Sign in

flagon-io/g1t

public

g1t/services/billing/src/compute.rs

1,050 lines48,767 bytesCodeBlame

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1//! Whether a workspace may start compute, and holding what it may cost.
2//!
3//! Every service that starts something that costs g1t real money asks
4//! here first (see `g1t_contracts::billing::ReserveArgs`):
5//!
6//! - **`entitlements`**: the workspace's plan, whether it may start compute
7//! at all, its caps (agents at once, a run's time and spend, an issue's
8//! spend), its ceiling and exposure, and whether compute is paused.
9//! - **`reserve`**: holds the work's estimated cost against what may pay
10//! for it (the plan's included usage, the trial, the open-source pool,
11//! then on-demand room under the ceiling and the spend limit), so starts
12//! at the same moment cannot overshoot together. Answers who pays first,
13//! or refuses with a stable code and a message for the owner.
14//! - **`settle`**: releases the hold. The charge itself goes on the ledger
15//! the usual way; a hold never settled lapses after three hours.
16//!
17//! **No card, no compute.** A free workspace's forge is free, but compute
18//! needs the plan, or a card check: it unlocks the one-time trial and g1t's
19//! open-source pool (checks, workflows and the merge queue on public
20//! repositories). The card check is what keeps g1t's free compute from
21//! being mined: one trial per card, and a real person behind each.
22//!
23//! **Spikes.** An hour's spend above `SPIKE_FACTOR` (5) times the
24//! workspace's usual hour over the last week, and at least
25//! `SPIKE_FLOOR_MICROS` ($5), pauses new compute until an owner answers:
26//! keep going (for 24 hours, or until the hour's spend doubles again) or
27//! stop. Runs already under way finish. g1t's own workspaces are watched
28//! but never paused.
29
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index30use futures_util::future::{try_join, try_join4, try_join5};
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look31use g1t_contracts::billing::{
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index32 BillingAccount, ComputeKind, ConfirmSpikeArgs, SetCapsArgs, Entitlements, EntitlementsArgs, LimitState, PaidBy, PlanKind, Reservation,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look33 ReserveArgs, SettleArgs, Spike, UNLIMITED_MICROS, UsageAlert, RESERVATION_HOURS,
34};
35use g1t_contracts::time::rfc3339;
36use g1t_contracts::{FailureCode, Outcome, Role, new_id};
37use g1t_kit::now_ms;
38use serde::Deserialize;
39use worker::Result;
40use worker::wasm_bindgen::JsValue;
41
42use crate::Billing;
43use crate::credits::{self, left};
44use crate::features::dollars;
45use crate::limits::alert_level;
46
47/// Agents at once in the first month or on the trial, and after.
48pub(crate) const FIRST_MONTH_AGENTS: u32 = 2;
49pub(crate) const AGENTS: u32 = 10;
50/// The longest run in the first month or on the trial, in minutes.
51pub(crate) const FIRST_MONTH_MINUTES: u32 = 60;
52/// How long "keep going" lifts a spike's pause.
53const KEEP_GOING_MS: u64 = 24 * 60 * 60 * 1000;
54/// The week a usual hour is measured over.
55const WEEK_HOURS: i64 = 7 * 24;
56
57/// What may pay for reserved work, at price, in the order it pays.
58#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
59pub(crate) struct Room {
60 pub credit: i64,
61 pub trial: i64,
62 pub oss: i64,
63 /// Under the ceiling and the spend limit; None: no bound (g1t's own).
64 pub on_demand: Option<i64>,
65}
66
67/// Why `place` could not hold an estimate.
68#[derive(Clone, Copy, Debug, PartialEq, Eq)]
69pub(crate) enum Short {
70 /// Nothing left that pays for it.
71 Empty,
72 /// Some room, but less than a paid workspace's whole estimate.
73 TooSmall,
74}
75
76/// Where a new hold of `estimate` goes, given what open holds take
77/// (`held`): the source that pays first, and what to hold. Holds fill the
78/// sources in order, so the first source with room after them pays first.
79/// A paid workspace's whole estimate must fit, so the ceiling cannot be
80/// overshot; a free workspace may use its last bit of trial, and what the
81/// run costs past it is g1t's.
82pub(crate) fn place(room: &Room, held: i64, estimate: i64, whole: bool) -> std::result::Result<(PaidBy, i64), Short> {
83 let sources = [
84 (PaidBy::Credit, room.credit.max(0)),
85 (PaidBy::Trial, room.trial.max(0)),
86 (PaidBy::Oss, room.oss.max(0)),
87 ];
88 let pools: i64 = sources.iter().map(|(_, room)| room).sum();
89 let remaining = match room.on_demand {
90 None => i64::MAX,
91 Some(on_demand) => pools + on_demand.max(0) - held.max(0),
92 };
93 if remaining <= 0 {
94 return Err(Short::Empty);
95 }
96 let estimate = estimate.max(0);
97 if whole && estimate > remaining {
98 return Err(Short::TooSmall);
99 }
100 let hold = estimate.min(remaining);
101 let mut end = 0;
102 for (source, size) in sources {
103 end += size;
104 if held.max(0) < end {
105 return Ok((source, hold));
106 }
107 }
108 Ok((PaidBy::OnDemand, hold))
109}
110
111/// Whether the last hour is a spike: above `factor` times the usual hour,
112/// and at least `floor`.
113pub(crate) fn is_spike(last_hour: i64, usual_hour: i64, factor: i64, floor: i64) -> bool {
114 last_hour >= floor.max(1) && last_hour > usual_hour.max(0) * factor
115}
116
117/// Whether a spike an owner said to keep going on still lets work start:
118/// within its 24 hours, and the hour's spend not doubled again.
119pub(crate) fn still_continued(until: Option<&str>, now: &str, hour_at_spike: i64, last_hour: i64) -> bool {
120 until.is_some_and(|until| now < until) && last_hour < hour_at_spike.max(1) * 2
121}
122
123/// A workspace's caps, from its plan.
124pub(crate) fn caps(plan: PlanKind, first_month: bool, on_trial: bool, agents: Option<u32>) -> (u32, u32) {
125 let tight = first_month || (plan == PlanKind::Free && on_trial) || plan == PlanKind::Free;
126 let default_agents = if tight { FIRST_MONTH_AGENTS } else { AGENTS };
127 let minutes = if tight { FIRST_MONTH_MINUTES } else { g1t_contracts::guardrails::MAX_MINUTES };
128 (agents.unwrap_or(default_agents), minutes)
129}
130
131/// The refusal for a start that cannot be held, with what to do.
