Sign in

flagon-io/g1t

public

g1t/services/billing/src/compute.rs

1,049 lines48,609 bytesCodeBlame

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1//! Whether a workspace may start compute, and holding what it may cost.
2//!
3//! Every service that starts something that costs g1t real money asks
4//! here first (see `g1t_contracts::billing::ReserveArgs`):
5//!
6//! - **`entitlements`**: the workspace's plan, whether it may start compute
7//! at all, its caps (agents at once, a run's time and spend, an issue's
8//! spend), its ceiling and exposure, and whether compute is paused.
9//! - **`reserve`**: holds the work's estimated cost against what may pay
10//! for it (the plan's included usage, the trial, the open-source pool,
11//! then on-demand room under the ceiling and the spend limit), so starts
12//! at the same moment cannot overshoot together. Answers who pays first,
13//! or refuses with a stable code and a message for the owner.
14//! - **`settle`**: releases the hold. The charge itself goes on the ledger
15//! the usual way; a hold never settled lapses after three hours.
16//!
17//! **No card, no compute.** A free workspace's forge is free, but compute
18//! needs the plan, or a card check: it unlocks the one-time trial and g1t's
19//! open-source pool (checks, workflows and the merge queue on public
20//! repositories). The card check is what keeps g1t's free compute from
21//! being mined: one trial per card, and a real person behind each.
22//!
23//! **Spikes.** An hour's spend above `SPIKE_FACTOR` (5) times the
24//! workspace's usual hour over the last week, and at least
25//! `SPIKE_FLOOR_MICROS` ($5), pauses new compute until an owner answers:
26//! keep going (for 24 hours, or until the hour's spend doubles again) or
27//! stop. Runs already under way finish. g1t's own workspaces are watched
28//! but never paused.
29
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index30use futures_util::future::{try_join, try_join4, try_join5};
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look31use g1t_contracts::billing::{
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index32 BillingAccount, ComputeKind, ConfirmSpikeArgs, SetCapsArgs, Entitlements, EntitlementsArgs, LimitState, PaidBy, PlanKind, Reservation,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look33 ReserveArgs, SettleArgs, Spike, UNLIMITED_MICROS, UsageAlert, RESERVATION_HOURS,
34};
35use g1t_contracts::time::rfc3339;
36use g1t_contracts::{FailureCode, Outcome, Role, new_id};
37use g1t_kit::now_ms;
38use serde::Deserialize;
39use worker::Result;
40use worker::wasm_bindgen::JsValue;
41
42use crate::Billing;
43use crate::credits::{self, left};
44use crate::features::dollars;
45use crate::limits::alert_level;
46
47/// Agents at once in the first month or on the trial, and after.
48pub(crate) const FIRST_MONTH_AGENTS: u32 = 2;
49pub(crate) const AGENTS: u32 = 10;
50/// The longest run in the first month or on the trial, in minutes.
51pub(crate) const FIRST_MONTH_MINUTES: u32 = 60;
52/// How long "keep going" lifts a spike's pause.
53const KEEP_GOING_MS: u64 = 24 * 60 * 60 * 1000;
54/// The week a usual hour is measured over.
55const WEEK_HOURS: i64 = 7 * 24;
56
57/// What may pay for reserved work, at price, in the order it pays.
58#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
59pub(crate) struct Room {
60 pub credit: i64,
61 pub trial: i64,
62 pub oss: i64,
63 /// Under the ceiling and the spend limit; None: no bound (g1t's own).
64 pub on_demand: Option<i64>,
65}
66
67/// Why `place` could not hold an estimate.
68#[derive(Clone, Copy, Debug, PartialEq, Eq)]
69pub(crate) enum Short {
70 /// Nothing left that pays for it.
71 Empty,
72 /// Some room, but less than a paid workspace's whole estimate.
73 TooSmall,
74}
75
76/// Where a new hold of `estimate` goes, given what open holds take
77/// (`held`): the source that pays first, and what to hold. Holds fill the
78/// sources in order, so the first source with room after them pays first.
79/// A paid workspace's whole estimate must fit, so the ceiling cannot be
80/// overshot; a free workspace may use its last bit of trial, and what the
81/// run costs past it is g1t's.
82pub(crate) fn place(room: &Room, held: i64, estimate: i64, whole: bool) -> std::result::Result<(PaidBy, i64), Short> {
83 let sources = [
84 (PaidBy::Credit, room.credit.max(0)),
85 (PaidBy::Trial, room.trial.max(0)),
86 (PaidBy::Oss, room.oss.max(0)),
87 ];
88 let pools: i64 = sources.iter().map(|(_, room)| room).sum();
89 let remaining = match room.on_demand {
90 None => i64::MAX,
91 Some(on_demand) => pools + on_demand.max(0) - held.max(0),
92 };
93 if remaining <= 0 {
94 return Err(Short::Empty);
95 }
96 let estimate = estimate.max(0);
97 if whole && estimate > remaining {
98 return Err(Short::TooSmall);
99 }
100 let hold = estimate.min(remaining);
101 let mut end = 0;
102 for (source, size) in sources {
103 end += size;
104 if held.max(0) < end {
105 return Ok((source, hold));
106 }
107 }
108 Ok((PaidBy::OnDemand, hold))
109}
110
111/// Whether the last hour is a spike: above `factor` times the usual hour,
112/// and at least `floor`.
113pub(crate) fn is_spike(last_hour: i64, usual_hour: i64, factor: i64, floor: i64) -> bool {
114 last_hour >= floor.max(1) && last_hour > usual_hour.max(0) * factor
115}
116
117/// Whether a spike an owner said to keep going on still lets work start:
118/// within its 24 hours, and the hour's spend not doubled again.
119pub(crate) fn still_continued(until: Option<&str>, now: &str, hour_at_spike: i64, last_hour: i64) -> bool {
120 until.is_some_and(|until| now < until) && last_hour < hour_at_spike.max(1) * 2
121}
122
123/// A workspace's caps, from its plan.
124pub(crate) fn caps(plan: PlanKind, first_month: bool, on_trial: bool, agents: Option<u32>) -> (u32, u32) {
125 let tight = first_month || (plan == PlanKind::Free && on_trial) || plan == PlanKind::Free;
126 let default_agents = if tight { FIRST_MONTH_AGENTS } else { AGENTS };
127 let minutes = if tight { FIRST_MONTH_MINUTES } else { g1t_contracts::guardrails::MAX_MINUTES };
128 (agents.unwrap_or(default_agents), minutes)
129}
130
131/// The refusal for a start that cannot be held, with what to do.
