 )
686 .bind(&[now.as_str().into(), (a.actual_micros.max(0) as f64).into(), a.reservation_id.as_str().into()])?
687 .first::<serde_json::Value>(None)
688 .await?;
689 Ok(Outcome::Ok(settled.is_some()))
690 }
691
692 /// Clears reservations long settled or lapsed.
693 pub(crate) async fn sweep_reservations(&self) -> Result<()> {
694 let week_ago = rfc3339(now_ms() - 7 * 24 * 60 * 60 * 1000);
695 self.db
696 .prepare("DELETE FROM reservations WHERE expires_at < ?1")
697 .bind(&[week_ago.into()])?
698 .run()
699 .await?;
700 Ok(())
701 }
702
703 /// `confirm_spike`: an owner keeps going, or stops.
704 pub(crate) async fn confirm_spike(&self, a: ConfirmSpikeArgs) -> Result<Outcome<Entitlements>> {
705 let workspace = a.workspace.to_lowercase();
Merge membership: owners, org roles, GitHub's repo roles, privileges, 2FA706 if !a.actor.manages_billing(&workspace) {
707 return Ok(Outcome::fail(FailureCode::Forbidden, "Only an owner or a billing manager can answer a spend spike."));
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look708 }
709 let Some(spike) = self.latest_spike(&workspace).await? else {
710 return Ok(Outcome::fail(FailureCode::NotFound, "There is no spend spike to answer."));
711 };
712 let now = now_ms();
713 let (status, until) = if a.keep_going { ("continued", Some(rfc3339(now + KEEP_GOING_MS))) } else { ("stopped", None) };
714 self.db
715 .prepare("UPDATE spikes SET status = ?1, decided_by = ?2, decided_at = ?3, until = ?4 WHERE id = ?5")
716 .bind(&[
717 status.into(),
718 a.actor.username.as_str().into(),
719 rfc3339(now).into(),
720 crate::optional(until.as_deref()),
721 spike.id.as_str().into(),
722 ])?
723 .run()
724 .await?;
725 let account = self.account_of(&workspace).await?;
726 self.audit(
727 &account.id,
728 "spike",
729 &format!("{workspace}: {} after {} in an hour", if a.keep_going { "kept going" } else { "stopped" }, dollars(spike.hour_micros)),
730 &a.actor.username,
731 )
732 .await?;
733 Ok(Outcome::Ok(self.entitlements(EntitlementsArgs { workspace }).await?))
734 }
735
736 /// The owners' own run and issue caps, if they set them.
737 async fn owner_caps(&self, workspace: &str) -> Result<(Option<i64>, Option<i64>)> {
738 #[derive(Deserialize)]
739 struct Row {
740 run_cap_micros: Option<i64>,
741 issue_cap_micros: Option<i64>,
742 }
743 Ok(self
744 .db
745 .prepare("SELECT run_cap_micros, issue_cap_micros FROM limits WHERE workspace = ?")
746 .bind(&[workspace.into()])?
747 .first::<Row>(None)
748 .await?
749 .map_or((None, None), |r| (r.run_cap_micros, r.issue_cap_micros)))
750 }
751
752 /// `set_caps`: the owners' own run and issue caps.
753 pub(crate) async fn set_caps(&self, a: SetCapsArgs) -> Result<Outcome<Entitlements>> {
754 let workspace = a.workspace.to_lowercase();
Merge membership: owners, org roles, GitHub's repo roles, privileges, 2FA755 if !a.actor.manages_billing(&workspace) {
756 return Ok(Outcome::fail(FailureCode::Forbidden, "Only an owner or a billing manager can set the workspace's caps."));
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look757 }
758 if let Err(why) = cap_bounds(a.run_cap_micros, a.issue_cap_micros) {
759 return Ok(Outcome::fail(FailureCode::Invalid, why));
760 }
761 let opt = |m: Option<i64>| m.map_or(JsValue::NULL, |m| (m as f64).into());
762 let now = rfc3339(now_ms());
763 self.db
764 .prepare(
765 "INSERT INTO limits (workspace, run_cap_micros, issue_cap_micros, updated_at) VALUES (?1, ?2, ?3, ?4)
766 ON CONFLICT (workspace) DO UPDATE SET run_cap_micros = ?2, issue_cap_micros = ?3, updated_at = ?4",
767 )
768 .bind(&[workspace.as_str().into(), opt(a.run_cap_micros), opt(a.issue_cap_micros), now.into()])?
