bf4f964 · 276312d · 6fecffb · 43fadc4 · ccc656b · db81167
@@ -1126,7 +1126,7 @@
A forge admin sees every declared flag at `/settings/flags` (Settings → Flags)
Every limit the owner can hit is declared in `src/settings/limits.ts` with its default, bounds and reason, and changed live by a forge admin at `/admin/limits`, `PUT /api/v1/admin/limits/:key` or the `limits` MCP tool (never by an agent). Each change is kept with who made it.
Per-account quotas (`src/settings/quotas.ts`) — how many `repositories` and `apps` one account may own — are set the same way: **Account quotas** on `/admin/limits`, `GET`/`PATCH /api/v1/admin/settings` (`{"quotas": {"repositories": 5, "apps": null}}`) or the `quotas` MCP tool (dry by default, admin scope, never an agent). A value is a positive whole number, or empty/`null` for no limit, which is the default; anything else is a 422. Every change is kept with who made it and listed beside the form. The `apps` limit is enforced (`src/actions/app_limit.ts`): with one set, an account owning that many apps is refused one more, unless the actor is a forge admin; with none set nothing is asked. The check and the insert are separate statements, so two concurrent creates can pass by one. The refusal reads "This account is at its limit: 3 of 3 apps. Remove one to make room." and each door answers it its own way: the API (`POST /api/v1/apps` and `POST /api/v1/repos/:owner/:name/app`) a 403 `{"error": "app_limit", "message", "limit", "count"}`; the new-app page and the app settings form a 422 with the sentence on the form; make-it-yours the same sentence as an invalid error, before the fork, so no repository is left behind. The `repositories` limit is not enforced yet (#2093): no create path reads it.
Per-account quotas (`src/settings/quotas.ts`) — how many `repositories` and `apps` one account may own — are set the same way: **Account quotas** on `/admin/limits`, `GET`/`PATCH /api/v1/admin/settings` (`{"quotas": {"repositories": 5, "apps": null}}`) or the `quotas` MCP tool (dry by default, admin scope, never an agent). A value is a positive whole number, or empty/`null` for no limit, which is the default; anything else is a 422. Every change is kept with who made it and listed beside the form. The `apps` limit is enforced (`src/actions/app_limit.ts`): with one set, an account owning that many apps is refused one more, unless the actor is a forge admin; with none set nothing is asked. The check and the insert are separate statements, so two concurrent creates can pass by one. The refusal reads "This account is at its limit: 3 of 3 apps. Remove one to make room." and each door answers it its own way: the API (`POST /api/v1/apps` and `POST /api/v1/repos/:owner/:name/app`) a 403 `{"error": "app_limit", "message", "limit", "count"}`; the new-app page and the app settings form a 422 with the sentence on the form; make-it-yours the same sentence as an invalid error, before the fork, so no repository is left behind. The `repositories` limit is enforced too (`src/actions/repos.ts`): with one set, an account owning that many repositories (sealed forks are not counted) is refused one more by create, fork, make-it-yours, mirror, migrate and new app, before anything is made on disk. Forge admins and agents are exempt, and creating under an organisation is not counted: the quota is per account, so only a repository the actor owns itself is asked. The refusal reads "2 of 2 repositories"; the API answers 403 `{"error": "repository_limit", "message"}`, the pages say "Not made: 2 of 2 repositories." on the form (a 422), and the terminal shows it as a toast. The check and the insert are separate statements here as well, so two concurrent creates can pass by one.
## Choosing among variants
@@ -42,7 +42,7 @@
import { isActive, type User } from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { requireAppRoom, appLimitWords } from "./app_limit.ts";
import { enableApp } from "./apps.ts";
import { FORKS_PER_DAY, forkRepo } from "./repos.ts";
import { FORKS_PER_DAY, forkRepo, repositoryLimitMessage } from "./repos.ts";
export interface MakeItYoursPlan {
  readonly dryRun: boolean;
@@ -69,7 +69,9 @@
export type MakeItYoursError =
  | { readonly kind: "own" }
  /** Today's copies are made; another may be made from `resetsAt`. */
  | { readonly kind: "limit"; readonly resetsAt: string }
  | { readonly kind: "invalid"; readonly message: string };
  | { readonly kind: "invalid"; readonly message: string }
  /** The owner's repositories limit is reached: `message` says "10 of 10 repositories". */
  | { readonly kind: "repository_limit"; readonly message: string };
export const COPIED = ["the code", "its history"] as const;
export const NOT_COPIED = [
@@ -228,6 +230,8 @@
export async function makeItYours(
        });
      case "limit":
        return err({ kind: "limit", resetsAt: resetsAt(app, actor.id, now) });
      case "repository_limit":
        return err({ kind: "repository_limit", message: repositoryLimitMessage(app, actor) });
      default:
        return err({
          kind: "invalid",
@@ -170,7 +170,7 @@
export function migrationJobFor(
}
/** A refusal in words a person can act on. */
export function migrateMessage(error: MigrateError): string {
export function migrateMessage(error: MigrateError, limit = "at the repositories limit"): string {
  switch (error) {
    case "invalid_url":
      return "That is not a URL this forge will clone from. Paste an https:// (or http://, git://) address of a public repository, with no password in it.";
@@ -196,6 +196,8 @@
export function migrateMessage(error: MigrateError): string {
      return "Verify your email first: follow the link we sent, or ask for another under Settings.";
    case "refused":
      return "New accounts cannot create repositories yet.";
    case "repository_limit":
      return `Not made: ${limit}.`;
      
        sentinelcrew
        29d ago
        outdated
      
      The issue asks for the refusal to say "10 of 10 repositories". Show the sentence here as the other doors do.
    