132pub(crate) fn refusal(code: FailureCode, workspace: &str, kind: ComputeKind, detail: &str) -> Outcome<Reservation> {
133 let link = format!("/{workspace}/-/billing");
134 let what = match kind {
135 ComputeKind::Agent => "Agents",
136 ComputeKind::Check => "Checks",
137 ComputeKind::Workflow => "Workflows",
138 ComputeKind::Queue => "The merge queue",
139 ComputeKind::Deploy => "Deployments",
140 ComputeKind::Embedding => "Semantic search",
141 };
142 let message = match code {
143 FailureCode::NotPaid if kind.open_source_pool() => format!(
144 "{what} run in g1t's sandboxes, which cost real money, so they need the g1t plan ($20 a month) or a card check. A card check gives public repositories g1t's open-source pool and starts the $5 trial; it is never charged. Both are at {link}."
145 ),
146 FailureCode::NotPaid => format!(
147 "{what} cost real money to run, so they need the g1t plan ($20 a month, with $10 of usage included) or the one-time $5 trial, which starts with a card check that is never charged. Both are at {link}."
148 ),
149 FailureCode::TrialUsed => format!(
150 "This workspace has used its $5 trial. Start the g1t plan ($20 a month, with $10 of usage included) to keep going: {link}."
151 ),
152 FailureCode::OssPoolEmpty => format!(
153 "g1t's open-source pool for this month is used up{detail}, so checks and workflows on public repositories wait until the 1st. The g1t plan runs them now: {link}."
154 ),
155 FailureCode::Limit => format!("{detail} An owner can raise the limit, prepay, or ask g1t for more at {link}."),
156 FailureCode::Paused => format!("New compute is paused: {detail} An owner can see why and answer at {link}."),
157 _ => detail.to_owned(),
158 };
159 Outcome::fail(code, message)
160}
161
162#[derive(Deserialize)]
163struct SpikeRow {
164 id: String,
165 status: String,
166 hour_micros: i64,
167 average_micros: i64,
168 detected_at: String,
169 decided_by: Option<String>,
170 decided_at: Option<String>,
171 until: Option<String>,
172}
173
174impl From<SpikeRow> for Spike {
175 fn from(row: SpikeRow) -> Self {
176 Spike {
177 id: row.id,
178 status: row.status,
179 hour_micros: row.hour_micros,
180 average_micros: row.average_micros,
181 detected_at: row.detected_at,
182 decided_by: row.decided_by,
183 decided_at: row.decided_at,
184 until: row.until,
185 }
186 }
187}
188
189/// A workspace's pace: the last hour, the usual hour over the last week,
190/// the last day, at price (what was charged plus what paid for it first).
191#[derive(Clone, Copy, Debug, Default)]
192pub(crate) struct Pace {
193 pub last_hour: i64,
194 pub usual_hour: i64,
195 pub last_day: i64,
196}
197
198impl Billing {
199 /// Spend at price over the last hour, day and week.
200 pub(crate) async fn pace(&self, workspace: &str) -> Result<Pace> {
201 #[derive(Deserialize)]
202 struct Row {
203 hour: Option<i64>,
204 day: Option<i64>,
205 week: Option<i64>,
206 }
207 let now = now_ms();
208 let hour_ago = rfc3339(now - 60 * 60 * 1000);
209 let day_ago = rfc3339(now - 24 * 60 * 60 * 1000);
210 let week_ago = rfc3339(now - 7 * 24 * 60 * 60 * 1000);
211 let gross = "(-amount_micros + credit_micros + trial_micros + oss_micros + given_micros)";
212 let row = self
213 .db
214 .prepare(format!(
215 "SELECT SUM(CASE WHEN created_at >= ?2 THEN {gross} END) AS hour,
216 SUM(CASE WHEN created_at >= ?3 THEN {gross} END) AS day,
217 SUM(CASE WHEN created_at < ?2 THEN {gross} END) AS week
218 FROM ledger WHERE workspace = ?1 AND kind = 'usage' AND created_at >= ?4"
219 ))
220 .bind(&[workspace.into(), hour_ago.into(), day_ago.into(), week_ago.into()])?
221 .first::<Row>(None)
222 .await?;
223 Ok(row.map_or_else(Pace::default, |r| Pace {
224 last_hour: r.hour.unwrap_or(0).max(0),
225 usual_hour: r.week.unwrap_or(0).max(0) / (WEEK_HOURS - 1),
226 last_day: r.day.unwrap_or(0).max(0),
227 }))
228 }
229
230 /// The workspace's latest spike, if any.
231 pub(crate) async fn latest_spike(&self, workspace: &str) -> Result<Option<Spike>> {
232 Ok(self
233 .db
234 .prepare(
235 "SELECT id, status, hour_micros, average_micros, detected_at, decided_by, decided_at, until
236 FROM spikes WHERE workspace = ? ORDER BY detected_at DESC LIMIT 1",
237 )
238 .bind(&[workspace.into()])?
239 .first::<SpikeRow>(None)
240 .await?
241 .map(Spike::from))
242 }
243
244 /// The spike pausing the workspace now, found or new. Never for g1t's
245 /// own workspaces, which are watched in sudo but never paused.
246 async fn spike_pause(&self, workspace: &str, plan: PlanKind) -> Result<Option<Spike>> {
247 let latest = self.latest_spike(workspace).await?;
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept248 if let Some(spike) = &latest
249 && (spike.status == "open" || spike.status == "stopped") {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look250 return Ok(latest);
251 }
252 if plan == PlanKind::Internal || self.stripe.is_none() {
253 return Ok(None);
254 }
255 let pace = self.pace(workspace).await?;
256 let now = rfc3339(now_ms());
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept257 if let Some(spike) = &latest
258 && spike.status == "continued" && still_continued(spike.until.as_deref(), &now, spike.hour_micros, pace.last_hour) {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look259 return Ok(None);
260 }
261 if !is_spike(pace.last_hour, pace.usual_hour, self.plans.spike_factor, self.plans.spike_floor_micros) {
262 return Ok(None);
263 }
264 let id = new_id("spk", now_ms());
265 self.db
266 .prepare(
267 "INSERT INTO spikes (id, workspace, status, hour_micros, average_micros, detected_at)
268 SELECT ?1, ?2, 'open', ?3, ?4, ?5
269 WHERE NOT EXISTS (SELECT 1 FROM spikes WHERE workspace = ?2 AND status = 'open')",
270 )
271 .bind(&[id.as_str().into(), workspace.into(), (pace.last_hour as f64).into(), (pace.usual_hour as f64).into(), now.as_str().into()])?