132pub(crate) fn refusal(code: FailureCode, workspace: &str, kind: ComputeKind, detail: &str) -> Outcome<Reservation> {
133 let link = format!("/{workspace}/-/billing");
134 let what = match kind {
135 ComputeKind::Agent => "Agents",
136 ComputeKind::Check => "Checks",
137 ComputeKind::Workflow => "Workflows",
138 ComputeKind::Queue => "The merge queue",
139 ComputeKind::Deploy => "Deployments",
140 ComputeKind::Embedding => "Semantic search",
141 };
142 let message = match code {
143 FailureCode::NotPaid if kind.open_source_pool() => format!(
144 "{what} run in g1t's sandboxes, which cost real money, so they need the g1t plan ($20 a month) or a card check. A card check gives public repositories g1t's open-source pool and starts the $5 trial; it is never charged. Both are at {link}."
145 ),
146 FailureCode::NotPaid => format!(
147 "{what} cost real money to run, so they need the g1t plan ($20 a month, with $10 of usage included) or the one-time $5 trial, which starts with a card check that is never charged. Both are at {link}."
148 ),
149 FailureCode::TrialUsed => format!(
150 "This workspace has used its $5 trial. Start the g1t plan ($20 a month, with $10 of usage included) to keep going: {link}."
151 ),
152 FailureCode::OssPoolEmpty => format!(
153 "g1t's open-source pool for this month is used up{detail}, so checks and workflows on public repositories wait until the 1st. The g1t plan runs them now: {link}."
154 ),
155 FailureCode::Limit => format!("{detail} An owner can raise the limit, prepay, or ask g1t for more at {link}."),
156 FailureCode::Paused => format!("New compute is paused: {detail} An owner can see why and answer at {link}."),
157 _ => detail.to_owned(),
158 };
159 Outcome::fail(code, message)
160}
161
162#[derive(Deserialize)]
163struct SpikeRow {
164 id: String,
165 status: String,
166 hour_micros: i64,
167 average_micros: i64,
168 detected_at: String,
169 decided_by: Option<String>,
170 decided_at: Option<String>,
171 until: Option<String>,
172}
173
174impl From<SpikeRow> for Spike {
175 fn from(row: SpikeRow) -> Self {
176 Spike {
177 id: row.id,
178 status: row.status,
179 hour_micros: row.hour_micros,
180 average_micros: row.average_micros,
181 detected_at: row.detected_at,
182 decided_by: row.decided_by,
183 decided_at: row.decided_at,
184 until: row.until,
185 }
186 }
187}
188
189/// A workspace's pace: the last hour, the usual hour over the last week,
190/// the last day, at price (what was charged plus what paid for it first).
191#[derive(Clone, Copy, Debug, Default)]
192pub(crate) struct Pace {
193 pub last_hour: i64,
194 pub usual_hour: i64,
195 pub last_day: i64,
196}
197
198impl Billing {
199 /// Spend at price over the last hour, day and week.
200 pub(crate) async fn pace(&self, workspace: &str) -> Result<Pace> {
201 #[derive(Deserialize)]
202 struct Row {
203 hour: Option<i64>,
204 day: Option<i64>,
205 week: Option<i64>,
206 }
207 let now = now_ms();
208 let hour_ago = rfc3339(now - 60 * 60 * 1000);
209 let day_ago = rfc3339(now - 24 * 60 * 60 * 1000);
210 let week_ago = rfc3339(now - 7 * 24 * 60 * 60 * 1000);
211 let gross = "(-amount_micros + credit_micros + trial_micros + oss_micros + given_micros)";
212 let row = self
213 .db
214 .prepare(format!(
215 "SELECT SUM(CASE WHEN created_at >= ?2 THEN {gross} END) AS hour,
216 SUM(CASE WHEN created_at >= ?3 THEN {gross} END) AS day,
217 SUM(CASE WHEN created_at < ?2 THEN {gross} END) AS week
218 FROM ledger WHERE workspace = ?1 AND kind = 'usage' AND created_at >= ?4"
219 ))
220 .bind(&[workspace.into(), hour_ago.into(), day_ago.into(), week_ago.into()])?
221 .first::<Row>(None)
222 .await?;
223 Ok(row.map_or_else(Pace::default, |r| Pace {
224 last_hour: r.hour.unwrap_or(0).max(0),
225 usual_hour: r.week.unwrap_or(0).max(0) / (WEEK_HOURS - 1),
226 last_day: r.day.unwrap_or(0).max(0),
227 }))
228 }
229
230 /// The workspace's latest spike, if any.
231 pub(crate) async fn latest_spike(&self, workspace: &str) -> Result<Option<Spike>> {
232 Ok(self
233 .db
234 .prepare(
235 "SELECT id, status, hour_micros, average_micros, detected_at, decided_by, decided_at, until
236 FROM spikes WHERE workspace = ? ORDER BY detected_at DESC LIMIT 1",
237 )
238 .bind(&[workspace.into()])?
239 .first::<SpikeRow>(None)
240 .await?
241 .map(Spike::from))
242 }
243
244 /// The spike pausing the workspace now, found or new. Never for g1t's
245 /// own workspaces, which are watched in sudo but never paused.
246 async fn spike_pause(&self, workspace: &str, plan: PlanKind) -> Result<Option<Spike>> {
247 let latest = self.latest_spike(workspace).await?;
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept248 if let Some(spike) = &latest
249 && (spike.status == "open" || spike.status == "stopped") {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look250 return Ok(latest);
251 }
252 if plan == PlanKind::Internal || self.stripe.is_none() {
253 return Ok(None);
254 }
255 let pace = self.pace(workspace).await?;
256 let now = rfc3339(now_ms());
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept257 if let Some(spike) = &latest
258 && spike.status == "continued" && still_continued(spike.until.as_deref(), &now, spike.hour_micros, pace.last_hour) {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look259 return Ok(None);
260 }
261 if !is_spike(pace.last_hour, pace.usual_hour, self.plans.spike_factor, self.plans.spike_floor_micros) {
262 return Ok(None);
263 }
264 let id = new_id("spk", now_ms());
265 self.db
266 .prepare(
267 "INSERT INTO spikes (id, workspace, status, hour_micros, average_micros, detected_at)
268 SELECT ?1, ?2, 'open', ?3, ?4, ?5
269 WHERE NOT EXISTS (SELECT 1 FROM spikes WHERE workspace = ?2 AND status = 'open')",
270 )
271 .bind(&[id.as_str().into(), workspace.into(), (pace.last_hour as f64).into(), (pace.usual_hour as f64).into(), now.as_str().into()])?