  }
}
@@ -9,6 +9,7 @@
import type { App } from "../app.ts";
import { canSeeSealed } from "../core/sealed.ts";
import { capacityValue } from "../core/capacity.ts";
import { NEW_FOR_MS } from "./accounts.ts";
import { repositoryLimitSentence } from "../settings/quotas.ts";
import {
  createLabel as insertLabel,
  deleteLabel as removeLabel,
@@ -69,7 +70,27 @@
export type CreateRepoActionError =
  | CreateRepoError
  | "unauthorized"
  | "forbidden_owner"
  | "refused";
  | "refused"
  | "repository_limit";
/**
 * The repositories limit (#2093): when the owner has set one, an account at
 * it makes no more, by create, fork or copy. Admins and agents are not held
 * to it. Only a repository the account owns itself is counted and asked: creating
 * under an organisation is not, since the quota is per account. Returns the refusal sentence ("10 of 10 repositories") or nothing.
 */
export function repositoryLimitRefusal(app: App, user: User, ownerId = user.id): string | undefined {
  if (user.isAdmin || user.kind === "agent") return undefined;
  return repositoryLimitSentence(app.db, ownerId);
}
/**
 * The sentence for a refusal just given. Always words: if a repository went
 * between the refusal and now, it still says the limit was the reason.
 */
export function repositoryLimitMessage(app: App, user: User, ownerId = user.id): string {
  return repositoryLimitRefusal(app, user, ownerId) ?? "at the repositories limit";
}
/**
 * The new-account guard (`guard_new_accounts`): when it is on, an account
@@ -117,6 +138,8 @@
export async function createRepo(
  if (!guarded.ok) return guarded;
  const ownerId = resolveOwner(app, user.value, input.owner ?? "");
  if (ownerId === undefined) return err("forbidden_owner");
      
        sentinelcrew
        29d ago
        outdated
      
      The limit is only asked when the owner is the actor, so creating under an org is never counted. That is defensible, because the quota is per account, but write it down: in the doc comment above repositoryLimitRefusal and in the README.
    
  if (ownerId === user.value.id && repositoryLimitRefusal(app, user.value) !== undefined)
    return err("repository_limit");
  const created = await initRepo(app.db, app.reposRoot, {
    ownerId,
    name: input.name,
@@ -148,13 +171,14 @@
export async function forkRepo(
  parent: Repo,
  name?: string,
  options: { visibility?: "public" | "private"; now?: number } = {},
): Promise<Result<Repo, ForkRepoError | "not_found" | "unauthorized" | "unverified" | "refused">> {
): Promise<Result<Repo, ForkRepoError | "not_found" | "unauthorized" | "unverified" | "refused" | "repository_limit">> {
  const user = requireParticipant(app, actor, parent);
  if (!user.ok) return user;
  const proven = requireVerified(app, user.value);
  if (!proven.ok) return proven;
  const guarded = requireNewAccountGuard(app, user.value);
  if (!guarded.ok) return guarded;
  if (repositoryLimitRefusal(app, user.value) !== undefined) return err("repository_limit");
  const forked = await cloneRepo(
    app.db,
    app.reposRoot,
@@ -133,6 +133,7 @@
import {
  deleteWebhook,
  FORKS_PER_DAY,
  forkRepo,
  repositoryLimitMessage,
  privateRepoForSealed,
  updateRepoSettings,
} from "../actions/repos.ts";
@@ -1876,6 +1877,8 @@
export function apiRoutes(router: Router<Handler>): void {
    if (!created.ok) {
      if (created.error === "forbidden_owner")
        return json({ error: "forbidden_owner" }, 403);
      if (created.error === "repository_limit")
        return apiError("repository_limit", 403, repositoryLimitMessage(ctx.app, ctx.auth.user!));
      return respondAccess(created.error, 422);
    }
    return json(created.value, 201);
@@ -1986,7 +1989,9 @@
export function apiRoutes(router: Router<Handler>): void {
      str(input.name) || undefined,
    );
    if (!forked.ok)
      return forked.error === "limit"
      return forked.error === "repository_limit"
        ? apiError("repository_limit", 403, repositoryLimitMessage(ctx.app, ctx.auth.user!))
        : forked.error === "limit"
        ? apiError("limit", 429, `at most ${FORKS_PER_DAY} forks a day: try again tomorrow`)
        : respondAccess(forked.error, 422);
    return json(forked.value, 201);
@@ -4242,6 +4247,8 @@
export function apiRoutes(router: Router<Handler>): void {
            },
            429,
          )
        : made.error.kind === "repository_limit"
        ? apiError("repository_limit", 403, made.error.message)
        : made.error.kind === "invalid"
        ? apiError("invalid", 422, made.error.message)
        : made.error.kind === "own"
@@ -4371,6 +4378,8 @@
export function apiRoutes(router: Router<Handler>): void {
      ...(typeof input.agent === "string" ? { agent: input.agent } : {}),
    });
    if (!made.ok) {
      if (made.error === "repository_limit")
        return apiError("repository_limit", 403, repositoryLimitMessage(ctx.app, ctx.auth.user!));
      if (made.error === "app_limit")
        return appLimitResponse(
          ctx,
@@ -4445,7 +4454,7 @@
export function apiRoutes(router: Router<Handler>): void {
    if (!started.ok)
      return started.error === "unauthorized"
        ? respondAccess(started.error, 401)
        : apiError(started.error, 422, migrateMessage(started.error));
        : apiError(started.error, 422, migrateMessage(started.error, repositoryLimitMessage(ctx.app, ctx.auth.user!)));
      
        sentinelcrew
        29d ago
        
      
      Here repository_limit comes back as a 422 whose message is "Not made: 2 of 2 repositories.". Every other API door answers 403 with the message "2 of 2 repositories", and so does the README. Follow-up: #2173.
    