769 .run()
770 .await?;
771 let account = self.account_of(&workspace).await?;
772 let shown = |m: Option<i64>| m.map_or_else(|| "the default".to_owned(), dollars);
773 self.audit(
774 &account.id,
775 "caps",
776 &format!("{workspace}: run cap {}, issue cap {}", shown(a.run_cap_micros), shown(a.issue_cap_micros)),
777 &a.actor.username,
778 )
779 .await?;
780 Ok(Outcome::Ok(self.entitlements(EntitlementsArgs { workspace }).await?))
781 }
782
783 /// Emails owners about spikes that paused their workspace, once each.
784 pub(crate) async fn tell_spikes(&self, identity: &worker::Fetcher) -> Result<()> {
785 #[derive(Deserialize)]
786 struct Open {
787 id: String,
788 workspace: String,
789 hour_micros: i64,
790 average_micros: i64,
791 }
792 let open = self
793 .db
794 .prepare("SELECT id, workspace, hour_micros, average_micros FROM spikes WHERE status = 'open' AND told_at IS NULL LIMIT 20")
795 .all()
796 .await?
797 .results::<Open>()?;
798 for spike in open {
799 let workspace = &spike.workspace;
800 let intro = format!(
801 "{workspace} spent {} in the last hour, more than {} times its usual {} an hour, so g1t paused new sandboxes, agents and builds until an owner confirms. Runs already going finish. If this was meant, choose Keep going and nothing pauses for 24 hours unless the hour's spend doubles again. If not, choose Stop; and if it was a mistake, tell g1t from the billing page.",
802 dollars(spike.hour_micros),
803 self.plans.spike_factor,
804 dollars(spike.average_micros)
805 );
806 let link = format!("https://g1t.sh/{workspace}/-/billing");
807 if crate::limits::notify(identity, workspace, &format!("g1t: spending on {workspace} spiked, so new work is paused"), &intro, "Keep going or stop", &link).await {
808 self.db
809 .prepare("UPDATE spikes SET told_at = ? WHERE id = ?")
810 .bind(&[rfc3339(now_ms()).into(), spike.id.as_str().into()])?
811 .run()
812 .await?;
813 }
814 }
815 Ok(())
816 }
817
818 /// What the workspace's private repositories held at the last measure.
819 pub(crate) async fn private_storage(&self, workspace: &str) -> Result<i64> {
820 #[derive(Deserialize)]
821 struct Stored {
822 private_bytes: Option<i64>,
823 }
824 Ok(self
825 .db
826 .prepare("SELECT private_bytes FROM storage_days WHERE workspace = ? ORDER BY day DESC LIMIT 1")
827 .bind(&[workspace.into()])?
828 .first::<Stored>(None)
829 .await?
830 .and_then(|s| s.private_bytes)
831 .unwrap_or(0))
832 }
833
834 /// What g1t's open-source pool paid for the workspace in `month`.
835 async fn oss_paid(&self, workspace: &str, month: &str) -> Result<i64> {
836 #[derive(Deserialize)]
837 struct Sum {
838 micros: Option<i64>,
839 }
840 Ok(self
841 .db
842 .prepare("SELECT SUM(oss_micros) AS micros FROM ledger WHERE workspace = ? AND created_at >= ?")
843 .bind(&[workspace.into(), format!("{month}-01").into()])?
844 .first::<Sum>(None)
845 .await?