272 .run()
273 .await?;
274 self.latest_spike(workspace).await
275 }
276
277 /// The alerts a workspace has reached this month: its plan's included
278 /// usage, its spend limit and g1t's ceiling, from 50%.
279 pub(crate) async fn alerts_for(&self, workspace: &str) -> Result<Vec<UsageAlert>> {
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index280 let account = self.account_of(workspace).await?;
281 let plan = self.plan_kind_for(workspace, &account).await?;
282 let has_plan = plan != PlanKind::Free;
283 let month = credits::month_of(&rfc3339(now_ms()));
284 let (limit, used) = try_join(self.limit_with(workspace, &account, plan), async {
285 if has_plan { self.allowance_used("plan_credit", workspace, &month).await } else { Ok(0) }
286 })
287 .await?;
288 Ok(alerts_from(workspace, &limit, has_plan, used, self.plans.plan_included_micros))
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look289 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index290}
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look291
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index292/// The alerts reached, from a limit already worked out, whether the
293/// workspace has the plan, and what of its included usage it has used.
294fn alerts_from(
295 workspace: &str,
296 limit: &g1t_contracts::billing::Limit,
297 has_plan: bool,
298 used: i64,
299 included: i64,
300) -> Vec<UsageAlert> {
301 let mut alerts = vec![];
302 if has_plan && limit.trust != g1t_contracts::billing::Trust::Internal {
303 let level = alert_level(used, included);
304 if level > 0 {
305 alerts.push(UsageAlert {
306 meter: "included".into(),
307 level,
308 used_micros: used,
309 limit_micros: included,
310 message: if level >= 100 {
311 format!("{workspace} has used all {} of this month's included usage. Usage from here is charged at cost plus 20%, up to your spend limit.", dollars(included))
312 } else {
313 format!("{workspace} has used {} of this month's {} included usage ({level}%). Past it, usage is charged at cost plus 20%, up to your spend limit.", dollars(used), dollars(included))
314 },
315 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look316 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index317 }
318 if let Some(spend_limit) = limit.spend_limit_micros {
319 let level = alert_level(limit.spent_micros, spend_limit);
320 if level > 0 {
321 alerts.push(UsageAlert {
322 meter: "spend_limit".into(),
323 level,
324 used_micros: limit.spent_micros,
325 limit_micros: spend_limit,
326 message: format!(
327 "{workspace} has spent {} of its {} monthly spend limit ({level}%). At the limit, new sandboxes, builds and agents stop until the month turns or an owner raises it.",
328 dollars(limit.spent_micros),
329 dollars(spend_limit)
330 ),
331 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look332 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index333 }
334 if let Some(ceiling) = limit.ceiling_micros.filter(|_| limit.trust != g1t_contracts::billing::Trust::New) {
335 let level = alert_level(limit.exposure_micros, ceiling);
336 if level > 0 {
337 alerts.push(UsageAlert {
338 meter: "ceiling".into(),
339 level,
340 used_micros: limit.exposure_micros,
341 limit_micros: ceiling,
342 message: format!(
343 "{workspace} has {} of usage not yet paid for, of the {} g1t allows ({level}%). With a card on file g1t charges it as the limit nears; prepaying raises it at once.",
344 dollars(limit.exposure_micros),
345 dollars(ceiling)
346 ),
347 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look348 }
349 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index350 alerts
351}
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look352
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index353impl Billing {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look354 /// Whether a card check was done for the workspace.
355 pub(crate) async fn card_checked(&self, workspace: &str) -> Result<bool> {
356 Ok(self
357 .db
358 .prepare("SELECT workspace FROM card_checks WHERE workspace = ?")
359 .bind(&[workspace.into()])?
360 .first::<serde_json::Value>(None)
361 .await?
362 .is_some())
363 }
364
365 /// What open reservations hold across `members`, at price.
366 async fn held(&self, members: &[String]) -> Result<i64> {
367 #[derive(Deserialize)]
368 struct Row {
369 held: Option<i64>,
370 }
371 let marks = vec!["?"; members.len().max(1)].join(", ");
372 let mut values: Vec<JsValue> = members.iter().map(|m| JsValue::from(m.as_str())).collect();
373 if values.is_empty() {
374 values.push("".into());
375 }
376 values.push(rfc3339(now_ms()).into());
377 Ok(self
378 .db
379 .prepare(format!(
380 "SELECT SUM(hold_micros) AS held FROM reservations
381 WHERE workspace IN ({marks}) AND settled_at IS NULL AND expires_at > ?"
382 ))
383 .bind(&values)?
384 .first::<Row>(None)
385 .await?
386 .and_then(|r| r.held)
387 .unwrap_or(0))
388 }
389
390 /// Why new compute is paused, if it is: a staff hold, a spike waiting
391 /// for an owner (or stopped by one), or the limit reached.
392 async fn pause_reason(
393 &self,
394 workspace: &str,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index395 account: &BillingAccount,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look396 plan: PlanKind,
397 limit: Option<&g1t_contracts::billing::Limit>,
398 ) -> Result<(Option<String>, Option<Spike>, Option<FailureCode>)> {
399 if let Some(hold) = account.allowances.hold.as_deref().filter(|h| !h.trim().is_empty()) {
400 return Ok((Some(format!("g1t staff put a hold on new compute ({}).", hold.trim())), None, Some(FailureCode::Paused)));
401 }
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays402 // A comped account past its monthly budget (`budget`).
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index403 if let Some(why) = self.comped_stop(account).await? {
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays404 return Ok((Some(why), None, Some(FailureCode::Paused)));
405 }
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look406 let spike = self.spike_pause(workspace, plan).await?;
407 if let Some(spike) = &spike {
408 let why = if spike.status == "stopped" {
409 format!(
410 "an owner stopped new compute after a spend spike ({} in an hour). An owner can choose Keep going.",
411 dollars(spike.hour_micros)
412 )
413 } else {
414 format!(
415 "{} was spent in an hour, more than {} times the usual {} an hour, so new compute waits for an owner to confirm.",
416 dollars(spike.hour_micros),
417 self.plans.spike_factor,
418 dollars(spike.average_micros)
419 )
420 };
421 return Ok((Some(why), Some(spike.clone()), Some(FailureCode::Paused)));
422 }
423 let latest = self.latest_spike(workspace).await?;
424 if plan != PlanKind::Internal && self.stripe.is_some() {
425 let worked_out;
426 let limit = match limit {
427 Some(limit) => limit,
428 None => {
429 worked_out = self.limit_of(workspace).await?;
430 &worked_out
431 }
432 };
433 if limit.state == LimitState::Stopped {
434 return Ok((limit.message.clone(), latest, Some(FailureCode::Limit)));
435 }
436 }
437 Ok((None, latest, None))
438 }
439
440 /// `entitlements`: what the workspace may do now.