    return json(
      {
        repo: repoJson(ctx, started.value.repo),
@@ -1396,6 +1396,8 @@
const TOOLS: readonly Tool[] = [
      if (!made.ok)
        return made.error.kind === "limit"
          ? bad("limit", `at most ${COPIES_PER_DAY} copies a day; another after ${made.error.resetsAt}`)
          : made.error.kind === "repository_limit"
          ? bad("repository_limit", made.error.message)
          : made.error.kind === "invalid"
          ? bad("invalid", made.error.message)
          : made.error.kind === "own"
@@ -25,6 +25,7 @@
import { repoDir } from "../git/repos.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { bustOrigin } from "../view/cache.ts";
import { providerForOrigin } from "./credential.ts";
import { repositoryLimitMessage, repositoryLimitRefusal } from "../actions/repos.ts";
import { redact, safeRemoteUrl } from "./credentials.ts";
import { adoptDefaultBranch, configureMirror } from "./git-mirror.ts";
import { advance, createJob, runningJob, type MirrorJob } from "./jobs.ts";
@@ -37,7 +38,8 @@
export type MirrorError =
  | "name_taken"
  | "already_mirrored"
  | "git_init_failed"
  | "unreachable";
  | "unreachable"
  | "repository_limit";
export interface MirrorResult {
  readonly repo: Repo;
@@ -119,6 +121,10 @@
export async function mirrorRepo(
  const chosen = availableName(app, actor.id, wanted, origin);
  if (chosen === undefined) return err("name_taken");
  // A mirror is a repository the account owns: the repositories limit asks
  // here as it does at create and fork (#2093).
  if (repositoryLimitRefusal(app, actor) !== undefined) return err("repository_limit");
  const created = await createRepo(app.db, app.reposRoot, {
    ownerId: actor.id,
    name: chosen,
@@ -228,7 +234,10 @@
export function startMirror(
        advance(job.id, {
          stage: "failed",
          detail: "",
          error: mirrorMessage(result.error),
          error:
            result.error === "repository_limit"
              ? `Not mirrored: ${repositoryLimitMessage(app, actor)}.`
              : mirrorMessage(result.error),
        });
        return;
      }
@@ -284,6 +293,8 @@
export function mirrorMessage(error: MirrorError): string {
      return "the local repository could not be created";
    case "unreachable":
      return "the origin could not be reached";
    case "repository_limit":
      return "this account is at the forge's repositories limit";
  }
}
@@ -3,8 +3,8 @@
 * `forge_setting` under `quota.<key>`, and every change is kept in
 * `forge_setting_change` (who, when, from what to what). The default for
 * each is no limit (`null`), and creating an app asks the apps limit
 * (`actions/app_limit.ts`); repositories are not enforced yet. Room for more
 * keys is the `QUOTA_KEYS` list.
 * (`actions/app_limit.ts`); creating, forking and copying a repository ask the
      
        sentinelcrew
        29d ago
        
      
      This header now says the limit is enforced, but README.md:1129 still says "not enforced yet: no create path reads it". Update the README paragraph in this pull so the two agree.
    
 * repositories limit first (`actions/repos.ts`). Room for more keys is the `QUOTA_KEYS` list.
 */
import type { Database } from "bun:sqlite";
@@ -49,6 +49,25 @@
export function getQuotas(db: Database): Quotas {
  return { repositories: getQuota(db, "repositories"), apps: getQuota(db, "apps") };
}
/** Repositories an account owns, a sealed fork (nobody's to count) aside. */
export function repositoriesOwned(db: Database, ownerId: string): number {
  return (
    db
      .query<{ n: number }, [string]>(
        "SELECT count(*) AS n FROM repo WHERE owner_id = ?1 AND sealed_for IS NULL",
      )
      .get(ownerId)?.n ?? 0
  );
}
/** The sentence a refused creation says, or nothing when there is room. */
export function repositoryLimitSentence(db: Database, ownerId: string): string | undefined {
  const limit = getQuota(db, "repositories");
  if (limit === null) return undefined;
  const owned = repositoriesOwned(db, ownerId);
  return owned >= limit ? `${owned} of ${limit} repositories` : undefined;
}
/** Set `key` (`null` clears it) and keep the change. */
export function setQuota(
  db: Database,
@@ -3,7 +3,7 @@
 * because the next thing anyone does is look at it.
 */
import { createRepo, forkRepo } from "../../actions/repos.ts";
import { createRepo, forkRepo, repositoryLimitMessage } from "../../actions/repos.ts";
import { listOrgsForUser } from "../../core/orgs.ts";
import type { Repo } from "../../core/repos.ts";
import type { Ctx, Screen } from "../app/app.ts";
@@ -42,7 +42,10 @@
export function newRepoScreen(f: Session, ctx: Ctx, owner?: string): Screen {
        visibility,
      });
      if (!created.ok) {
        error = errorText(created.error);
        error =
          created.error === "repository_limit"
            ? `not made: ${repositoryLimitMessage(f.app, f.user!)}`
            : errorText(created.error);
        ctx.toast(error, "danger");
        return;
      }
@@ -154,7 +157,10 @@
export function forkScreen(f: Session, ctx: Ctx, parent: Repo): Screen {
    runAsync(ctx, async () => {
      const forked = await forkRepo(f.app, f.user, parent, name);
      if (!forked.ok) {
        error = errorText(forked.error);
        error =
          forked.error === "repository_limit"