272 .run()
273 .await?;
274 self.latest_spike(workspace).await
275 }
276
277 /// The alerts a workspace has reached this month: its plan's included
278 /// usage, its spend limit and g1t's ceiling, from 50%.
279 pub(crate) async fn alerts_for(&self, workspace: &str) -> Result<Vec<UsageAlert>> {
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index280 let account = self.account_of(workspace).await?;
281 let plan = self.plan_kind_for(workspace, &account).await?;
282 let has_plan = plan != PlanKind::Free;
283 let month = credits::month_of(&rfc3339(now_ms()));
284 let (limit, used) = try_join(self.limit_with(workspace, &account, plan), async {
285 if has_plan { self.allowance_used("plan_credit", workspace, &month).await } else { Ok(0) }
286 })
287 .await?;
288 Ok(alerts_from(workspace, &limit, has_plan, used, self.plans.plan_included_micros))
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look289 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index290}
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look291
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index292/// The alerts reached, from a limit already worked out, whether the
293/// workspace has the plan, and what of its included usage it has used.
294fn alerts_from(
295 workspace: &str,
296 limit: &g1t_contracts::billing::Limit,
297 has_plan: bool,
298 used: i64,
299 included: i64,
300) -> Vec<UsageAlert> {
301 let mut alerts = vec![];
302 if has_plan && limit.trust != g1t_contracts::billing::Trust::Internal {
303 let level = alert_level(used, included);
304 if level > 0 {
305 alerts.push(UsageAlert {
306 meter: "included".into(),
307 level,
308 used_micros: used,
309 limit_micros: included,
310 message: if level >= 100 {
311 format!("{workspace} has used all {} of this month's included usage. Usage from here is charged at cost plus 20%, up to your spend limit.", dollars(included))
312 } else {
313 format!("{workspace} has used {} of this month's {} included usage ({level}%). Past it, usage is charged at cost plus 20%, up to your spend limit.", dollars(used), dollars(included))
314 },
315 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look316 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index317 }
318 if let Some(spend_limit) = limit.spend_limit_micros {
319 let level = alert_level(limit.spent_micros, spend_limit);
320 if level > 0 {
321 alerts.push(UsageAlert {
322 meter: "spend_limit".into(),
323 level,
324 used_micros: limit.spent_micros,
325 limit_micros: spend_limit,
326 message: format!(
327 "{workspace} has spent {} of its {} monthly spend limit ({level}%). At the limit, new sandboxes, builds and agents stop until the month turns or an owner raises it.",
328 dollars(limit.spent_micros),
329 dollars(spend_limit)
330 ),
331 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look332 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index333 }
334 if let Some(ceiling) = limit.ceiling_micros.filter(|_| limit.trust != g1t_contracts::billing::Trust::New) {
335 let level = alert_level(limit.exposure_micros, ceiling);
336 if level > 0 {
337 alerts.push(UsageAlert {
338 meter: "ceiling".into(),
339 level,
340 used_micros: limit.exposure_micros,
341 limit_micros: ceiling,
342 message: format!(
343 "{workspace} has {} of usage not yet paid for, of the {} g1t allows ({level}%). With a card on file g1t charges it as the limit nears; prepaying raises it at once.",
344 dollars(limit.exposure_micros),
345 dollars(ceiling)
346 ),
347 });
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look348 }
349 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index350 alerts
351}
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look352
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index353impl Billing {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look354 /// Whether a card check was done for the workspace.
355 pub(crate) async fn card_checked(&self, workspace: &str) -> Result<bool> {
356 Ok(self
357 .db
358 .prepare("SELECT workspace FROM card_checks WHERE workspace = ?")
359 .bind(&[workspace.into()])?
360 .first::<serde_json::Value>(None)
361 .await?
362 .is_some())
363 }
364
365 /// What open reservations hold across `members`, at price.
366 async fn held(&self, members: &[String]) -> Result<i64> {
367 #[derive(Deserialize)]
368 struct Row {
369 held: Option<i64>,
370 }
371 let marks = vec!["?"; members.len().max(1)].join(", ");
372 let mut values: Vec<JsValue> = members.iter().map(|m| JsValue::from(m.as_str())).collect();
373 if values.is_empty() {
374 values.push("".into());
375 }
376 values.push(rfc3339(now_ms()).into());
377 Ok(self
378 .db
379 .prepare(format!(
380 "SELECT SUM(hold_micros) AS held FROM reservations
381 WHERE workspace IN ({marks}) AND settled_at IS NULL AND expires_at > ?"
382 ))
383 .bind(&values)?
384 .first::<Row>(None)
385 .await?
386 .and_then(|r| r.held)
387 .unwrap_or(0))
388 }
389
390 /// Why new compute is paused, if it is: a staff hold, a spike waiting
391 /// for an owner (or stopped by one), or the limit reached.
392 async fn pause_reason(
393 &self,
394 workspace: &str,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index395 account: &BillingAccount,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look396 plan: PlanKind,
397 limit: Option<&g1t_contracts::billing::Limit>,
398 ) -> Result<(Option<String>, Option<Spike>, Option<FailureCode>)> {
399 if let Some(hold) = account.allowances.hold.as_deref().filter(|h| !h.trim().is_empty()) {
400 return Ok((Some(format!("g1t staff put a hold on new compute ({}).", hold.trim())), None, Some(FailureCode::Paused)));
401 }
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays402 // A comped account past its monthly budget (`budget`).
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index403 if let Some(why) = self.comped_stop(account).await? {
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays404 return Ok((Some(why), None, Some(FailureCode::Paused)));
405 }
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look406 let spike = self.spike_pause(workspace, plan).await?;
407 if let Some(spike) = &spike {
408 let why = if spike.status == "stopped" {
409 format!(
410 "an owner stopped new compute after a spend spike ({} in an hour). An owner can choose Keep going.",
411 dollars(spike.hour_micros)
412 )
413 } else {
414 format!(
415 "{} was spent in an hour, more than {} times the usual {} an hour, so new compute waits for an owner to confirm.",
416 dollars(spike.hour_micros),
417 self.plans.spike_factor,
418 dollars(spike.average_micros)
419 )
420 };
421 return Ok((Some(why), Some(spike.clone()), Some(FailureCode::Paused)));
422 }
423 let latest = self.latest_spike(workspace).await?;
424 if plan != PlanKind::Internal && self.stripe.is_some() {
425 let worked_out;
426 let limit = match limit {
427 Some(limit) => limit,
428 None => {
429 worked_out = self.limit_of(workspace).await?;
430 &worked_out
431 }
432 };
433 if limit.state == LimitState::Stopped {
434 return Ok((limit.message.clone(), latest, Some(FailureCode::Limit)));
435 }
436 }
437 Ok((None, latest, None))
438 }
439
440 /// `entitlements`: what the workspace may do now.