441 pub(crate) async fn entitlements(&self, a: EntitlementsArgs) -> Result<Entitlements> {
442 let workspace = a.workspace.to_lowercase();
443 let account = self.account_of(&workspace).await?;
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index444 let plan = self.plan_kind_for(&workspace, &account).await?;
445 let has_plan = plan != PlanKind::Free;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look446 let now = rfc3339(now_ms());
447 let month = credits::month_of(&now);
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index448 // Every signed-in page asks for this, so what does not need another
449 // answer is read at once: the limit (and the pause, from it), the
450 // trial, and the month's counts.
451 let standing = async {
452 let limit = self.limit_with(&workspace, &account, plan).await?;
453 let pause = self.pause_reason(&workspace, &account, plan, Some(&limit)).await?;
454 Ok::<_, worker::Error>((limit, pause))
455 };
456 let trial = async {
457 let (checked, grant) = try_join(
458 async {
459 if matches!(plan, PlanKind::Internal | PlanKind::Enterprise) { Ok(true) } else { self.card_checked(&workspace).await }
460 },
461 self.grant_of(&workspace),
462 )
463 .await?;
464 // A card checked while the month's pool was empty: granted once
465 // it has room.
466 let grant = match grant {
467 Some(grant) => Some(grant),
468 None if checked && plan == PlanKind::Free && self.trial_allowed(&workspace).await? => self.ensure_grant(&workspace).await?,
469 None => None,
470 };
471 Ok::<_, worker::Error>((checked, grant))
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look472 };
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index473 let counts = try_join5(
474 self.owner_caps(&workspace),
475 self.private_storage(&workspace),
476 self.oss_paid(&workspace, &month),
477 self.held(&account.workspaces),
478 async { if has_plan { self.allowance_used("plan_credit", &workspace, &month).await } else { Ok(0) } },
479 );
480 let more = try_join(self.allowance_used("build_seconds", &workspace, &month), self.git_operations_this_month(&workspace));
481 let ((limit, (paused, spike, _)), (verified, grant), (owners, stored, oss, held, included_used), (build_seconds, git_operations)) =
482 try_join4(standing, trial, counts, more).await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look483 let trial_left = grant.as_ref().map_or(0, |g| left(g.granted_micros, g.used_micros));
484 let first_month = limit.first_month;
485 let (max_agents, max_minutes) = caps(plan, first_month, trial_left > 0, account.allowances.max_concurrent_agents);
486 let ceiling = match plan {
487 PlanKind::Free => 0,
488 PlanKind::Internal => UNLIMITED_MICROS,
489 _ => limit.ceiling_micros.unwrap_or(UNLIMITED_MICROS),
490 };
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index491 let alerts = alerts_from(&workspace, &limit, has_plan, included_used, self.plans.plan_included_micros);
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look492 Ok(Entitlements {
493 plan,
494 compute: has_plan || trial_left > 0,
495 trial_micros_left: trial_left,
496 trial_verified: verified,
497 first_month,
498 max_concurrent_agents: max_agents,
499 max_run_minutes: max_minutes,
500 run_cap_micros: account.allowances.run_cap_micros.or(owners.0).unwrap_or(self.plans.run_cap_micros),
501 issue_cap_micros: account.allowances.issue_cap_micros.or(owners.1).unwrap_or(self.plans.issue_cap_micros),
502 ceiling_micros: ceiling,
503 exposure_micros: limit.exposure_micros,
504 paused,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index505 held_micros: held,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look506 prepaid_micros: limit.prepaid_micros,
507 included_micros: if has_plan { self.plans.plan_included_micros } else { 0 },
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index508 included_used_micros: included_used,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look509 audit_retention_days: self.plans.audit_days,
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas510 free_private_storage_bytes: self.plans.free_storage_bytes,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look511 private_storage_bytes: stored,
512 oss_paid_micros: oss,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index513 build_seconds_used: build_seconds.max(0) as u32,
514 git_operations,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look515 git_operations_included: self.plans.git_included,
516 min_charge_micros: self.plans.min_charge_micros,
517 spike,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index518 alerts,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look519 workspace,
520 })
521 }
522
523 /// `reserve`: holds a start's estimated cost, or says why not.
524 pub(crate) async fn reserve(&self, a: ReserveArgs) -> Result<Outcome<Reservation>> {
525 let workspace = a.workspace.to_lowercase();
526 let now = now_ms();
527 let expires_at = rfc3339(now + RESERVATION_HOURS * 60 * 60 * 1000);
528 let repo = format!("{}/{}", a.repo.namespace, a.repo.name).to_lowercase();
529 // A g1t that does not charge holds nothing.
530 if self.stripe.is_none() {
531 return Ok(Outcome::Ok(Reservation { id: new_id("rsv", now), paid_by: PaidBy::OnDemand, held_micros: 0, expires_at }));
532 }
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays533 let account = self.account_of(&workspace).await?;
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index534 let plan = self.plan_kind_for(&workspace, &account).await?;
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays535 // g1t's own caps (`budget`), in their own words: a comped account's
536 // monthly budget, and the daily breaker.
537 if let Some(why) = self.comped_stop(&account).await? {
538 return Ok(Outcome::fail(FailureCode::Paused, why));
539 }
540 if let Some(why) = self.breaker_refuses(plan, &account, a.kind, a.hosted_model).await? {
541 return Ok(Outcome::fail(FailureCode::Paused, why));
542 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index543 let limit = if plan == PlanKind::Internal { None } else { Some(self.limit_with(&workspace, &account, plan).await?) };
544 let (paused, _, code) = self.pause_reason(&workspace, &account, plan, limit.as_ref()).await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look545 if let (Some(why), Some(code)) = (paused, code) {
546 return Ok(refusal(code, &workspace, a.kind, &why));
547 }
548 let month = credits::month_of(&rfc3339(now));
549 let estimate = credits::with_margin(a.estimate_micros, self.margin_percent);
550 let verified = matches!(plan, PlanKind::Internal | PlanKind::Enterprise | PlanKind::Paid) || self.card_checked(&workspace).await?;
551 let has_plan = plan != PlanKind::Free;
552 let credit = if has_plan {
553 left(self.plans.plan_included_micros, self.allowance_used("plan_credit", &workspace, &month).await?)