846 .and_then(|s| s.micros)
847 .unwrap_or(0))
848 }
849}
850
851/// Whether owners' caps are in bounds: a run $0.10 to $100 (the
852/// guardrails' most), an issue $1 to $1,000.
853pub(crate) fn cap_bounds(run: Option<i64>, issue: Option<i64>) -> std::result::Result<(), String> {
854 if run.is_some_and(|m| !(100_000..=100_000_000).contains(&m)) {
855 return Err("A run's cap is between $0.10 and $100.".to_owned());
856 }
857 if issue.is_some_and(|m| !(1_000_000..=1_000_000_000).contains(&m)) {
858 return Err("An issue's cap is between $1 and $1,000.".to_owned());
859 }
860 Ok(())
861}
862
863pub(crate) fn paid_by_text(paid_by: PaidBy) -> &'static str {
864 match paid_by {
865 PaidBy::Credit => "credit",
866 PaidBy::Trial => "trial",
867 PaidBy::Oss => "oss",
868 PaidBy::OnDemand => "on_demand",
869 }
870}
871
872#[cfg(test)]
873mod tests {
874 use super::*;
875
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index876 fn limit(trust: g1t_contracts::billing::Trust, spent: i64, spend_limit: Option<i64>, exposure: i64, ceiling: Option<i64>) -> g1t_contracts::billing::Limit {
877 g1t_contracts::billing::Limit {
878 workspace: "acme".into(),
879 account: "acc_acme".into(),
880 account_name: "acme".into(),
881 trust,
882 exposure_micros: exposure,
883 ceiling_micros: ceiling,
884 trust_ceiling_micros: ceiling,
885 spend_limit_micros: spend_limit,
886 state: LimitState::Ok,
887 message: None,
888 spent_micros: spent,
889 default_spend_limit: false,
890 available_micros: None,
891 growth: None,
892 prepaid_micros: 0,
893 max_ceiling_micros: None,
894 raise_once_micros: None,
895 raised_at: None,
896 first_month: false,
Usage, Billing settings and prepaid AI credit; fixes from the UX audit897 alert_levels: crate::limits::ALERT_LEVELS.to_vec(),
898 pause_at_limit: true,
899 budget_webhook: None,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index900 }
901 }
902
903 #[test]
904 fn alerts_come_from_the_answers_already_read() {
905 use g1t_contracts::billing::Trust;
906 let meters = |alerts: Vec<UsageAlert>| alerts.into_iter().map(|a| (a.meter, a.level)).collect::<Vec<_>>();
907 // On the plan: included usage at 90%, the spend limit at 50%, the ceiling at 75%.
908 let paid = limit(Trust::Paid, 100_000_000, Some(200_000_000), 75_000_000, Some(100_000_000));
909 assert_eq!(
910 meters(alerts_from("acme", &paid, true, 9_000_000, 10_000_000)),
911 vec![("included".to_owned(), 90), ("spend_limit".to_owned(), 50), ("ceiling".to_owned(), 75)]
912 );
913 // Without the plan, what was used of the included usage is not an alert.
914 assert_eq!(meters(alerts_from("acme", &paid, false, 9_000_000, 10_000_000)).len(), 2);
915 // g1t's own workspaces have no included usage to warn of, and a new
916 // workspace's ceiling is not one either.
917 let internal = limit(Trust::Internal, 0, None, 0, None);
918 assert!(alerts_from("acme", &internal, true, 10_000_000, 10_000_000).is_empty());
919 let new = limit(Trust::New, 0, None, 3_000_000, Some(3_000_000));
920 assert!(alerts_from("acme", &new, false, 0, 10_000_000).is_empty());
921 }
922
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look923 fn paid(credit: i64, on_demand: i64) -> Room {
924 Room { credit, trial: 0, oss: 0, on_demand: Some(on_demand) }
925 }
926
927 #[test]
928 fn included_usage_pays_first_then_on_demand() {
929 // $10 included, $100 under the ceiling, nothing held: included pays first.