441 pub(crate) async fn entitlements(&self, a: EntitlementsArgs) -> Result<Entitlements> {
442 let workspace = a.workspace.to_lowercase();
443 let account = self.account_of(&workspace).await?;
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index444 let plan = self.plan_kind_for(&workspace, &account).await?;
445 let has_plan = plan != PlanKind::Free;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look446 let now = rfc3339(now_ms());
447 let month = credits::month_of(&now);
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index448 // Every signed-in page asks for this, so what does not need another
449 // answer is read at once: the limit (and the pause, from it), the
450 // trial, and the month's counts.
451 let standing = async {
452 let limit = self.limit_with(&workspace, &account, plan).await?;
453 let pause = self.pause_reason(&workspace, &account, plan, Some(&limit)).await?;
454 Ok::<_, worker::Error>((limit, pause))
455 };
456 let trial = async {
457 let (checked, grant) = try_join(
458 async {
459 if matches!(plan, PlanKind::Internal | PlanKind::Enterprise) { Ok(true) } else { self.card_checked(&workspace).await }
460 },
461 self.grant_of(&workspace),
462 )
463 .await?;
464 // A card checked while the month's pool was empty: granted once
465 // it has room.
466 let grant = match grant {
467 Some(grant) => Some(grant),
468 None if checked && plan == PlanKind::Free && self.trial_allowed(&workspace).await? => self.ensure_grant(&workspace).await?,
469 None => None,
470 };
471 Ok::<_, worker::Error>((checked, grant))
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look472 };
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index473 let counts = try_join5(
474 self.owner_caps(&workspace),
475 self.private_storage(&workspace),
476 self.oss_paid(&workspace, &month),
477 self.held(&account.workspaces),
478 async { if has_plan { self.allowance_used("plan_credit", &workspace, &month).await } else { Ok(0) } },
479 );
480 let more = try_join(self.allowance_used("build_seconds", &workspace, &month), self.git_operations_this_month(&workspace));
481 let ((limit, (paused, spike, _)), (verified, grant), (owners, stored, oss, held, included_used), (build_seconds, git_operations)) =
482 try_join4(standing, trial, counts, more).await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look483 let trial_left = grant.as_ref().map_or(0, |g| left(g.granted_micros, g.used_micros));
484 let first_month = limit.first_month;
485 let (max_agents, max_minutes) = caps(plan, first_month, trial_left > 0, account.allowances.max_concurrent_agents);
486 let ceiling = match plan {
487 PlanKind::Free => 0,
488 PlanKind::Internal => UNLIMITED_MICROS,
489 _ => limit.ceiling_micros.unwrap_or(UNLIMITED_MICROS),
490 };
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index491 let alerts = alerts_from(&workspace, &limit, has_plan, included_used, self.plans.plan_included_micros);
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look492 Ok(Entitlements {
493 plan,
494 compute: has_plan || trial_left > 0,
495 trial_micros_left: trial_left,
496 trial_verified: verified,
497 first_month,
498 max_concurrent_agents: max_agents,
499 max_run_minutes: max_minutes,
500 run_cap_micros: account.allowances.run_cap_micros.or(owners.0).unwrap_or(self.plans.run_cap_micros),
501 issue_cap_micros: account.allowances.issue_cap_micros.or(owners.1).unwrap_or(self.plans.issue_cap_micros),
502 ceiling_micros: ceiling,
503 exposure_micros: limit.exposure_micros,
504 paused,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index505 held_micros: held,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look506 prepaid_micros: limit.prepaid_micros,
507 included_micros: if has_plan { self.plans.plan_included_micros } else { 0 },
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index508 included_used_micros: included_used,
Audit logs are kept by plan: a week on free, 90 days on the plan, and what staff set for an account in sudo509 audit_retention_days: crate::retention::effective_days(&self.plans, plan, account.allowances.audit_retention_days),
510 audit_retention_custom: account.allowances.audit_retention_days.is_some(),
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas511 free_private_storage_bytes: self.plans.free_storage_bytes,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look512 private_storage_bytes: stored,
513 oss_paid_micros: oss,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index514 build_seconds_used: build_seconds.max(0) as u32,
515 git_operations,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look516 git_operations_included: self.plans.git_included,
517 min_charge_micros: self.plans.min_charge_micros,
518 spike,
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index519 alerts,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look520 workspace,
521 })
522 }
523
524 /// `reserve`: holds a start's estimated cost, or says why not.
525 pub(crate) async fn reserve(&self, a: ReserveArgs) -> Result<Outcome<Reservation>> {
526 let workspace = a.workspace.to_lowercase();
527 let now = now_ms();
528 let expires_at = rfc3339(now + RESERVATION_HOURS * 60 * 60 * 1000);
529 let repo = format!("{}/{}", a.repo.namespace, a.repo.name).to_lowercase();
530 // A g1t that does not charge holds nothing.
531 if self.stripe.is_none() {
532 return Ok(Outcome::Ok(Reservation { id: new_id("rsv", now), paid_by: PaidBy::OnDemand, held_micros: 0, expires_at }));
533 }
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays534 let account = self.account_of(&workspace).await?;
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index535 let plan = self.plan_kind_for(&workspace, &account).await?;
Spend caps: a monthly budget for comped workspaces and a daily breaker on what g1t pays536 // g1t's own caps (`budget`), in their own words: a comped account's
537 // monthly budget, and the daily breaker.
538 if let Some(why) = self.comped_stop(&account).await? {
539 return Ok(Outcome::fail(FailureCode::Paused, why));
540 }
541 if let Some(why) = self.breaker_refuses(plan, &account, a.kind, a.hosted_model).await? {
542 return Ok(Outcome::fail(FailureCode::Paused, why));
543 }
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index544 let limit = if plan == PlanKind::Internal { None } else { Some(self.limit_with(&workspace, &account, plan).await?) };
545 let (paused, _, code) = self.pause_reason(&workspace, &account, plan, limit.as_ref()).await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look546 if let (Some(why), Some(code)) = (paused, code) {
547 return Ok(refusal(code, &workspace, a.kind, &why));
548 }
549 let month = credits::month_of(&rfc3339(now));
550 let estimate = credits::with_margin(a.estimate_micros, self.margin_percent);
551 let verified = matches!(plan, PlanKind::Internal | PlanKind::Enterprise | PlanKind::Paid) || self.card_checked(&workspace).await?;
552 let has_plan = plan != PlanKind::Free;
553 let credit = if has_plan {
554 left(self.plans.plan_included_micros, self.allowance_used("plan_credit", &workspace, &month).await?)