554 } else {
555 0
556 };
557 let trial = if a.kind == ComputeKind::Deploy || !verified {
558 0
559 } else {
560 self.grant_of(&workspace).await?.map_or(0, |g| left(g.granted_micros, g.used_micros))
561 };
562 let oss_eligible = a.public && a.kind.open_source_pool() && verified;
563 let oss = if oss_eligible { self.oss_left(&workspace, &repo, &month).await? } else { 0 };
564 let on_demand = match plan {
565 PlanKind::Free => Some(0),
566 PlanKind::Internal => None,
567 _ => {
568 let Some(limit) = &limit else { unreachable!("only g1t's own workspaces skip the limit") };
569 let under_ceiling = limit.ceiling_micros.map(|c| (c - limit.exposure_micros).max(0));
570 let under_spend = limit.spend_limit_micros.map(|s| (s - limit.spent_micros).max(0));
571 match (under_ceiling, under_spend) {
572 (Some(c), Some(s)) => Some(c.min(s)),
573 (c, s) => c.or(s),
574 }
575 }
576 };
577 let room = Room { credit, trial, oss, on_demand };
578 // Optimistic: what was held is read, and the hold is written only if
579 // nothing was held meanwhile; otherwise read again.
580 for _ in 0..4 {
581 let held = self.held(&account.workspaces).await?;
582 let (paid_by, hold) = match place(&room, held, estimate, has_plan) {
583 Ok(placed) => placed,
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept584 Err(short) => return self.short(&workspace, plan, &a, verified, &room, short).await,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look585 };
586 let id = new_id("rsv", now);
587 let mut values: Vec<JsValue> = vec![
588 id.as_str().into(),
589 workspace.as_str().into(),
590 repo.as_str().into(),
591 a.kind.as_str().into(),
592 u8::from(a.public).into(),
593 (a.estimate_micros.max(0) as f64).into(),
594 (hold as f64).into(),
595 paid_by_text(paid_by).into(),
596 rfc3339(now).into(),
597 expires_at.as_str().into(),
598 (held as f64).into(),
599 ];
600 values.extend(account.workspaces.iter().map(|w| JsValue::from(w.as_str())));
601 if account.workspaces.is_empty() {
602 values.push("".into());
603 }
604 let placed = self
605 .db
606 .prepare(format!(
607 "INSERT INTO reservations (id, workspace, repo, kind, public, estimate_micros, hold_micros, paid_by, created_at, expires_at)
608 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10
609 WHERE (SELECT COALESCE(SUM(hold_micros), 0) FROM reservations
610 WHERE workspace IN ({marks}) AND settled_at IS NULL AND expires_at > ?9) = ?11
611 RETURNING id",
612 marks = (12..12 + account.workspaces.len().max(1)).map(|i| format!("?{i}")).collect::<Vec<_>>().join(", ")
613 ))
614 .bind(&values)?
615 .first::<serde_json::Value>(None)
616 .await?;
617 if placed.is_some() {
618 // What is held, at cost, as it was asked.
619 let held_cost = if hold >= estimate { a.estimate_micros.max(0) } else { hold * 100 / i64::from(100 + self.margin_percent) };
620 return Ok(Outcome::Ok(Reservation { id, paid_by, held_micros: held_cost, expires_at }));
621 }
622 }
623 Ok(refusal(FailureCode::Limit, &workspace, a.kind, "Too many starts at once to hold this one; try again in a moment."))
624 }
625
626 /// The refusal for a start nothing pays for.
627 async fn short(
628 &self,
629 workspace: &str,
630 plan: PlanKind,
631 a: &ReserveArgs,
632 verified: bool,
633 room: &Room,
634 short: Short,
635 ) -> Result<Outcome<Reservation>> {
636 if plan != PlanKind::Free {
637 let limit = self.limit_of(workspace).await?;
638 let detail = match short {
639 Short::TooSmall => format!(
640 "This would take the workspace past its limit: about {} more could start now ({} spent of a {} spend limit, {} not yet paid of the {} g1t allows).",
641 dollars(room.credit + room.trial + room.oss + room.on_demand.unwrap_or(0)),
642 dollars(limit.spent_micros),
643 dollars(limit.spend_limit_micros.unwrap_or_default()),
644 dollars(limit.exposure_micros),
645 dollars(limit.ceiling_micros.unwrap_or_default()),
646 ),
647 Short::Empty => limit.message.unwrap_or_else(|| "The workspace reached its limit for this month.".to_owned()),
648 };
649 return Ok(refusal(FailureCode::Limit, workspace, a.kind, &detail));
650 }
651 if !verified {
652 return Ok(refusal(FailureCode::NotPaid, workspace, a.kind, ""));
653 }
654 let oss_eligible = a.public && a.kind.open_source_pool();
655 let trial = self.grant_of(workspace).await?;
656 if oss_eligible && room.oss == 0 {
657 let month = credits::month_of(&rfc3339(now_ms()));
658 let repo = format!("{}/{}", a.repo.namespace, a.repo.name).to_lowercase();
659 let pool = left(self.plans.oss_pool_micros, self.allowance_used("oss_pool", "", &month).await?);
660 let detail = if pool > 0 { format!(" for {repo} (its share is {})", dollars(self.oss_repo_cap(workspace).await?)) } else { String::new() };
661 if trial.as_ref().is_none_or(|g| g.used_micros >= g.granted_micros) {
662 return Ok(refusal(FailureCode::OssPoolEmpty, workspace, a.kind, &detail));
663 }
664 }
665 match trial {
666 Some(grant) if grant.used_micros >= grant.granted_micros => Ok(refusal(FailureCode::TrialUsed, workspace, a.kind, "")),
667 _ => Ok(refusal(FailureCode::NotPaid, workspace, a.kind, "")),
668 }
669 }
670
671 /// `settle`: releases a hold.