            ? `not made: ${repositoryLimitMessage(f.app, f.user!)}`
            : errorText(forked.error);
        ctx.toast(error, "danger");
        return;
      }
@@ -12,6 +12,7 @@
 * 404 for everyone.
 */
import { repositoryLimitMessage } from "../../actions/repos.ts";
import { appLimitWords } from "../../actions/app_limit.ts";
import { getUserByName } from "../../core/users.ts";
import {
@@ -419,7 +420,9 @@
export async function newAppSubmit(ctx: Ctx): Promise<Response> {
        body: newAppForm(
          ctx,
          values,
          made.error === "app_limit" && ownerId !== undefined
          made.error === "repository_limit"
            ? `Not made: ${repositoryLimitMessage(ctx.app, ctx.auth.user!)}.`
            : made.error === "app_limit" && ownerId !== undefined
            ? appLimitWords(ctx.app, ownerId)
            : (NEW_APP_ERRORS[made.error] ?? "That app could not be created."),
        ),
@@ -7,6 +7,7 @@
 * Every mutation is `migrateRepo`; the page only puts its answer into words.
 */
import { repositoryLimitMessage } from "../../actions/repos.ts";
import { listAllAgents } from "../../actions/crew.ts";
import {
  migrateMessage,
@@ -354,7 +355,9 @@
export async function migrateSubmit(ctx: Ctx): Promise<Response> {
  if (!started.ok) {
    if (started.error === "forbidden_owner" || started.error === "unauthorized")
      return new Response("forbidden", { status: 403 });
    return again(migrateMessage(started.error));
    return again(
      migrateMessage(started.error, repositoryLimitMessage(ctx.app, ctx.auth.user!)),
    );
  }
  return redirect(`/migrate/jobs/${started.value.job.id}`);
}
@@ -9,7 +9,7 @@
 */
import { canRead, listForks, type Repo } from "../../core/repos.ts";
import { FORKS_PER_DAY, forkRepo } from "../../actions/repos.ts";
import { FORKS_PER_DAY, forkRepo, repositoryLimitMessage } from "../../actions/repos.ts";
import { forkDrift, takeUpdates, type ForkDrift } from "../../actions/forks.ts";
import { lineageOf } from "../../core/following.ts";
import {
@@ -195,6 +195,8 @@
export async function forkSubmit(ctx: Ctx): Promise<Response> {
    const reason =
      forked.error === "name_taken"
        ? "You already have a repository by that name."
        : forked.error === "repository_limit"
        ? `Not made: ${repositoryLimitMessage(ctx.app, ctx.auth.user)}.`
        : forked.error === "limit"
          ? `That is today's forks made (${FORKS_PER_DAY} a day). Try again tomorrow.`
          : "That fork could not be created.";
@@ -13,7 +13,7 @@
import { signOutHere } from "../../actions/signins.ts";
import { clientAddress } from "../../http/peer.ts";
import { verifyEmail } from "../../actions/verify.ts";
import { STRANGER_MAX } from "../../http/limits.ts";
import { createRepo } from "../../actions/repos.ts";
import { createRepo, repositoryLimitMessage } from "../../actions/repos.ts";
import { HUMAN_CHECK_MESSAGE, PASSKEY_REQUIRED_MESSAGE, signUp } from "../../actions/users.ts";
import { accessAllows, listOrgsForUser, orgAccess } from "../../core/orgs.ts";
import { listPins } from "../../core/pins.ts";
@@ -689,6 +689,7 @@
export async function newRepoSubmit(ctx: Ctx): Promise<Response> {
    if (created.error === "forbidden_owner" || created.error === "unauthorized")
      return new Response("forbidden", { status: 403 });
    const messages: Record<string, string> = {
      repository_limit: `Not made: ${repositoryLimitMessage(ctx.app, ctx.auth.user)}.`,
      name_taken: "That owner already has a repository by that name.",
      invalid_name: "Names start with a letter or digit; no spaces, no .git.",
      git_init_failed: "The repository could not be initialised on disk.",
@@ -128,6 +128,8 @@
export async function makeItYoursSubmit(ctx: Ctx): Promise<Response> {
    const message = !made.ok
      ? made.error.kind === "invalid"
        ? made.error.message
        : made.error.kind === "repository_limit"
          ? `Not made: ${made.error.message}.`
        : made.error.kind === "own"
          ? "This app is already yours."
          : made.error.kind === "unverified"
@@ -9,15 +9,22 @@
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { newApp } from "../src/actions/apps.ts";
import { createAgent } from "../src/actions/crew.ts";
import { makeItYours } from "../src/actions/make_it_yours.ts";
import { createRepo, forkRepo } from "../src/actions/repos.ts";
import { getRepo } from "../src/core/repos.ts";
import { mirrorAndWait, newFakeState, serveFakeForge } from "./fake-origin.ts";
import { proveAll } from "./helpers/verified.ts";
import { getQuotas, quotaChanges } from "../src/settings/quotas.ts";
import { createToken } from "../src/core/tokens.ts";
import { newApp } from "../src/actions/apps.ts";
import { createRepo } from "../src/actions/repos.ts";
import { makeItYours } from "../src/actions/make_it_yours.ts";
import { getRepo } from "../src/core/repos.ts";
import { createSession } from "../src/core/sessions.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { createForgeApp } from "../src/tui/forge.ts";
import { newRepoScreen } from "../src/tui/screens/newrepo.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { settleApp } from "./helpers/tui.ts";
describe("quotas", () => {
  let dataDir: string;
@@ -317,3 +324,172 @@
describe("quotas", () => {
    }
      
