UBERF-9606: Limit a number of workspaces per user (#8192)

haiodo · haiodo · commit 7b6c99eda0fd · 2025-03-11T18:12:44.000+07:00
* UBERF-9606: Limit workspaces per user

Signed-off-by: Andrey Sobolev &lt;haiodo@gmail.com&gt;

* Revert limit check for system account or admin

Signed-off-by: Andrey Sobolev &lt;haiodo@gmail.com&gt;

* Fix review comment

Signed-off-by: Andrey Sobolev &lt;haiodo@gmail.com&gt;

---------

Signed-off-by: Andrey Sobolev &lt;haiodo@gmail.com&gt;
diff --git a/dev/docker-compose.yaml b/dev/docker-compose.yaml
@@ -90,6 +90,7 @@ services:
       - SERVER_SECRET=secret
       - ADMIN_EMAILS=admin
       - STATS_URL=http://huly.local:4900
+      - WORKSPACE_LIMIT_PER_USER=10000
       # - DB_URL=postgresql://root@huly.local:26257/defaultdb?sslmode=disable
       - DB_URL=${MONGO_URL}
       # - DB_NS=account-2
diff --git a/dev/prod/webpack.config.js b/dev/prod/webpack.config.js
@@ -74,7 +74,7 @@ const devProxy = {
 