930 assert_eq!(place(&paid(10_000_000, 100_000_000), 0, 2_400_000, true), Ok((PaidBy::Credit, 2_400_000)));
931 // Holds already cover the included usage: on demand.
932 assert_eq!(place(&paid(10_000_000, 100_000_000), 10_000_000, 2_400_000, true), Ok((PaidBy::OnDemand, 2_400_000)));
933 // A free workspace on its trial.
934 let trial = Room { trial: 5_000_000, on_demand: Some(0), ..Room::default() };
935 assert_eq!(place(&trial, 0, 2_400_000, false), Ok((PaidBy::Trial, 2_400_000)));
936 // A public repository's checks, from the pool.
937 let pool = Room { oss: 2_000_000, on_demand: Some(0), ..Room::default() };
938 assert_eq!(place(&pool, 0, 600_000, false), Ok((PaidBy::Oss, 600_000)));
939 }
940
941 #[test]
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas942 fn a_paid_workspace_is_stopped_only_by_its_limit_never_by_a_count() {
943 // The included $10 is gone and the workspace has already built,
944 // served and stored far past what used to be quotas: the next start
945 // still goes on demand, as long as its spend limit has room.
946 let room = paid(0, 250_000_000);
947 let held = 0;
948 for start in 0..1_000 {
949 let placed = place(&room, held + start * 100_000, 100_000, true);
950 assert_eq!(placed, Ok((PaidBy::OnDemand, 100_000)));
951 }
952 // Only at its limit does it stop, with the limit's refusal.
953 assert_eq!(place(&room, 250_000_000, 100_000, true), Err(Short::Empty));
954 // A free workspace has no on-demand room at all: with no trial or
955 // pool left, nothing starts (`short` says NotPaid or TrialUsed).
956 let free = Room { on_demand: Some(0), ..Room::default() };
957 assert_eq!(place(&free, 0, 100_000, false), Err(Short::Empty));
958 // g1t's own workspaces: no limit.
959 let internal = Room { on_demand: None, ..Room::default() };
960 assert_eq!(place(&internal, i64::MAX / 2, 100_000, true), Ok((PaidBy::OnDemand, 100_000)));
961 }
962
963 #[test]
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look964 fn concurrent_starts_cannot_overshoot_the_ceiling() {
965 // $5 of room in all, and each start may cost up to $2.40.
966 let room = paid(0, 5_000_000);
967 let mut held = 0;
968 let mut started = 0;
969 for _ in 0..5 {
970 match place(&room, held, 2_400_000, true) {
971 Ok((_, hold)) => {
972 held += hold;
973 started += 1;
974 }
975 Err(short) => assert_eq!(short, Short::TooSmall),
976 }
977 }
978 assert_eq!(started, 2);
979 assert!(held <= 5_000_000);
980 // Once the first settles, a third fits.
981 assert!(place(&room, held - 2_400_000, 2_400_000, true).is_ok());
982 // Nothing left at all.
983 assert_eq!(place(&room, 5_000_000, 1, true), Err(Short::Empty));
984 }
985
986 #[test]
987 fn a_free_workspace_may_use_its_last_bit_of_trial() {
988 let room = Room { trial: 300_000, on_demand: Some(0), ..Room::default() };
989 // The whole estimate does not fit, but what is left is held.
990 assert_eq!(place(&room, 0, 2_400_000, false), Ok((PaidBy::Trial, 300_000)));
991 // Once it is held, nothing more starts.
992 assert_eq!(place(&room, 300_000, 2_400_000, false), Err(Short::Empty));
993 // Nothing at all: no plan, no trial, no pool.