        sentinelcrew
        29d ago
        outdated
      
      These tests cover the action and the JSON API. They don't cover the HTML forms (site.ts newRepoSubmit, repo.ts forkSubmit, apps.ts, migrate.ts, studio make-it-yours) or the TUI screens. Add at least one form POST that expects "Not made: 2 of 2 repositories." and one TUI screen test, so both doors are proven.
    
  });
});
describe("the repositories limit", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let admin: string;
  let fresh: string;
  let freshUser: User;
  let boss: User;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-quotas-limit-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    const users: User[] = [];
    for (const username of ["boss", "fresh"]) {
      const made = await createUser(app.db, {
        trusted: true,
        username,
        email: `${username}@forge.local`,
        password: "a-good-passphrase",
        adminIfFirst: username === "boss",
      });
      if (!made.ok) throw new Error(made.error);
      users.push(made.value);
    }
    freshUser = users[1]!;
    boss = users[0]!;
    admin = createToken(app.db, users[0]!.id, "t", "admin").token;
    fresh = createToken(app.db, freshUser.id, "t", "rw").token;
  });
  afterAll(async () => {
    await servers.stop();
    await rm(dataDir, { recursive: true, force: true });
  });
  const post = (token: string, path: string, body: unknown) =>
    fetch(`${servers.url}${path}`, {
      method: "POST",
      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
      body: JSON.stringify(body),
    });
  const setLimit = (value: number | null) =>
    fetch(`${servers.url}/api/v1/admin/settings`, {
      method: "PATCH",
      headers: { authorization: `Bearer ${admin}`, "content-type": "application/json" },
      body: JSON.stringify({ quotas: { repositories: value } }),
    });
  test("past the limit create and fork are refused with the sentence; admins and no limit are free", async () => {
    // No limit: nothing changes.
    expect((await post(admin, "/api/v1/repos", { name: "base", visibility: "public" })).status).toBe(201);
    expect((await setLimit(2)).status).toBe(200);
    for (const name of ["one", "two"])
      expect((await post(fresh, "/api/v1/repos", { name })).status).toBe(201);
    const third = await post(fresh, "/api/v1/repos", { name: "three" });
    expect(third.status).toBe(403);
    expect(await third.json()).toMatchObject({
      error: "repository_limit",
      message: "2 of 2 repositories",
    });
    const fork = await post(fresh, "/api/v1/repos/boss/base/forks", {});
    expect(fork.status).toBe(403);
    expect(((await fork.json()) as any).message).toBe("2 of 2 repositories");
    // The owner (an admin) is never limited.
    for (const name of ["a", "b", "c"])
      expect((await post(admin, "/api/v1/repos", { name })).status).toBe(201);
    // Clearing the limit lets the fresh account make one more.
    expect((await setLimit(null)).status).toBe(200);
    expect((await post(fresh, "/api/v1/repos", { name: "three" })).status).toBe(201);
  });
  test("a copy and a mirror say the sentence; an agent is not held to it", async () => {
    // alice's public app, owned by the admin, for the copy.
    const made = await newApp(app, boss, { name: "garden", visibility: "public" });
    if (!made.ok) throw new Error(String(made.error));
    expect((await setLimit(2)).status).toBe(200);
    // fresh owns three here, so it is over the line.
    const copy = await makeItYours(app, freshUser, made.value.repo, { dryRun: false });
    expect(copy.ok).toBe(false);
    if (!copy.ok) expect(copy.error).toEqual({ kind: "repository_limit", message: "3 of 2 repositories" });
    const viaApi = await post(fresh, "/api/v1/repos/boss/garden/make-it-yours", { dryRun: false });
    expect(viaApi.status).toBe(403);
    expect(((await viaApi.json()) as any).message).toBe("3 of 2 repositories");
    // A mirror is a repository too.
    const state = newFakeState("forgejo", "someone", "tok");
    state.repos.push({
      id: 1,
      fullName: "someone/gears",
      cloneUrl: "http://127.0.0.1:1/someone/gears.git",
      defaultBranch: "main",
    });
    const fake = serveFakeForge(state);
    try {
      proveAll(app);
      const freshAdmin = createToken(app.db, freshUser.id, "o", "admin").token;
      const connected = await post(freshAdmin, "/api/v1/user/origins", { host: fake.url, token: "tok" });
      expect(connected.status).toBe(201);
      const originId = ((await connected.json()) as { id: string }).id;
      const job = await mirrorAndWait(
        await post(freshAdmin, `/api/v1/user/origins/${originId}/mirror`, { fullName: "someone/gears" }),
      );
      expect(job?.stage).toBe("failed");
      expect(job?.error).toBe("Not mirrored: 3 of 2 repositories.");
    } finally {
      fake.stop();
    }
    // An agent is held to nothing: it forks per issue to work.
    const agent = await createAgent(app, boss, { username: "worker" });
    if (!agent.ok) throw new Error(String(agent.error));
    const forked = await forkRepo(app, agent.value.user, getRepo(app.db, "boss", "garden")!);
    expect(forked.ok).toBe(true);
    expect((await setLimit(null)).status).toBe(200);
  });
  test("owning exactly the limit is refused with 'N of N'; the pages and the terminal say so too", async () => {
    const made = await createUser(app.db, {
      trusted: true,
      username: "exact",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!made.ok) throw new Error(made.error);
    const exact = made.value;
    expect((await setLimit(2)).status).toBe(200);
    for (const name of ["x1", "x2"]) expect((await createRepo(app, exact, { name })).ok).toBe(true);
    const refused = await createRepo(app, exact, { name: "x3" });
    expect(refused).toEqual({ ok: false, error: "repository_limit" });
    // The new-repository page: a 422 with the sentence on the form.
    const cookie = `forge_session=${createSession(app.db, exact.id).token}`;
    const form = await fetch(`${servers.url}/new`, {
      method: "POST",
      headers: { cookie, origin: servers.url },
      body: new URLSearchParams({ owner: "exact", name: "x3" }),
      redirect: "manual",
    });
    expect(form.status).toBe(422);
    expect(await form.text()).toContain("Not made: 2 of 2 repositories.");
    expect(getRepo(app.db, "exact", "x3")).toBeUndefined();
    // The terminal's new-repository screen: the same sentence, as a toast.
    const terminal = headlessTerminal(120, 30);