555 } else {
556 0
557 };
558 let trial = if a.kind == ComputeKind::Deploy || !verified {
559 0
560 } else {
561 self.grant_of(&workspace).await?.map_or(0, |g| left(g.granted_micros, g.used_micros))
562 };
563 let oss_eligible = a.public && a.kind.open_source_pool() && verified;
564 let oss = if oss_eligible { self.oss_left(&workspace, &repo, &month).await? } else { 0 };
565 let on_demand = match plan {
566 PlanKind::Free => Some(0),
567 PlanKind::Internal => None,
568 _ => {
569 let Some(limit) = &limit else { unreachable!("only g1t's own workspaces skip the limit") };
570 let under_ceiling = limit.ceiling_micros.map(|c| (c - limit.exposure_micros).max(0));
571 let under_spend = limit.spend_limit_micros.map(|s| (s - limit.spent_micros).max(0));
572 match (under_ceiling, under_spend) {
573 (Some(c), Some(s)) => Some(c.min(s)),
574 (c, s) => c.or(s),
575 }
576 }
577 };
578 let room = Room { credit, trial, oss, on_demand };
579 // Optimistic: what was held is read, and the hold is written only if
580 // nothing was held meanwhile; otherwise read again.
581 for _ in 0..4 {
582 let held = self.held(&account.workspaces).await?;
583 let (paid_by, hold) = match place(&room, held, estimate, has_plan) {
584 Ok(placed) => placed,
Billing keeps Stripe's view itself: the saved card on the account, missed events replayed every 15 minutes, and the endpoint kept585 Err(short) => return self.short(&workspace, plan, &a, verified, &room, short).await,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look586 };
587 let id = new_id("rsv", now);
588 let mut values: Vec<JsValue> = vec![
589 id.as_str().into(),
590 workspace.as_str().into(),
591 repo.as_str().into(),
592 a.kind.as_str().into(),
593 u8::from(a.public).into(),
594 (a.estimate_micros.max(0) as f64).into(),
595 (hold as f64).into(),
596 paid_by_text(paid_by).into(),
597 rfc3339(now).into(),
598 expires_at.as_str().into(),
599 (held as f64).into(),
600 ];
601 values.extend(account.workspaces.iter().map(|w| JsValue::from(w.as_str())));
602 if account.workspaces.is_empty() {
603 values.push("".into());
604 }
605 let placed = self
606 .db
607 .prepare(format!(
608 "INSERT INTO reservations (id, workspace, repo, kind, public, estimate_micros, hold_micros, paid_by, created_at, expires_at)
609 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10
610 WHERE (SELECT COALESCE(SUM(hold_micros), 0) FROM reservations
611 WHERE workspace IN ({marks}) AND settled_at IS NULL AND expires_at > ?9) = ?11
612 RETURNING id",
613 marks = (12..12 + account.workspaces.len().max(1)).map(|i| format!("?{i}")).collect::<Vec<_>>().join(", ")
614 ))
615 .bind(&values)?
616 .first::<serde_json::Value>(None)
617 .await?;
618 if placed.is_some() {
619 // What is held, at cost, as it was asked.
620 let held_cost = if hold >= estimate { a.estimate_micros.max(0) } else { hold * 100 / i64::from(100 + self.margin_percent) };
621 return Ok(Outcome::Ok(Reservation { id, paid_by, held_micros: held_cost, expires_at }));
622 }
623 }
624 Ok(refusal(FailureCode::Limit, &workspace, a.kind, "Too many starts at once to hold this one; try again in a moment."))
625 }
626
627 /// The refusal for a start nothing pays for.
628 async fn short(
629 &self,
630 workspace: &str,
631 plan: PlanKind,
632 a: &ReserveArgs,
633 verified: bool,
634 room: &Room,
635 short: Short,
636 ) -> Result<Outcome<Reservation>> {
637 if plan != PlanKind::Free {
638 let limit = self.limit_of(workspace).await?;
639 let detail = match short {
640 Short::TooSmall => format!(
641 "This would take the workspace past its limit: about {} more could start now ({} spent of a {} spend limit, {} not yet paid of the {} g1t allows).",
642 dollars(room.credit + room.trial + room.oss + room.on_demand.unwrap_or(0)),
643 dollars(limit.spent_micros),
644 dollars(limit.spend_limit_micros.unwrap_or_default()),
645 dollars(limit.exposure_micros),
646 dollars(limit.ceiling_micros.unwrap_or_default()),
647 ),
648 Short::Empty => limit.message.unwrap_or_else(|| "The workspace reached its limit for this month.".to_owned()),
649 };
650 return Ok(refusal(FailureCode::Limit, workspace, a.kind, &detail));
651 }
652 if !verified {
653 return Ok(refusal(FailureCode::NotPaid, workspace, a.kind, ""));
654 }
655 let oss_eligible = a.public && a.kind.open_source_pool();
656 let trial = self.grant_of(workspace).await?;
657 if oss_eligible && room.oss == 0 {
658 let month = credits::month_of(&rfc3339(now_ms()));
659 let repo = format!("{}/{}", a.repo.namespace, a.repo.name).to_lowercase();
660 let pool = left(self.plans.oss_pool_micros, self.allowance_used("oss_pool", "", &month).await?);
661 let detail = if pool > 0 { format!(" for {repo} (its share is {})", dollars(self.oss_repo_cap(workspace).await?)) } else { String::new() };
662 if trial.as_ref().is_none_or(|g| g.used_micros >= g.granted_micros) {
663 return Ok(refusal(FailureCode::OssPoolEmpty, workspace, a.kind, &detail));
664 }
665 }
666 match trial {
667 Some(grant) if grant.used_micros >= grant.granted_micros => Ok(refusal(FailureCode::TrialUsed, workspace, a.kind, "")),
668 _ => Ok(refusal(FailureCode::NotPaid, workspace, a.kind, "")),
669 }
670 }
671
672 /// `settle`: releases a hold.