994 assert_eq!(place(&Room { on_demand: Some(0), ..Room::default() }, 0, 1, false), Err(Short::Empty));
995 }
996
997 #[test]
998 fn g1ts_own_workspaces_are_never_short() {
999 let room = Room { credit: 10_000_000, on_demand: None, ..Room::default() };
1000 assert_eq!(place(&room, 50_000_000_000, 2_400_000, true), Ok((PaidBy::OnDemand, 2_400_000)));
1001 assert_eq!(place(&room, 0, 2_400_000, true), Ok((PaidBy::Credit, 2_400_000)));
1002 }
1003
1004 #[test]
1005 fn a_spike_is_five_times_the_usual_hour_and_at_least_five_dollars() {
1006 let (factor, floor) = (5, 5_000_000);
1007 // A new workspace with no history: $5 in an hour is a spike, $4 is not.
1008 assert!(is_spike(5_000_000, 0, factor, floor));
1009 assert!(!is_spike(4_000_000, 0, factor, floor));
1010 // Usually $2 an hour: $10 is not above five times, $10.01 is.
1011 assert!(!is_spike(10_000_000, 2_000_000, factor, floor));
1012 assert!(is_spike(10_010_000, 2_000_000, factor, floor));
1013 // A busy workspace at its usual pace is never a spike.
1014 assert!(!is_spike(40_000_000, 30_000_000, factor, floor));
1015 }
1016
1017 #[test]
1018 fn keep_going_lasts_a_day_or_until_spend_doubles() {
1019 let until = "2026-10-06T12:00:00Z";
1020 assert!(still_continued(Some(until), "2026-10-06T11:00:00Z", 6_000_000, 8_000_000));
1021 // Doubled again: paused again.
1022 assert!(!still_continued(Some(until), "2026-10-06T11:00:00Z", 6_000_000, 12_000_000));
1023 // A day later: watched afresh.
1024 assert!(!still_continued(Some(until), "2026-10-06T12:00:01Z", 6_000_000, 1_000_000));
1025 assert!(!still_continued(None, "2026-10-06T11:00:00Z", 6_000_000, 1));
1026 }
1027
1028 #[test]
1029 fn owners_caps_stay_in_bounds() {
1030 assert!(cap_bounds(None, None).is_ok());
1031 assert!(cap_bounds(Some(5_000_000), Some(50_000_000)).is_ok());
1032 assert!(cap_bounds(Some(50_000), None).is_err());
1033 assert!(cap_bounds(Some(101_000_000), None).is_err());
1034 assert!(cap_bounds(None, Some(500_000)).is_err());
1035 assert!(cap_bounds(None, Some(2_000_000_000)).is_err());
1036 }
1037
1038 #[test]
1039 fn caps_are_tight_in_the_first_month_and_on_the_trial() {
1040 assert_eq!(caps(PlanKind::Paid, true, false, None), (2, 60));
1041 assert_eq!(caps(PlanKind::Free, false, true, None), (2, 60));
1042 assert_eq!(caps(PlanKind::Paid, false, false, None), (10, g1t_contracts::guardrails::MAX_MINUTES));
1043 assert_eq!(caps(PlanKind::Internal, false, false, None).0, 10);
1044 // Staff can set agents at once.
1045 assert_eq!(caps(PlanKind::Paid, true, false, Some(6)).0, 6);
1046 }
1047
1048 #[test]
1049 fn every_refusal_says_what_to_do_and_where() {
1050 for code in [FailureCode::NotPaid, FailureCode::TrialUsed, FailureCode::OssPoolEmpty, FailureCode::Limit, FailureCode::Paused] {
1051 let Outcome::Fail(failure) = refusal(code, "acme", ComputeKind::Check, "Detail.") else { panic!() };
1052 assert_eq!(failure.code, code);
1053 assert!(failure.message.contains("/acme/-/billing"), "{}", failure.message);
1054 }
1055 let Outcome::Fail(failure) = refusal(FailureCode::NotPaid, "acme", ComputeKind::Agent, "") else { panic!() };
1056 assert!(failure.message.contains("$5 trial") && failure.message.contains("never charged"));
1057 }
1058}

This file's history is long; its oldest lines are credited to the oldest commit read.