 const devProxyTest = {
   '/account': {
-    target: 'http://localhost:3003',
+    target: 'http://huly.local:3003',
     changeOrigin: true,
     pathRewrite: { '^/account': '' },
     logLevel: 'debug'
diff --git a/packages/platform/lang/cs.json b/packages/platform/lang/cs.json
@@ -19,6 +19,7 @@
     "AccountAlreadyConfirmed": "Účet již byl potvrzen",
     "WorkspaceAlreadyExists": "Pracovní prostor již existuje",
     "InvalidOtp": "Neplatný kód",
-    "InviteNotFound": "Pozvánka s email:{email} nebyla nalezena."
+    "InviteNotFound": "Pozvánka s email:{email} nebyla nalezena.",
+    "WorkspaceLimitReached": "Dosáhli jste limitu pracovních prostorů. Kontaktujte nás..."
   }
 }
diff --git a/packages/platform/lang/de.json b/packages/platform/lang/de.json
@@ -19,6 +19,7 @@
     "AccountAlreadyConfirmed": "Konto wurde bereits bestätigt",
     "WorkspaceAlreadyExists": "Arbeitsbereich existiert bereits",
     "InvalidOtp": "Ungültiger Code",
-    "InviteNotFound": "Einladung mit E-Mail: {email} nicht gefunden."
+    "InviteNotFound": "Einladung mit E-Mail: {email} nicht gefunden.",
+    "WorkspaceLimitReached": "Sie haben das Arbeitsbereichslimit erreicht. Bitte kontaktieren Sie uns..."
   }
 }
diff --git a/packages/platform/lang/en.json b/packages/platform/lang/en.json
@@ -18,6 +18,7 @@
     "AccountAlreadyConfirmed": "Account already confirmed",
     "WorkspaceAlreadyExists": "Workspace already exists",
     "InvalidOtp": "Invalid code",
-    "InviteNotFound": "Invitation with email:{email} not found."
+    "InviteNotFound": "Invitation with email:{email} not found.",
+    "WorkspaceLimitReached": "You have reached the workspace limit. Please contact us..."
   }
 }
diff --git a/packages/platform/lang/es.json b/packages/platform/lang/es.json
@@ -19,6 +19,7 @@
     "AccountAlreadyConfirmed": "La cuenta ya está confirmada",
     "WorkspaceAlreadyExists": "El espacio de trabajo ya existe",
     "InvalidOtp": "Código no válido",
-    "InviteNotFound": "No se encontró la invitación con email:{email}."
+    "InviteNotFound": "No se encontró la invitación con email:{email}.",
+    "WorkspaceLimitReached": "Ha alcanzado el límite de espacios de trabajo. Póngase en contacto con nosotros..."
   }
 }
diff --git a/packages/platform/lang/fr.json b/packages/platform/lang/fr.json
@@ -19,6 +19,7 @@
     "AccountAlreadyConfirmed": "Compte déjà confirmé",
     "WorkspaceAlreadyExists": "L'espace de travail existe déjà",
     "InvalidOtp": "Code invalide",
-    "InviteNotFound": "Invitation avec l'email:{email} introuvable."
+    "InviteNotFound": "Invitation avec l'email:{email} introuvable.",
+    "WorkspaceLimitReached": "Vous avez atteint la limite d'espace de travail. Veuillez contacter nous..."
   }
 }
diff --git a/packages/platform/lang/it.json b/packages/platform/lang/it.json
@@ -19,6 +19,7 @@
     "AccountAlreadyConfirmed": "Account già confermato",
     "WorkspaceAlreadyExists": "Spazio di lavoro già esistente",
     "InvalidOtp": "Codice non valido",
-    "InviteNotFound": "Invito con email:{email} non trovato."
+    "InviteNotFound": "Invito con email:{email} non trovato.",
+    "WorkspaceLimitReached": "Hai raggiunto il limite di spazi di lavoro. Contattaci..."
   }
 }
diff --git a/packages/platform/lang/pt.json b/packages/platform/lang/pt.json
@@ -19,6 +19,7 @@
     "AccountAlreadyConfirmed": "Conta já confirmada",
     "WorkspaceAlreadyExists": "Espaço de trabalho já existe",
     "InvalidOtp": "Código inválido",
-    "InviteNotFound": "Convite com email:{email} não encontrado."
+    "InviteNotFound": "Convite com email:{email} não encontrado.",
+    "WorkspaceLimitReached": "Você atingiu o limite de espaço de trabalho. Entre em contato conosco..."
   }
 }
diff --git a/packages/platform/lang/ru.json b/packages/platform/lang/ru.json
@@ -19,6 +19,7 @@
     "AccountAlreadyConfirmed": "Аккаунт уже подтвержден",
     "WorkspaceAlreadyExists": "Рабочее пространство уже существует",
     "InvalidOtp": "Неверный код",
-    "InviteNotFound": "Приглашение с email:{email} не найдено."
+    "InviteNotFound": "Приглашение с email:{email} не найдено.",
+    "WorkspaceLimitReached": "Вы достигли лимита рабочих пространств. Свяжитесь с нами..."
   }
 }
diff --git a/packages/platform/lang/zh.json b/packages/platform/lang/zh.json
@@ -19,6 +19,7 @@
     "AccountAlreadyConfirmed": "账户已确认",
     "WorkspaceAlreadyExists": "工作区已存在",
     "InvalidOtp": "无效的代码",
-    "InviteNotFound": "未找到 id 为 {email} 的邀请。"
+    "InviteNotFound": "未找到 id 为 {email} 的邀请。",
+    "WorkspaceLimitReached": "您已达到工作区限制。请联系我们..."
   }
 }
diff --git a/packages/platform/src/platform.ts b/packages/platform/src/platform.ts
@@ -159,6 +159,7 @@ export default plugin(platformId, {
     AccountAlreadyExists: '' as StatusCode,
     WorkspaceAlreadyExists: '' as StatusCode<{ workspace: string }>,
     WorkspaceRateLimit: '' as StatusCode<{ workspace: string }>,
+    WorkspaceLimitReached: '' as StatusCode<{ workspace: string }>,
     InvalidOtp: '' as StatusCode,
     InviteNotFound: '' as StatusCode<{ email: string }>
   },
diff --git a/plugins/login-assets/lang/en.json b/plugins/login-assets/lang/en.json
@@ -3,7 +3,7 @@
     "RequiredField": "Required field {field}",
     "FieldsDoNotMatch": "{field} don't match {field2}",
     "ConnectingToServer": "Connecting to server....",
-    "IncorrectValue": "Incorrect value {field}"
+    "IncorrectValue": "Incorrect value {field}"    
   },
   "string": {
     "LogIn": "Log In",
diff --git a/plugins/login-assets/lang/es.json b/plugins/login-assets/lang/es.json
@@ -3,7 +3,7 @@
     "RequiredField": "Campo obligatorio: {field}",
     "FieldsDoNotMatch": "{field} no coincide con {field2}",
     "ConnectingToServer": "Conectando al servidor...",
-    "IncorrectValue": "Valor incorrecto para {field}"
+    "IncorrectValue": "Valor incorrecto para {field}"    
   },
   "string": {
     "LogIn": "Iniciar sesión",
diff --git a/qms-tests/docker-compose.yaml b/qms-tests/docker-compose.yaml
@@ -53,6 +53,7 @@ services:
     environment:
       - ACCOUNT_PORT=3003
       - SERVER_SECRET=secret
+      - WORKSPACE_LIMIT_PER_USER=100
       - DB_URL=mongodb://mongodb:27018
       - TRANSACTOR_URL=ws://transactor:3334;ws://huly.local:3334
       - STORAGE_CONFIG=${STORAGE_CONFIG}
diff --git a/server/account/src/operations.ts b/server/account/src/operations.ts
@@ -101,6 +101,9 @@ import {
 // Move to config?
 const processingTimeoutMs = 30 * 1000
 