    const { app: tui, session } = createForgeApp(
      app,
      { sshUsername: "exact", remoteAddress: "127.0.0.1", fingerprint: "SHA256:exact", user: exact },
      { terminal, exitHooks: false },
    );
    tui.start();
    try {
      tui.ctx.push(newRepoScreen(session, tui.ctx));
      await settleApp(tui);
      for (const ch of "x3")
        tui.dispatch({ type: "key", key: ch, ctrl: false, alt: false, shift: false });
      tui.dispatch({ type: "key", key: "d", ctrl: true, alt: false, shift: false });
      await settleApp(tui);
      expect(tui.screen.toText()).toContain("not made: 2 of 2 repositories");
    } finally {
      tui.stop();
    }
    expect(getRepo(app.db, "exact", "x3")).toBeUndefined();
    expect((await setLimit(null)).status).toBe(200);
  });
});
		@@ -1126,7 +1126,7 @@ A forge admin sees every declared flag at `/settings/flags` (Settings → Flags)
1126	1126
1127	1127	Every limit the owner can hit is declared in `src/settings/limits.ts` with its default, bounds and reason, and changed live by a forge admin at `/admin/limits`, `PUT /api/v1/admin/limits/:key` or the `limits` MCP tool (never by an agent). Each change is kept with who made it.
1128	1128
1129		Per-account quotas (`src/settings/quotas.ts`) — how many `repositories` and `apps` one account may own — are set the same way: Account quotas on `/admin/limits`, `GET`/`PATCH /api/v1/admin/settings` (`{"quotas": {"repositories": 5, "apps": null}}`) or the `quotas` MCP tool (dry by default, admin scope, never an agent). A value is a positive whole number, or empty/`null` for no limit, which is the default; anything else is a 422. Every change is kept with who made it and listed beside the form. The `apps` limit is enforced (`src/actions/app_limit.ts`): with one set, an account owning that many apps is refused one more, unless the actor is a forge admin; with none set nothing is asked. The check and the insert are separate statements, so two concurrent creates can pass by one. The refusal reads "This account is at its limit: 3 of 3 apps. Remove one to make room." and each door answers it its own way: the API (`POST /api/v1/apps` and `POST /api/v1/repos/:owner/:name/app`) a 403 `{"error": "app_limit", "message", "limit", "count"}`; the new-app page and the app settings form a 422 with the sentence on the form; make-it-yours the same sentence as an invalid error, before the fork, so no repository is left behind. The `repositories` limit is not enforced yet (#2093): no create path reads it.
	1129	Per-account quotas (`src/settings/quotas.ts`) — how many `repositories` and `apps` one account may own — are set the same way: Account quotas on `/admin/limits`, `GET`/`PATCH /api/v1/admin/settings` (`{"quotas": {"repositories": 5, "apps": null}}`) or the `quotas` MCP tool (dry by default, admin scope, never an agent). A value is a positive whole number, or empty/`null` for no limit, which is the default; anything else is a 422. Every change is kept with who made it and listed beside the form. The `apps` limit is enforced (`src/actions/app_limit.ts`): with one set, an account owning that many apps is refused one more, unless the actor is a forge admin; with none set nothing is asked. The check and the insert are separate statements, so two concurrent creates can pass by one. The refusal reads "This account is at its limit: 3 of 3 apps. Remove one to make room." and each door answers it its own way: the API (`POST /api/v1/apps` and `POST /api/v1/repos/:owner/:name/app`) a 403 `{"error": "app_limit", "message", "limit", "count"}`; the new-app page and the app settings form a 422 with the sentence on the form; make-it-yours the same sentence as an invalid error, before the fork, so no repository is left behind. The `repositories` limit is enforced too (`src/actions/repos.ts`): with one set, an account owning that many repositories (sealed forks are not counted) is refused one more by create, fork, make-it-yours, mirror, migrate and new app, before anything is made on disk. Forge admins and agents are exempt, and creating under an organisation is not counted: the quota is per account, so only a repository the actor owns itself is asked. The refusal reads "2 of 2 repositories"; the API answers 403 `{"error": "repository_limit", "message"}`, the pages say "Not made: 2 of 2 repositories." on the form (a 422), and the terminal shows it as a toast. The check and the insert are separate statements here as well, so two concurrent creates can pass by one.
1130	1130
1131	1131	## Choosing among variants
1132	1132
		@@ -42,7 +42,7 @@ import { isActive, type User } from "../core/users.ts";
42	42	import { err, ok, type Result } from "../kernel/result.ts";
43	43	import { requireAppRoom, appLimitWords } from "./app_limit.ts";
44	44	import { enableApp } from "./apps.ts";
45		import { FORKS_PER_DAY, forkRepo } from "./repos.ts";
	45	import { FORKS_PER_DAY, forkRepo, repositoryLimitMessage } from "./repos.ts";
46	46
47	47	export interface MakeItYoursPlan {
48	48	readonly dryRun: boolean;
		@@ -69,7 +69,9 @@ export type MakeItYoursError =
69	69	\| { readonly kind: "own" }
70	70	/** Today's copies are made; another may be made from `resetsAt`. */
71	71	\| { readonly kind: "limit"; readonly resetsAt: string }
72		\| { readonly kind: "invalid"; readonly message: string };
	72	\| { readonly kind: "invalid"; readonly message: string }
	73	/** The owner's repositories limit is reached: `message` says "10 of 10 repositories". */
	74	\| { readonly kind: "repository_limit"; readonly message: string };
73	75
74	76	export const COPIED = ["the code", "its history"] as const;
75	77	export const NOT_COPIED = [
		@@ -228,6 +230,8 @@ export async function makeItYours(
228	230	});
229	231	case "limit":
230	232	return err({ kind: "limit", resetsAt: resetsAt(app, actor.id, now) });
	233	case "repository_limit":
	234	return err({ kind: "repository_limit", message: repositoryLimitMessage(app, actor) });
231	235	default:
232	236	return err({
233	237	kind: "invalid",
		@@ -170,7 +170,7 @@ export function migrationJobFor(
170	170	}
171	171
172	172	/** A refusal in words a person can act on. */
173		export function migrateMessage(error: MigrateError): string {
	173	export function migrateMessage(error: MigrateError, limit = "at the repositories limit"): string {
174	174	switch (error) {
175	175	case "invalid_url":
176	176	return "That is not a URL this forge will clone from. Paste an https:// (or http://, git://) address of a public repository, with no password in it.";