672 pub(crate) async fn settle_reservation(&self, a: SettleArgs) -> Result<Outcome<bool>> {
673 let now = rfc3339(now_ms());
674 let settled = self
675 .db
676 .prepare(
677 "UPDATE reservations SET settled_at = ?1, actual_micros = ?2
678 WHERE id = ?3 AND settled_at IS NULL AND expires_at > ?1 RETURNING id",
679 )
680 .bind(&[now.as_str().into(), (a.actual_micros.max(0) as f64).into(), a.reservation_id.as_str().into()])?
681 .first::<serde_json::Value>(None)
682 .await?;
683 Ok(Outcome::Ok(settled.is_some()))
684 }
685
686 /// Clears reservations long settled or lapsed.
687 pub(crate) async fn sweep_reservations(&self) -> Result<()> {
688 let week_ago = rfc3339(now_ms() - 7 * 24 * 60 * 60 * 1000);
689 self.db
690 .prepare("DELETE FROM reservations WHERE expires_at < ?1")
691 .bind(&[week_ago.into()])?
692 .run()
693 .await?;
694 Ok(())
695 }
696
697 /// `confirm_spike`: an owner keeps going, or stops.
698 pub(crate) async fn confirm_spike(&self, a: ConfirmSpikeArgs) -> Result<Outcome<Entitlements>> {
699 let workspace = a.workspace.to_lowercase();
700 if a.actor.role_in(&workspace) != Some(Role::Owner) {
701 return Ok(Outcome::fail(FailureCode::Forbidden, "Only an owner can answer a spend spike."));
702 }
703 let Some(spike) = self.latest_spike(&workspace).await? else {
704 return Ok(Outcome::fail(FailureCode::NotFound, "There is no spend spike to answer."));
705 };
706 let now = now_ms();
707 let (status, until) = if a.keep_going { ("continued", Some(rfc3339(now + KEEP_GOING_MS))) } else { ("stopped", None) };
708 self.db
709 .prepare("UPDATE spikes SET status = ?1, decided_by = ?2, decided_at = ?3, until = ?4 WHERE id = ?5")
710 .bind(&[
711 status.into(),
712 a.actor.username.as_str().into(),
713 rfc3339(now).into(),
714 crate::optional(until.as_deref()),
715 spike.id.as_str().into(),
716 ])?
717 .run()
718 .await?;
719 let account = self.account_of(&workspace).await?;
720 self.audit(
721 &account.id,
722 "spike",
723 &format!("{workspace}: {} after {} in an hour", if a.keep_going { "kept going" } else { "stopped" }, dollars(spike.hour_micros)),
724 &a.actor.username,
725 )
726 .await?;
727 Ok(Outcome::Ok(self.entitlements(EntitlementsArgs { workspace }).await?))
728 }
729
730 /// The owners' own run and issue caps, if they set them.
731 async fn owner_caps(&self, workspace: &str) -> Result<(Option<i64>, Option<i64>)> {
732 #[derive(Deserialize)]
733 struct Row {
734 run_cap_micros: Option<i64>,
735 issue_cap_micros: Option<i64>,
736 }
737 Ok(self
738 .db
739 .prepare("SELECT run_cap_micros, issue_cap_micros FROM limits WHERE workspace = ?")
740 .bind(&[workspace.into()])?
741 .first::<Row>(None)
742 .await?
743 .map_or((None, None), |r| (r.run_cap_micros, r.issue_cap_micros)))
744 }
745
746 /// `set_caps`: the owners' own run and issue caps.
747 pub(crate) async fn set_caps(&self, a: SetCapsArgs) -> Result<Outcome<Entitlements>> {
748 let workspace = a.workspace.to_lowercase();
749 if a.actor.role_in(&workspace) != Some(Role::Owner) {
750 return Ok(Outcome::fail(FailureCode::Forbidden, "Only an owner can set the workspace's caps."));
751 }
752 if let Err(why) = cap_bounds(a.run_cap_micros, a.issue_cap_micros) {
753 return Ok(Outcome::fail(FailureCode::Invalid, why));
754 }
755 let opt = |m: Option<i64>| m.map_or(JsValue::NULL, |m| (m as f64).into());
756 let now = rfc3339(now_ms());
757 self.db
758 .prepare(
759 "INSERT INTO limits (workspace, run_cap_micros, issue_cap_micros, updated_at) VALUES (?1, ?2, ?3, ?4)
760 ON CONFLICT (workspace) DO UPDATE SET run_cap_micros = ?2, issue_cap_micros = ?3, updated_at = ?4",
761 )
762 .bind(&[workspace.as_str().into(), opt(a.run_cap_micros), opt(a.issue_cap_micros), now.into()])?
763 .run()
764 .await?;
765 let account = self.account_of(&workspace).await?;
766 let shown = |m: Option<i64>| m.map_or_else(|| "the default".to_owned(), dollars);
767 self.audit(
768 &account.id,
769 "caps",
770 &format!("{workspace}: run cap {}, issue cap {}", shown(a.run_cap_micros), shown(a.issue_cap_micros)),
771 &a.actor.username,
772 )
773 .await?;
774 Ok(Outcome::Ok(self.entitlements(EntitlementsArgs { workspace }).await?))
775 }
776
777 /// Emails owners about spikes that paused their workspace, once each.
778 pub(crate) async fn tell_spikes(&self, identity: &worker::Fetcher) -> Result<()> {
779 #[derive(Deserialize)]
780 struct Open {
781 id: String,
782 workspace: String,
783 hour_micros: i64,
784 average_micros: i64,
785 }
786 let open = self
787 .db
788 .prepare("SELECT id, workspace, hour_micros, average_micros FROM spikes WHERE status = 'open' AND told_at IS NULL LIMIT 20")
789 .all()
790 .await?
791 .results::<Open>()?;
792 for spike in open {
793 let workspace = &spike.workspace;
794 let intro = format!(
795 "{workspace} spent {} in the last hour, more than {} times its usual {} an hour, so g1t paused new sandboxes, agents and builds until an owner confirms. Runs already going finish. If this was meant, choose Keep going and nothing pauses for 24 hours unless the hour's spend doubles again. If not, choose Stop; and if it was a mistake, tell g1t from the billing page.",
796 dollars(spike.hour_micros),
797 self.plans.spike_factor,
798 dollars(spike.average_micros)
799 );
800 let link = format!("https://g1t.sh/{workspace}/-/billing");
801 if crate::limits::notify(identity, workspace, &format!("g1t: spending on {workspace} spiked, so new work is paused"), &intro, "Keep going or stop", &link).await {
802 self.db
803 .prepare("UPDATE spikes SET told_at = ? WHERE id = ?")