+const workspaceLimitPerUser =
+  process.env.WORKSPACE_LIMIT_PER_USER != null ? parseInt(process.env.WORKSPACE_LIMIT_PER_USER) : 10
+
 /* =================================== */
 /* ============OPERATIONS============= */
 /* =================================== */
@@ -353,18 +356,28 @@ export async function createWorkspace (
   if (socialId == null) {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.AccountNotConfirmed, {}))
   }
+  const person = await db.person.findOne({ uuid: socialId.personUuid })
+  if (person == null) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
+  }
+
+  // Get a list of created workspaces
+  const created = (await db.workspace.find({ createdBy: socialId.personUuid })).length
+
+  // TODO: Add support for per person limit increase
+  if (created >= workspaceLimitPerUser) {
+    ctx.warn('created-by-limit', { person: socialId.key, workspace: workspaceName })
+    throw new PlatformError(
+      new Status(Severity.ERROR, platform.status.WorkspaceLimitReached, { workspace: workspaceName })
+    )
+  }
 
   const { workspaceUuid, workspaceUrl } = await createWorkspaceRecord(ctx, db, branding, workspaceName, account, region)
 
   await db.assignWorkspace(account, workspaceUuid, AccountRole.Owner)
 
   ctx.info('Creating workspace record done', { workspaceName, region, account: socialId.personUuid })
 
-  const person = await db.person.findOne({ uuid: socialId.personUuid })
-  if (person == null) {
-    throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
-  }
-
   return {
     account,
     socialId: socialId.key,
diff --git a/tests/docker-compose.yaml b/tests/docker-compose.yaml
@@ -52,6 +52,7 @@ services:
     environment:
       - ACCOUNT_PORT=3003
       - SERVER_SECRET=secret
+      - WORKSPACE_LIMIT_PER_USER=100
       - DB_URL=mongodb://mongodb:27018
       - TRANSACTOR_URL=ws://transactor:3334;ws://localhost:3334
       - STORAGE_CONFIG=${STORAGE_CONFIG}
diff --git a/ws-tests/docker-compose.yaml b/ws-tests/docker-compose.yaml
@@ -63,6 +63,7 @@ services:
       - REGION_INFO=|America;europe| # Europe without name will not be available for creation of new workspaces.
       # - REGION_INFO=|America;europe|Europe
       - ADMIN_EMAILS=admin
+      - WORKSPACE_LIMIT_PER_USER=100
       - ACCOUNT_PORT=3003
       - SERVER_SECRET=secret
       - DB_URL=mongodb://huly.local:27018

Original file line number	Diff line number	Diff line change
`@@ -19,6 +19,7 @@`
`19`	`19`	`"AccountAlreadyConfirmed": "Účet již byl potvrzen",`
`20`	`20`	`"WorkspaceAlreadyExists": "Pracovní prostor již existuje",`
`21`	`21`	`"InvalidOtp": "Neplatný kód",`
`22`		`- "InviteNotFound": "Pozvánka s email:{email} nebyla nalezena."`
	`22`	`+ "InviteNotFound": "Pozvánka s email:{email} nebyla nalezena.",`
	`23`	`+ "WorkspaceLimitReached": "Dosáhli jste limitu pracovních prostorů. Kontaktujte nás..."`
`23`	`24`	`}`
`24`	`25`	`}`
Original file line number	Diff line number	Diff line change
`@@ -18,6 +18,7 @@`
`18`	`18`	`"AccountAlreadyConfirmed": "Account already confirmed",`
`19`	`19`	`"WorkspaceAlreadyExists": "Workspace already exists",`
`20`	`20`	`"InvalidOtp": "Invalid code",`
`21`		`- "InviteNotFound": "Invitation with email:{email} not found."`
	`21`	`+ "InviteNotFound": "Invitation with email:{email} not found.",`
	`22`	`+ "WorkspaceLimitReached": "You have reached the workspace limit. Please contact us..."`
`22`	`23`	`}`
`23`	`24`	`}`