		@@ -196,6 +196,8 @@ export function migrateMessage(error: MigrateError): string {
196	196	return "Verify your email first: follow the link we sent, or ask for another under Settings.";
197	197	case "refused":
198	198	return "New accounts cannot create repositories yet.";
	199	case "repository_limit":
	200	return `Not made: ${limit}.`;
		sentinelcrew 29d ago outdated The issue asks for the refusal to say "10 of 10 repositories". Show the sentence here as the other doors do.
199	201	}
200	202	}
201	203
		@@ -9,6 +9,7 @@ import type { App } from "../app.ts";
9	9	import { canSeeSealed } from "../core/sealed.ts";
10	10	import { capacityValue } from "../core/capacity.ts";
11	11	import { NEW_FOR_MS } from "./accounts.ts";
	12	import { repositoryLimitSentence } from "../settings/quotas.ts";
12	13	import {
13	14	createLabel as insertLabel,
14	15	deleteLabel as removeLabel,
		@@ -69,7 +70,27 @@ export type CreateRepoActionError =
69	70	\| CreateRepoError
70	71	\| "unauthorized"
71	72	\| "forbidden_owner"
72		\| "refused";
	73	\| "refused"
	74	\| "repository_limit";
	75
	76	/**
	77	* The repositories limit (#2093): when the owner has set one, an account at
	78	* it makes no more, by create, fork or copy. Admins and agents are not held
	79	* to it. Only a repository the account owns itself is counted and asked: creating
	80	* under an organisation is not, since the quota is per account. Returns the refusal sentence ("10 of 10 repositories") or nothing.
	81	*/
	82	export function repositoryLimitRefusal(app: App, user: User, ownerId = user.id): string \| undefined {
	83	if (user.isAdmin \|\| user.kind === "agent") return undefined;
	84	return repositoryLimitSentence(app.db, ownerId);
	85	}
	86
	87	/**
	88	* The sentence for a refusal just given. Always words: if a repository went
	89	* between the refusal and now, it still says the limit was the reason.
	90	*/
	91	export function repositoryLimitMessage(app: App, user: User, ownerId = user.id): string {
	92	return repositoryLimitRefusal(app, user, ownerId) ?? "at the repositories limit";
	93	}
73	94
74	95	/**
75	96	* The new-account guard (`guard_new_accounts`): when it is on, an account
		@@ -117,6 +138,8 @@ export async function createRepo(
117	138	if (!guarded.ok) return guarded;
118	139	const ownerId = resolveOwner(app, user.value, input.owner ?? "");
119	140	if (ownerId === undefined) return err("forbidden_owner");
		sentinelcrew 29d ago outdated The limit is only asked when the owner is the actor, so creating under an org is never counted. That is defensible, because the quota is per account, but write it down: in the doc comment above `repositoryLimitRefusal` and in the README.
	141	if (ownerId === user.value.id && repositoryLimitRefusal(app, user.value) !== undefined)
	142	return err("repository_limit");
120	143	const created = await initRepo(app.db, app.reposRoot, {
121	144	ownerId,
122	145	name: input.name,
		@@ -148,13 +171,14 @@ export async function forkRepo(
148	171	parent: Repo,
149	172	name?: string,
150	173	options: { visibility?: "public" \| "private"; now?: number } = {},
151		): Promise<Result<Repo, ForkRepoError \| "not_found" \| "unauthorized" \| "unverified" \| "refused">> {
	174	): Promise<Result<Repo, ForkRepoError \| "not_found" \| "unauthorized" \| "unverified" \| "refused" \| "repository_limit">> {
152	175	const user = requireParticipant(app, actor, parent);
153	176	if (!user.ok) return user;
154	177	const proven = requireVerified(app, user.value);
155	178	if (!proven.ok) return proven;
156	179	const guarded = requireNewAccountGuard(app, user.value);
157	180	if (!guarded.ok) return guarded;
	181	if (repositoryLimitRefusal(app, user.value) !== undefined) return err("repository_limit");
158	182	const forked = await cloneRepo(
159	183	app.db,
160	184	app.reposRoot,
		@@ -133,6 +133,7 @@ import {
133	133	deleteWebhook,
134	134	FORKS_PER_DAY,
135	135	forkRepo,
	136	repositoryLimitMessage,
136	137	privateRepoForSealed,
137	138	updateRepoSettings,
138	139	} from "../actions/repos.ts";
		@@ -1876,6 +1877,8 @@ export function apiRoutes(router: Router<Handler>): void {
1876	1877	if (!created.ok) {
1877	1878	if (created.error === "forbidden_owner")
1878	1879	return json({ error: "forbidden_owner" }, 403);
	1880	if (created.error === "repository_limit")
	1881	return apiError("repository_limit", 403, repositoryLimitMessage(ctx.app, ctx.auth.user!));
1879	1882	return respondAccess(created.error, 422);
1880	1883	}
1881	1884	return json(created.value, 201);
		@@ -1986,7 +1989,9 @@ export function apiRoutes(router: Router<Handler>): void {
1986	1989	str(input.name) \|\| undefined,
1987	1990	);
1988	1991	if (!forked.ok)
1989		return forked.error === "limit"
	1992	return forked.error === "repository_limit"
	1993	? apiError("repository_limit", 403, repositoryLimitMessage(ctx.app, ctx.auth.user!))
	1994	: forked.error === "limit"
1990	1995	? apiError("limit", 429, `at most ${FORKS_PER_DAY} forks a day: try again tomorrow`)
1991	1996	: respondAccess(forked.error, 422);
1992	1997	return json(forked.value, 201);
		@@ -4242,6 +4247,8 @@ export function apiRoutes(router: Router<Handler>): void {
4242	4247	},
4243	4248	429,
4244	4249	)
	4250	: made.error.kind === "repository_limit"
	4251	? apiError("repository_limit", 403, made.error.message)
4245	4252	: made.error.kind === "invalid"
4246	4253	? apiError("invalid", 422, made.error.message)
4247	4254	: made.error.kind === "own"
		@@ -4371,6 +4378,8 @@ export function apiRoutes(router: Router<Handler>): void {
4371	4378	...(typeof input.agent === "string" ? { agent: input.agent } : {}),
4372	4379	});
4373	4380	if (!made.ok) {
	4381	if (made.error === "repository_limit")
	4382	return apiError("repository_limit", 403, repositoryLimitMessage(ctx.app, ctx.auth.user!));
4374	4383	if (made.error === "app_limit")
4375	4384	return appLimitResponse(
4376	4385	ctx,
		@@ -4445,7 +4454,7 @@ export function apiRoutes(router: Router<Handler>): void {
4445	4454	if (!started.ok)
4446	4455	return started.error === "unauthorized"
4447	4456	? respondAccess(started.error, 401)
4448		: apiError(started.error, 422, migrateMessage(started.error));
	4457	: apiError(started.error, 422, migrateMessage(started.error, repositoryLimitMessage(ctx.app, ctx.auth.user!)));
		sentinelcrew 29d ago Here `repository_limit` comes back as a 422 whose message is "Not made: 2 of 2 repositories.". Every other API door answers 403 with the message "2 of 2 repositories", and so does the README. Follow-up: #2173.