804 .bind(&[rfc3339(now_ms()).into(), spike.id.as_str().into()])?
805 .run()
806 .await?;
807 }
808 }
809 Ok(())
810 }
811
812 /// What the workspace's private repositories held at the last measure.
813 pub(crate) async fn private_storage(&self, workspace: &str) -> Result<i64> {
814 #[derive(Deserialize)]
815 struct Stored {
816 private_bytes: Option<i64>,
817 }
818 Ok(self
819 .db
820 .prepare("SELECT private_bytes FROM storage_days WHERE workspace = ? ORDER BY day DESC LIMIT 1")
821 .bind(&[workspace.into()])?
822 .first::<Stored>(None)
823 .await?
824 .and_then(|s| s.private_bytes)
825 .unwrap_or(0))
826 }
827
828 /// What g1t's open-source pool paid for the workspace in `month`.
829 async fn oss_paid(&self, workspace: &str, month: &str) -> Result<i64> {
830 #[derive(Deserialize)]
831 struct Sum {
832 micros: Option<i64>,
833 }
834 Ok(self
835 .db
836 .prepare("SELECT SUM(oss_micros) AS micros FROM ledger WHERE workspace = ? AND created_at >= ?")
837 .bind(&[workspace.into(), format!("{month}-01").into()])?
838 .first::<Sum>(None)
839 .await?
840 .and_then(|s| s.micros)
841 .unwrap_or(0))
842 }
843}
844
845/// Whether owners' caps are in bounds: a run $0.10 to $100 (the
846/// guardrails' most), an issue $1 to $1,000.
847pub(crate) fn cap_bounds(run: Option<i64>, issue: Option<i64>) -> std::result::Result<(), String> {
848 if run.is_some_and(|m| !(100_000..=100_000_000).contains(&m)) {
849 return Err("A run's cap is between $0.10 and $100.".to_owned());
850 }
851 if issue.is_some_and(|m| !(1_000_000..=1_000_000_000).contains(&m)) {
852 return Err("An issue's cap is between $1 and $1,000.".to_owned());
853 }
854 Ok(())
855}
856
857pub(crate) fn paid_by_text(paid_by: PaidBy) -> &'static str {
858 match paid_by {
859 PaidBy::Credit => "credit",
860 PaidBy::Trial => "trial",
861 PaidBy::Oss => "oss",
862 PaidBy::OnDemand => "on_demand",
863 }
864}
865
866#[cfg(test)]
867mod tests {
868 use super::*;
869
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index870 fn limit(trust: g1t_contracts::billing::Trust, spent: i64, spend_limit: Option<i64>, exposure: i64, ceiling: Option<i64>) -> g1t_contracts::billing::Limit {
871 g1t_contracts::billing::Limit {
872 workspace: "acme".into(),
873 account: "acc_acme".into(),
874 account_name: "acme".into(),
875 trust,
876 exposure_micros: exposure,
877 ceiling_micros: ceiling,
878 trust_ceiling_micros: ceiling,
879 spend_limit_micros: spend_limit,
880 state: LimitState::Ok,
881 message: None,
882 spent_micros: spent,
883 default_spend_limit: false,
884 available_micros: None,
885 growth: None,
886 prepaid_micros: 0,
887 max_ceiling_micros: None,
888 raise_once_micros: None,
889 raised_at: None,
890 first_month: false,
891 }
892 }
893
894 #[test]
895 fn alerts_come_from_the_answers_already_read() {
896 use g1t_contracts::billing::Trust;
897 let meters = |alerts: Vec<UsageAlert>| alerts.into_iter().map(|a| (a.meter, a.level)).collect::<Vec<_>>();
898 // On the plan: included usage at 90%, the spend limit at 50%, the ceiling at 75%.
899 let paid = limit(Trust::Paid, 100_000_000, Some(200_000_000), 75_000_000, Some(100_000_000));
900 assert_eq!(
901 meters(alerts_from("acme", &paid, true, 9_000_000, 10_000_000)),
902 vec![("included".to_owned(), 90), ("spend_limit".to_owned(), 50), ("ceiling".to_owned(), 75)]
903 );
904 // Without the plan, what was used of the included usage is not an alert.
905 assert_eq!(meters(alerts_from("acme", &paid, false, 9_000_000, 10_000_000)).len(), 2);
906 // g1t's own workspaces have no included usage to warn of, and a new
907 // workspace's ceiling is not one either.
908 let internal = limit(Trust::Internal, 0, None, 0, None);
909 assert!(alerts_from("acme", &internal, true, 10_000_000, 10_000_000).is_empty());
910 let new = limit(Trust::New, 0, None, 3_000_000, Some(3_000_000));
911 assert!(alerts_from("acme", &new, false, 0, 10_000_000).is_empty());
912 }
913
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look914 fn paid(credit: i64, on_demand: i64) -> Room {
915 Room { credit, trial: 0, oss: 0, on_demand: Some(on_demand) }
916 }
917
918 #[test]
919 fn included_usage_pays_first_then_on_demand() {
920 // $10 included, $100 under the ceiling, nothing held: included pays first.
921 assert_eq!(place(&paid(10_000_000, 100_000_000), 0, 2_400_000, true), Ok((PaidBy::Credit, 2_400_000)));
922 // Holds already cover the included usage: on demand.
923 assert_eq!(place(&paid(10_000_000, 100_000_000), 10_000_000, 2_400_000, true), Ok((PaidBy::OnDemand, 2_400_000)));
924 // A free workspace on its trial.
925 let trial = Room { trial: 5_000_000, on_demand: Some(0), ..Room::default() };
926 assert_eq!(place(&trial, 0, 2_400_000, false), Ok((PaidBy::Trial, 2_400_000)));
927 // A public repository's checks, from the pool.
928 let pool = Room { oss: 2_000_000, on_demand: Some(0), ..Room::default() };
929 assert_eq!(place(&pool, 0, 600_000, false), Ok((PaidBy::Oss, 600_000)));
930 }
931
932 #[test]
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas933 fn a_paid_workspace_is_stopped_only_by_its_limit_never_by_a_count() {
934 // The included $10 is gone and the workspace has already built,
935 // served and stored far past what used to be quotas: the next start
936 // still goes on demand, as long as its spend limit has room.