673 pub(crate) async fn settle_reservation(&self, a: SettleArgs) -> Result<Outcome<bool>> {
674 let now = rfc3339(now_ms());
675 let settled = self
676 .db
677 .prepare(
678 "UPDATE reservations SET settled_at = ?1, actual_micros = ?2
679 WHERE id = ?3 AND settled_at IS NULL AND expires_at > ?1 RETURNING id",
680 )
681 .bind(&[now.as_str().into(), (a.actual_micros.max(0) as f64).into(), a.reservation_id.as_str().into()])?
682 .first::<serde_json::Value>(None)
683 .await?;
684 Ok(Outcome::Ok(settled.is_some()))
685 }
686
687 /// Clears reservations long settled or lapsed.
688 pub(crate) async fn sweep_reservations(&self) -> Result<()> {
689 let week_ago = rfc3339(now_ms() - 7 * 24 * 60 * 60 * 1000);
690 self.db
691 .prepare("DELETE FROM reservations WHERE expires_at < ?1")
692 .bind(&[week_ago.into()])?
693 .run()
694 .await?;
695 Ok(())
696 }
697
698 /// `confirm_spike`: an owner keeps going, or stops.
699 pub(crate) async fn confirm_spike(&self, a: ConfirmSpikeArgs) -> Result<Outcome<Entitlements>> {
700 let workspace = a.workspace.to_lowercase();
701 if a.actor.role_in(&workspace) != Some(Role::Owner) {
702 return Ok(Outcome::fail(FailureCode::Forbidden, "Only an owner can answer a spend spike."));
703 }
704 let Some(spike) = self.latest_spike(&workspace).await? else {
705 return Ok(Outcome::fail(FailureCode::NotFound, "There is no spend spike to answer."));
706 };
707 let now = now_ms();
708 let (status, until) = if a.keep_going { ("continued", Some(rfc3339(now + KEEP_GOING_MS))) } else { ("stopped", None) };
709 self.db
710 .prepare("UPDATE spikes SET status = ?1, decided_by = ?2, decided_at = ?3, until = ?4 WHERE id = ?5")
711 .bind(&[
712 status.into(),
713 a.actor.username.as_str().into(),
714 rfc3339(now).into(),
715 crate::optional(until.as_deref()),
716 spike.id.as_str().into(),
717 ])?
718 .run()
719 .await?;
720 let account = self.account_of(&workspace).await?;
721 self.audit(
722 &account.id,
723 "spike",
724 &format!("{workspace}: {} after {} in an hour", if a.keep_going { "kept going" } else { "stopped" }, dollars(spike.hour_micros)),
725 &a.actor.username,
726 )
727 .await?;
728 Ok(Outcome::Ok(self.entitlements(EntitlementsArgs { workspace }).await?))
729 }
730
731 /// The owners' own run and issue caps, if they set them.
732 async fn owner_caps(&self, workspace: &str) -> Result<(Option<i64>, Option<i64>)> {
733 #[derive(Deserialize)]
734 struct Row {
735 run_cap_micros: Option<i64>,
736 issue_cap_micros: Option<i64>,
737 }
738 Ok(self
739 .db
740 .prepare("SELECT run_cap_micros, issue_cap_micros FROM limits WHERE workspace = ?")
741 .bind(&[workspace.into()])?
742 .first::<Row>(None)
743 .await?
744 .map_or((None, None), |r| (r.run_cap_micros, r.issue_cap_micros)))
745 }
746
747 /// `set_caps`: the owners' own run and issue caps.
748 pub(crate) async fn set_caps(&self, a: SetCapsArgs) -> Result<Outcome<Entitlements>> {
749 let workspace = a.workspace.to_lowercase();
750 if a.actor.role_in(&workspace) != Some(Role::Owner) {
751 return Ok(Outcome::fail(FailureCode::Forbidden, "Only an owner can set the workspace's caps."));
752 }
753 if let Err(why) = cap_bounds(a.run_cap_micros, a.issue_cap_micros) {
754 return Ok(Outcome::fail(FailureCode::Invalid, why));
755 }
756 let opt = |m: Option<i64>| m.map_or(JsValue::NULL, |m| (m as f64).into());
757 let now = rfc3339(now_ms());
758 self.db
759 .prepare(
760 "INSERT INTO limits (workspace, run_cap_micros, issue_cap_micros, updated_at) VALUES (?1, ?2, ?3, ?4)
761 ON CONFLICT (workspace) DO UPDATE SET run_cap_micros = ?2, issue_cap_micros = ?3, updated_at = ?4",
762 )
763 .bind(&[workspace.as_str().into(), opt(a.run_cap_micros), opt(a.issue_cap_micros), now.into()])?
764 .run()
765 .await?;
766 let account = self.account_of(&workspace).await?;
767 let shown = |m: Option<i64>| m.map_or_else(|| "the default".to_owned(), dollars);
768 self.audit(
769 &account.id,
770 "caps",
771 &format!("{workspace}: run cap {}, issue cap {}", shown(a.run_cap_micros), shown(a.issue_cap_micros)),
772 &a.actor.username,
773 )
774 .await?;
775 Ok(Outcome::Ok(self.entitlements(EntitlementsArgs { workspace }).await?))
776 }
777
778 /// Emails owners about spikes that paused their workspace, once each.
779 pub(crate) async fn tell_spikes(&self, identity: &worker::Fetcher) -> Result<()> {
780 #[derive(Deserialize)]
781 struct Open {
782 id: String,
783 workspace: String,
784 hour_micros: i64,
785 average_micros: i64,
786 }
787 let open = self
788 .db
789 .prepare("SELECT id, workspace, hour_micros, average_micros FROM spikes WHERE status = 'open' AND told_at IS NULL LIMIT 20")
790 .all()
791 .await?
792 .results::<Open>()?;
793 for spike in open {
794 let workspace = &spike.workspace;
795 let intro = format!(
796 "{workspace} spent {} in the last hour, more than {} times its usual {} an hour, so g1t paused new sandboxes, agents and builds until an owner confirms. Runs already going finish. If this was meant, choose Keep going and nothing pauses for 24 hours unless the hour's spend doubles again. If not, choose Stop; and if it was a mistake, tell g1t from the billing page.",
797 dollars(spike.hour_micros),
798 self.plans.spike_factor,
799 dollars(spike.average_micros)
800 );
801 let link = format!("https://g1t.sh/{workspace}/-/billing");
802 if crate::limits::notify(identity, workspace, &format!("g1t: spending on {workspace} spiked, so new work is paused"), &intro, "Keep going or stop", &link).await {
803 self.db
804 .prepare("UPDATE spikes SET told_at = ? WHERE id = ?")