4449	4458	return json(
4450	4459	{
4451	4460	repo: repoJson(ctx, started.value.repo),
		@@ -1396,6 +1396,8 @@ const TOOLS: readonly Tool[] = [
1396	1396	if (!made.ok)
1397	1397	return made.error.kind === "limit"
1398	1398	? bad("limit", `at most ${COPIES_PER_DAY} copies a day; another after ${made.error.resetsAt}`)
	1399	: made.error.kind === "repository_limit"
	1400	? bad("repository_limit", made.error.message)
1399	1401	: made.error.kind === "invalid"
1400	1402	? bad("invalid", made.error.message)
1401	1403	: made.error.kind === "own"
		@@ -25,6 +25,7 @@ import { repoDir } from "../git/repos.ts";
25	25	import { err, ok, type Result } from "../kernel/result.ts";
26	26	import { bustOrigin } from "../view/cache.ts";
27	27	import { providerForOrigin } from "./credential.ts";
	28	import { repositoryLimitMessage, repositoryLimitRefusal } from "../actions/repos.ts";
28	29	import { redact, safeRemoteUrl } from "./credentials.ts";
29	30	import { adoptDefaultBranch, configureMirror } from "./git-mirror.ts";
30	31	import { advance, createJob, runningJob, type MirrorJob } from "./jobs.ts";
		@@ -37,7 +38,8 @@ export type MirrorError =
37	38	\| "name_taken"
38	39	\| "already_mirrored"
39	40	\| "git_init_failed"
40		\| "unreachable";
	41	\| "unreachable"
	42	\| "repository_limit";
41	43
42	44	export interface MirrorResult {
43	45	readonly repo: Repo;
		@@ -119,6 +121,10 @@ export async function mirrorRepo(
119	121	const chosen = availableName(app, actor.id, wanted, origin);
120	122	if (chosen === undefined) return err("name_taken");
121	123
	124	// A mirror is a repository the account owns: the repositories limit asks
	125	// here as it does at create and fork (#2093).
	126	if (repositoryLimitRefusal(app, actor) !== undefined) return err("repository_limit");
	127
122	128	const created = await createRepo(app.db, app.reposRoot, {
123	129	ownerId: actor.id,
124	130	name: chosen,
		@@ -228,7 +234,10 @@ export function startMirror(
228	234	advance(job.id, {
229	235	stage: "failed",
230	236	detail: "",
231		error: mirrorMessage(result.error),
	237	error:
	238	result.error === "repository_limit"
	239	? `Not mirrored: ${repositoryLimitMessage(app, actor)}.`
	240	: mirrorMessage(result.error),
232	241	});
233	242	return;
234	243	}
		@@ -284,6 +293,8 @@ export function mirrorMessage(error: MirrorError): string {
284	293	return "the local repository could not be created";
285	294	case "unreachable":
286	295	return "the origin could not be reached";
	296	case "repository_limit":
	297	return "this account is at the forge's repositories limit";
287	298	}
288	299	}
289	300
		@@ -3,8 +3,8 @@
3	3	* `forge_setting` under `quota.<key>`, and every change is kept in
4	4	* `forge_setting_change` (who, when, from what to what). The default for
5	5	* each is no limit (`null`), and creating an app asks the apps limit
6		* (`actions/app_limit.ts`); repositories are not enforced yet. Room for more
7		* keys is the `QUOTA_KEYS` list.
	6	* (`actions/app_limit.ts`); creating, forking and copying a repository ask the
		sentinelcrew 29d ago This header now says the limit is enforced, but README.md:1129 still says "not enforced yet: no create path reads it". Update the README paragraph in this pull so the two agree.
	7	* repositories limit first (`actions/repos.ts`). Room for more keys is the `QUOTA_KEYS` list.
8	8	*/
9	9
10	10	import type { Database } from "bun:sqlite";
		@@ -49,6 +49,25 @@ export function getQuotas(db: Database): Quotas {
49	49	return { repositories: getQuota(db, "repositories"), apps: getQuota(db, "apps") };
50	50	}
51	51
	52	/** Repositories an account owns, a sealed fork (nobody's to count) aside. */
	53	export function repositoriesOwned(db: Database, ownerId: string): number {
	54	return (
	55	db
	56	.query<{ n: number }, [string]>(
	57	"SELECT count(*) AS n FROM repo WHERE owner_id = ?1 AND sealed_for IS NULL",
	58	)
	59	.get(ownerId)?.n ?? 0
	60	);
	61	}
	62
	63	/** The sentence a refused creation says, or nothing when there is room. */
	64	export function repositoryLimitSentence(db: Database, ownerId: string): string \| undefined {
	65	const limit = getQuota(db, "repositories");
	66	if (limit === null) return undefined;
	67	const owned = repositoriesOwned(db, ownerId);
	68	return owned >= limit ? `${owned} of ${limit} repositories` : undefined;
	69	}
	70
52	71	/** Set `key` (`null` clears it) and keep the change. */
53	72	export function setQuota(
54	73	db: Database,
		@@ -3,7 +3,7 @@
3	3	* because the next thing anyone does is look at it.
4	4	*/
5	5
6		import { createRepo, forkRepo } from "../../actions/repos.ts";
	6	import { createRepo, forkRepo, repositoryLimitMessage } from "../../actions/repos.ts";
7	7	import { listOrgsForUser } from "../../core/orgs.ts";
8	8	import type { Repo } from "../../core/repos.ts";
9	9	import type { Ctx, Screen } from "../app/app.ts";
		@@ -42,7 +42,10 @@ export function newRepoScreen(f: Session, ctx: Ctx, owner?: string): Screen {
42	42	visibility,
43	43	});
44	44	if (!created.ok) {
45		error = errorText(created.error);
	45	error =
	46	created.error === "repository_limit"
	47	? `not made: ${repositoryLimitMessage(f.app, f.user!)}`
	48	: errorText(created.error);
46	49	ctx.toast(error, "danger");
47	50	return;
48	51	}
		@@ -154,7 +157,10 @@ export function forkScreen(f: Session, ctx: Ctx, parent: Repo): Screen {
154	157	runAsync(ctx, async () => {
155	158	const forked = await forkRepo(f.app, f.user, parent, name);
156	159	if (!forked.ok) {
157		error = errorText(forked.error);
	160	error =
	161	forked.error === "repository_limit"
	162	? `not made: ${repositoryLimitMessage(f.app, f.user!)}`
	163	: errorText(forked.error);
158	164	ctx.toast(error, "danger");
159	165	return;
160	166	}
		@@ -12,6 +12,7 @@
12	12	* 404 for everyone.
13	13	*/
14	14
	15	import { repositoryLimitMessage } from "../../actions/repos.ts";
15	16	import { appLimitWords } from "../../actions/app_limit.ts";
16	17	import { getUserByName } from "../../core/users.ts";
17	18	import {
		@@ -419,7 +420,9 @@ export async function newAppSubmit(ctx: Ctx): Promise<Response> {
419	420	body: newAppForm(
420	421	ctx,
421	422	values,
422		made.error === "app_limit" && ownerId !== undefined
	423	made.error === "repository_limit"
	424	? `Not made: ${repositoryLimitMessage(ctx.app, ctx.auth.user!)}.`
	425	: made.error === "app_limit" && ownerId !== undefined
423	426	? appLimitWords(ctx.app, ownerId)
424	427	: (NEW_APP_ERRORS[made.error] ?? "That app could not be created."),
425	428	),