937 let room = paid(0, 250_000_000);
938 let held = 0;
939 for start in 0..1_000 {
940 let placed = place(&room, held + start * 100_000, 100_000, true);
941 assert_eq!(placed, Ok((PaidBy::OnDemand, 100_000)));
942 }
943 // Only at its limit does it stop, with the limit's refusal.
944 assert_eq!(place(&room, 250_000_000, 100_000, true), Err(Short::Empty));
945 // A free workspace has no on-demand room at all: with no trial or
946 // pool left, nothing starts (`short` says NotPaid or TrialUsed).
947 let free = Room { on_demand: Some(0), ..Room::default() };
948 assert_eq!(place(&free, 0, 100_000, false), Err(Short::Empty));
949 // g1t's own workspaces: no limit.
950 let internal = Room { on_demand: None, ..Room::default() };
951 assert_eq!(place(&internal, i64::MAX / 2, 100_000, true), Ok((PaidBy::OnDemand, 100_000)));
952 }
953
954 #[test]
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look955 fn concurrent_starts_cannot_overshoot_the_ceiling() {
956 // $5 of room in all, and each start may cost up to $2.40.
957 let room = paid(0, 5_000_000);
958 let mut held = 0;
959 let mut started = 0;
960 for _ in 0..5 {
961 match place(&room, held, 2_400_000, true) {
962 Ok((_, hold)) => {
963 held += hold;
964 started += 1;
965 }
966 Err(short) => assert_eq!(short, Short::TooSmall),
967 }
968 }
969 assert_eq!(started, 2);
970 assert!(held <= 5_000_000);
971 // Once the first settles, a third fits.
972 assert!(place(&room, held - 2_400_000, 2_400_000, true).is_ok());
973 // Nothing left at all.
974 assert_eq!(place(&room, 5_000_000, 1, true), Err(Short::Empty));
975 }
976
977 #[test]
978 fn a_free_workspace_may_use_its_last_bit_of_trial() {
979 let room = Room { trial: 300_000, on_demand: Some(0), ..Room::default() };
980 // The whole estimate does not fit, but what is left is held.
981 assert_eq!(place(&room, 0, 2_400_000, false), Ok((PaidBy::Trial, 300_000)));
982 // Once it is held, nothing more starts.
983 assert_eq!(place(&room, 300_000, 2_400_000, false), Err(Short::Empty));
984 // Nothing at all: no plan, no trial, no pool.
985 assert_eq!(place(&Room { on_demand: Some(0), ..Room::default() }, 0, 1, false), Err(Short::Empty));
986 }
987
988 #[test]
989 fn g1ts_own_workspaces_are_never_short() {
990 let room = Room { credit: 10_000_000, on_demand: None, ..Room::default() };
991 assert_eq!(place(&room, 50_000_000_000, 2_400_000, true), Ok((PaidBy::OnDemand, 2_400_000)));
992 assert_eq!(place(&room, 0, 2_400_000, true), Ok((PaidBy::Credit, 2_400_000)));
993 }
994
995 #[test]
996 fn a_spike_is_five_times_the_usual_hour_and_at_least_five_dollars() {
997 let (factor, floor) = (5, 5_000_000);
998 // A new workspace with no history: $5 in an hour is a spike, $4 is not.
999 assert!(is_spike(5_000_000, 0, factor, floor));
1000 assert!(!is_spike(4_000_000, 0, factor, floor));
1001 // Usually $2 an hour: $10 is not above five times, $10.01 is.
1002 assert!(!is_spike(10_000_000, 2_000_000, factor, floor));
1003 assert!(is_spike(10_010_000, 2_000_000, factor, floor));
1004 // A busy workspace at its usual pace is never a spike.
1005 assert!(!is_spike(40_000_000, 30_000_000, factor, floor));
1006 }
1007
1008 #[test]
1009 fn keep_going_lasts_a_day_or_until_spend_doubles() {
1010 let until = "2026-10-06T12:00:00Z";
1011 assert!(still_continued(Some(until), "2026-10-06T11:00:00Z", 6_000_000, 8_000_000));
1012 // Doubled again: paused again.
1013 assert!(!still_continued(Some(until), "2026-10-06T11:00:00Z", 6_000_000, 12_000_000));
1014 // A day later: watched afresh.
1015 assert!(!still_continued(Some(until), "2026-10-06T12:00:01Z", 6_000_000, 1_000_000));
1016 assert!(!still_continued(None, "2026-10-06T11:00:00Z", 6_000_000, 1));
1017 }
1018
1019 #[test]
1020 fn owners_caps_stay_in_bounds() {
1021 assert!(cap_bounds(None, None).is_ok());
1022 assert!(cap_bounds(Some(5_000_000), Some(50_000_000)).is_ok());
1023 assert!(cap_bounds(Some(50_000), None).is_err());
1024 assert!(cap_bounds(Some(101_000_000), None).is_err());
1025 assert!(cap_bounds(None, Some(500_000)).is_err());
1026 assert!(cap_bounds(None, Some(2_000_000_000)).is_err());
1027 }
1028
1029 #[test]
1030 fn caps_are_tight_in_the_first_month_and_on_the_trial() {
1031 assert_eq!(caps(PlanKind::Paid, true, false, None), (2, 60));
1032 assert_eq!(caps(PlanKind::Free, false, true, None), (2, 60));
1033 assert_eq!(caps(PlanKind::Paid, false, false, None), (10, g1t_contracts::guardrails::MAX_MINUTES));
1034 assert_eq!(caps(PlanKind::Internal, false, false, None).0, 10);
1035 // Staff can set agents at once.
1036 assert_eq!(caps(PlanKind::Paid, true, false, Some(6)).0, 6);
1037 }
1038
1039 #[test]
1040 fn every_refusal_says_what_to_do_and_where() {
1041 for code in [FailureCode::NotPaid, FailureCode::TrialUsed, FailureCode::OssPoolEmpty, FailureCode::Limit, FailureCode::Paused] {
1042 let Outcome::Fail(failure) = refusal(code, "acme", ComputeKind::Check, "Detail.") else { panic!() };
1043 assert_eq!(failure.code, code);
1044 assert!(failure.message.contains("/acme/-/billing"), "{}", failure.message);
1045 }
1046 let Outcome::Fail(failure) = refusal(FailureCode::NotPaid, "acme", ComputeKind::Agent, "") else { panic!() };
1047 assert!(failure.message.contains("$5 trial") && failure.message.contains("never charged"));
1048 }
1049}