805 .bind(&[rfc3339(now_ms()).into(), spike.id.as_str().into()])?
806 .run()
807 .await?;
808 }
809 }
810 Ok(())
811 }
812
813 /// What the workspace's private repositories held at the last measure.
814 pub(crate) async fn private_storage(&self, workspace: &str) -> Result<i64> {
815 #[derive(Deserialize)]
816 struct Stored {
817 private_bytes: Option<i64>,
818 }
819 Ok(self
820 .db
821 .prepare("SELECT private_bytes FROM storage_days WHERE workspace = ? ORDER BY day DESC LIMIT 1")
822 .bind(&[workspace.into()])?
823 .first::<Stored>(None)
824 .await?
825 .and_then(|s| s.private_bytes)
826 .unwrap_or(0))
827 }
828
829 /// What g1t's open-source pool paid for the workspace in `month`.
830 async fn oss_paid(&self, workspace: &str, month: &str) -> Result<i64> {
831 #[derive(Deserialize)]
832 struct Sum {
833 micros: Option<i64>,
834 }
835 Ok(self
836 .db
837 .prepare("SELECT SUM(oss_micros) AS micros FROM ledger WHERE workspace = ? AND created_at >= ?")
838 .bind(&[workspace.into(), format!("{month}-01").into()])?
839 .first::<Sum>(None)
840 .await?
841 .and_then(|s| s.micros)
842 .unwrap_or(0))
843 }
844}
845
846/// Whether owners' caps are in bounds: a run $0.10 to $100 (the
847/// guardrails' most), an issue $1 to $1,000.
848pub(crate) fn cap_bounds(run: Option<i64>, issue: Option<i64>) -> std::result::Result<(), String> {
849 if run.is_some_and(|m| !(100_000..=100_000_000).contains(&m)) {
850 return Err("A run's cap is between $0.10 and $100.".to_owned());
851 }
852 if issue.is_some_and(|m| !(1_000_000..=1_000_000_000).contains(&m)) {
853 return Err("An issue's cap is between $1 and $1,000.".to_owned());
854 }
855 Ok(())
856}
857
858pub(crate) fn paid_by_text(paid_by: PaidBy) -> &'static str {
859 match paid_by {
860 PaidBy::Credit => "credit",
861 PaidBy::Trial => "trial",
862 PaidBy::Oss => "oss",
863 PaidBy::OnDemand => "on_demand",
864 }
865}
866
867#[cfg(test)]
868mod tests {
869 use super::*;
870
Billing answers every page in a few round trips, not forty: its reads run together, Stripe is asked at most hourly, and the ledger has a time index871 fn limit(trust: g1t_contracts::billing::Trust, spent: i64, spend_limit: Option<i64>, exposure: i64, ceiling: Option<i64>) -> g1t_contracts::billing::Limit {
872 g1t_contracts::billing::Limit {
873 workspace: "acme".into(),
874 account: "acc_acme".into(),
875 account_name: "acme".into(),
876 trust,
877 exposure_micros: exposure,
878 ceiling_micros: ceiling,
879 trust_ceiling_micros: ceiling,
880 spend_limit_micros: spend_limit,
881 state: LimitState::Ok,
882 message: None,
883 spent_micros: spent,
884 default_spend_limit: false,
885 available_micros: None,
886 growth: None,
887 prepaid_micros: 0,
888 max_ceiling_micros: None,
889 raise_once_micros: None,
890 raised_at: None,
891 first_month: false,
892 }
893 }
894
895 #[test]
896 fn alerts_come_from_the_answers_already_read() {
897 use g1t_contracts::billing::Trust;
898 let meters = |alerts: Vec<UsageAlert>| alerts.into_iter().map(|a| (a.meter, a.level)).collect::<Vec<_>>();
899 // On the plan: included usage at 90%, the spend limit at 50%, the ceiling at 75%.
900 let paid = limit(Trust::Paid, 100_000_000, Some(200_000_000), 75_000_000, Some(100_000_000));
901 assert_eq!(
902 meters(alerts_from("acme", &paid, true, 9_000_000, 10_000_000)),
903 vec![("included".to_owned(), 90), ("spend_limit".to_owned(), 50), ("ceiling".to_owned(), 75)]
904 );
905 // Without the plan, what was used of the included usage is not an alert.
906 assert_eq!(meters(alerts_from("acme", &paid, false, 9_000_000, 10_000_000)).len(), 2);
907 // g1t's own workspaces have no included usage to warn of, and a new
908 // workspace's ceiling is not one either.
909 let internal = limit(Trust::Internal, 0, None, 0, None);
910 assert!(alerts_from("acme", &internal, true, 10_000_000, 10_000_000).is_empty());
911 let new = limit(Trust::New, 0, None, 3_000_000, Some(3_000_000));
912 assert!(alerts_from("acme", &new, false, 0, 10_000_000).is_empty());
913 }
914
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look915 fn paid(credit: i64, on_demand: i64) -> Room {
916 Room { credit, trial: 0, oss: 0, on_demand: Some(on_demand) }
917 }
918
919 #[test]
920 fn included_usage_pays_first_then_on_demand() {
921 // $10 included, $100 under the ceiling, nothing held: included pays first.
922 assert_eq!(place(&paid(10_000_000, 100_000_000), 0, 2_400_000, true), Ok((PaidBy::Credit, 2_400_000)));
923 // Holds already cover the included usage: on demand.
924 assert_eq!(place(&paid(10_000_000, 100_000_000), 10_000_000, 2_400_000, true), Ok((PaidBy::OnDemand, 2_400_000)));
925 // A free workspace on its trial.
926 let trial = Room { trial: 5_000_000, on_demand: Some(0), ..Room::default() };
927 assert_eq!(place(&trial, 0, 2_400_000, false), Ok((PaidBy::Trial, 2_400_000)));
928 // A public repository's checks, from the pool.
929 let pool = Room { oss: 2_000_000, on_demand: Some(0), ..Room::default() };
930 assert_eq!(place(&pool, 0, 600_000, false), Ok((PaidBy::Oss, 600_000)));
931 }
932
933 #[test]
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas934 fn a_paid_workspace_is_stopped_only_by_its_limit_never_by_a_count() {
935 // The included $10 is gone and the workspace has already built,
936 // served and stored far past what used to be quotas: the next start
937 // still goes on demand, as long as its spend limit has room.
938 let room = paid(0, 250_000_000);
939 let held = 0;
940 for start in 0..1_000 {
941 let placed = place(&room, held + start * 100_000, 100_000, true);
942 assert_eq!(placed, Ok((PaidBy::OnDemand, 100_000)));
943 }
944 // Only at its limit does it stop, with the limit's refusal.
945 assert_eq!(place(&room, 250_000_000, 100_000, true), Err(Short::Empty));
946 // A free workspace has no on-demand room at all: with no trial or
947 // pool left, nothing starts (`short` says NotPaid or TrialUsed).
948 let free = Room { on_demand: Some(0), ..Room::default() };
949 assert_eq!(place(&free, 0, 100_000, false), Err(Short::Empty));
950 // g1t's own workspaces: no limit.
951 let internal = Room { on_demand: None, ..Room::default() };
952 assert_eq!(place(&internal, i64::MAX / 2, 100_000, true), Ok((PaidBy::OnDemand, 100_000)));
953 }
954
955 #[test]
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look956 fn concurrent_starts_cannot_overshoot_the_ceiling() {
957 // $5 of room in all, and each start may cost up to $2.40.
958 let room = paid(0, 5_000_000);
959 let mut held = 0;
960 let mut started = 0;
961 for _ in 0..5 {
962 match place(&room, held, 2_400_000, true) {
963 Ok((_, hold)) => {
964 held += hold;
965 started += 1;
966 }
967 Err(short) => assert_eq!(short, Short::TooSmall),
968 }
969 }
970 assert_eq!(started, 2);
971 assert!(held <= 5_000_000);
972 // Once the first settles, a third fits.
973 assert!(place(&room, held - 2_400_000, 2_400_000, true).is_ok());
974 // Nothing left at all.
975 assert_eq!(place(&room, 5_000_000, 1, true), Err(Short::Empty));
976 }
977
978 #[test]
979 fn a_free_workspace_may_use_its_last_bit_of_trial() {
980 let room = Room { trial: 300_000, on_demand: Some(0), ..Room::default() };
981 // The whole estimate does not fit, but what is left is held.
982 assert_eq!(place(&room, 0, 2_400_000, false), Ok((PaidBy::Trial, 300_000)));
983 // Once it is held, nothing more starts.
984 assert_eq!(place(&room, 300_000, 2_400_000, false), Err(Short::Empty));
985 // Nothing at all: no plan, no trial, no pool.
986 assert_eq!(place(&Room { on_demand: Some(0), ..Room::default() }, 0, 1, false), Err(Short::Empty));
987 }
988
989 #[test]
990 fn g1ts_own_workspaces_are_never_short() {
991 let room = Room { credit: 10_000_000, on_demand: None, ..Room::default() };
992 assert_eq!(place(&room, 50_000_000_000, 2_400_000, true), Ok((PaidBy::OnDemand, 2_400_000)));
993 assert_eq!(place(&room, 0, 2_400_000, true), Ok((PaidBy::Credit, 2_400_000)));
994 }
995
996 #[test]
997 fn a_spike_is_five_times_the_usual_hour_and_at_least_five_dollars() {
998 let (factor, floor) = (5, 5_000_000);
999 // A new workspace with no history: $5 in an hour is a spike, $4 is not.
1000 assert!(is_spike(5_000_000, 0, factor, floor));
1001 assert!(!is_spike(4_000_000, 0, factor, floor));
1002 // Usually $2 an hour: $10 is not above five times, $10.01 is.
1003 assert!(!is_spike(10_000_000, 2_000_000, factor, floor));
1004 assert!(is_spike(10_010_000, 2_000_000, factor, floor));
1005 // A busy workspace at its usual pace is never a spike.
1006 assert!(!is_spike(40_000_000, 30_000_000, factor, floor));
1007 }
1008
1009 #[test]
1010 fn keep_going_lasts_a_day_or_until_spend_doubles() {
1011 let until = "2026-10-06T12:00:00Z";
1012 assert!(still_continued(Some(until), "2026-10-06T11:00:00Z", 6_000_000, 8_000_000));
1013 // Doubled again: paused again.
1014 assert!(!still_continued(Some(until), "2026-10-06T11:00:00Z", 6_000_000, 12_000_000));
1015 // A day later: watched afresh.
1016 assert!(!still_continued(Some(until), "2026-10-06T12:00:01Z", 6_000_000, 1_000_000));
1017 assert!(!still_continued(None, "2026-10-06T11:00:00Z", 6_000_000, 1));
1018 }
1019
1020 #[test]
1021 fn owners_caps_stay_in_bounds() {
1022 assert!(cap_bounds(None, None).is_ok());
1023 assert!(cap_bounds(Some(5_000_000), Some(50_000_000)).is_ok());
1024 assert!(cap_bounds(Some(50_000), None).is_err());
1025 assert!(cap_bounds(Some(101_000_000), None).is_err());
1026 assert!(cap_bounds(None, Some(500_000)).is_err());
1027 assert!(cap_bounds(None, Some(2_000_000_000)).is_err());
1028 }
1029
1030 #[test]
1031 fn caps_are_tight_in_the_first_month_and_on_the_trial() {
1032 assert_eq!(caps(PlanKind::Paid, true, false, None), (2, 60));
1033 assert_eq!(caps(PlanKind::Free, false, true, None), (2, 60));
1034 assert_eq!(caps(PlanKind::Paid, false, false, None), (10, g1t_contracts::guardrails::MAX_MINUTES));
1035 assert_eq!(caps(PlanKind::Internal, false, false, None).0, 10);
1036 // Staff can set agents at once.
1037 assert_eq!(caps(PlanKind::Paid, true, false, Some(6)).0, 6);
1038 }
1039
1040 #[test]
1041 fn every_refusal_says_what_to_do_and_where() {
1042 for code in [FailureCode::NotPaid, FailureCode::TrialUsed, FailureCode::OssPoolEmpty, FailureCode::Limit, FailureCode::Paused] {
1043 let Outcome::Fail(failure) = refusal(code, "acme", ComputeKind::Check, "Detail.") else { panic!() };
1044 assert_eq!(failure.code, code);
1045 assert!(failure.message.contains("/acme/-/billing"), "{}", failure.message);
1046 }
1047 let Outcome::Fail(failure) = refusal(FailureCode::NotPaid, "acme", ComputeKind::Agent, "") else { panic!() };
1048 assert!(failure.message.contains("$5 trial") && failure.message.contains("never charged"));
1049 }
1050}