Skip to content

feat(relay): limit managed tunnels per user#4530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
juliusmarminge merged 3 commits into from
Jul 27, 2026
Merged

feat(relay): limit managed tunnels per user #4530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
be658ec
feat(relay): limit managed tunnels per user
juliusmarminge Jul 25, 2026
aa658ab
fix(relay): address Effect convention review findings
juliusmarminge Jul 25, 2026
99bcad7
feat(relay): lower default managed tunnel limit to 3
juliusmarminge Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions apps/mobile/src/features/cloud/linkEnvironment.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -143,6 +143,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
return `Relay could not link the environment (${error.reason}).`;
case "RelayEnvironmentLinkUnavailableError":
return `Relay cannot provision the managed endpoint (${error.reason}).`;
case "RelayEnvironmentLinkLimitExceededError":
return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
case "RelayAgentActivityPublishProofExpiredError":
return "Relay rejected an expired agent activity publish proof.";
case "RelayAgentActivityPublishProofInvalidError":
Expand Down
2 changes: 2 additions & 0 deletions apps/web/src/cloud/linkEnvironment.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -154,6 +154,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
return `Relay could not link the environment (${error.reason}).`;
case "RelayEnvironmentLinkUnavailableError":
return `Relay cannot provision the managed endpoint (${error.reason}).`;
case "RelayEnvironmentLinkLimitExceededError":
return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
case "RelayAgentActivityPublishProofExpiredError":
return "Relay rejected an expired agent activity publish proof.";
case "RelayAgentActivityPublishProofInvalidError":
Expand Down
77 changes: 77 additions & 0 deletions infra/relay/src/environments/ManagedEndpointProvider.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ import * as Redacted from "effect/Redacted";
import * as RelayConfiguration from "../Config.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const config = RelayConfiguration.RelayConfiguration.of({
relayIssuer: "https://relay.example.test",
Expand DownExpand Up@@ -200,10 +201,24 @@ function makeAllocations(calls: AllocationCall[] = []) {
});
}

function makeTunnelLimits(
calls: Array<{ readonly userId: string; readonly environmentId: string }> = [],
result: ManagedTunnelLimits.ManagedTunnelLimitExceeded | null = null,
) {
return ManagedTunnelLimits.ManagedTunnelLimits.of({
ensureCapacity: (input) =>
Effect.suspend(() => {
calls.push(input);
return result === null ? Effect.void : Effect.fail(result);
}),
});
}

function providerLayer(
tunnelClient = makeTunnelClient(),
dnsClient = makeDnsClient(),
allocations = makeAllocations(),
tunnelLimits = makeTunnelLimits(),
) {
return ManagedEndpointProvider.layer.pipe(
Layer.provideMerge(NodeServices.layer),
Expand All@@ -213,6 +228,7 @@ function providerLayer(
Layer.provide(
Layer.succeed(ManagedEndpointAllocations.ManagedEndpointAllocations, allocations),
),
Layer.provide(Layer.succeed(ManagedTunnelLimits.ManagedTunnelLimits, tunnelLimits)),
);
}

Expand DownExpand Up@@ -311,6 +327,67 @@ describe("ManagedEndpointProvider", () => {
);
});

it.effect("checks the managed tunnel limit before reserving an allocation", () => {
const limitCalls: Array<{ readonly userId: string; readonly environmentId: string }> = [];

return Effect.gen(function* () {
const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
yield* provider.provision({
userId: "user_ABC",
environmentId: "env_ABC",
origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
});

expect(limitCalls).toEqual([{ userId: "user_ABC", environmentId: "env_ABC" }]);
}).pipe(
Effect.provide(
providerLayer(
makeTunnelClient(),
makeDnsClient(),
makeAllocations(),
makeTunnelLimits(limitCalls),
),
),
);
});

it.effect("refuses to provision past the managed tunnel limit without side effects", () => {
const tunnelCalls: TunnelCall[] = [];
const dnsCalls: DnsCall[] = [];
const allocationCalls: AllocationCall[] = [];
const exceeded = new ManagedTunnelLimits.ManagedTunnelLimitExceeded({
userId: "user_ABC",
environmentId: "env_ABC",
maxTunnels: 10,
activeTunnels: 10,
});

return Effect.gen(function* () {
const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
const error = yield* Effect.flip(
provider.provision({
userId: "user_ABC",
environmentId: "env_ABC",
origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
}),
);

expect(error).toBe(exceeded);
expect(tunnelCalls).toEqual([]);
expect(dnsCalls).toEqual([]);
expect(allocationCalls).toEqual([]);
}).pipe(
Effect.provide(
providerLayer(
makeTunnelClient(tunnelCalls),
makeDnsClient(dnsCalls),
makeAllocations(allocationCalls),
makeTunnelLimits([], exceeded),
),
),
);
});

it.effect("uses stage-scoped stable names without leaking unusual environment ids", () => {
const tunnelCalls: TunnelCall[] = [];

Expand Down
26 changes: 25 additions & 1 deletion infra/relay/src/environments/ManagedEndpointProvider.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -23,6 +23,7 @@ import {
managedEndpointTunnelName,
} from "../deploymentConfig.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedErrorClass<ManagedEndpointProvisioningNotConfigured>()(
"ManagedEndpointProvisioningNotConfigured",
Expand All@@ -41,6 +42,7 @@ export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedError

const ManagedEndpointProvisioningStage = Schema.Literals([
"derive-environment-hash",
"check-tunnel-limit",
"reserve-allocation",
"ensure-tunnel",
"validate-tunnel-response",
Expand DownExpand Up@@ -112,7 +114,8 @@ export class ManagedEndpointOriginNotAllowed extends Schema.TaggedErrorClass<Man
export type ManagedEndpointProviderError =
| ManagedEndpointProvisioningNotConfigured
| ManagedEndpointProvisioningFailed
| ManagedEndpointOriginNotAllowed;
| ManagedEndpointOriginNotAllowed
| ManagedTunnelLimits.ManagedTunnelLimitExceeded;

export interface ManagedEndpointProvisioningResult {
readonly endpoint: RelayManagedEndpoint;
Expand DownExpand Up@@ -331,6 +334,7 @@ export const make = Effect.gen(function* () {
const tunnels = yield* ManagedEndpointTunnelClient;
const dns = yield* ManagedEndpointDnsClient;
const allocations = yield* ManagedEndpointAllocations.ManagedEndpointAllocations;
const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;

const updateExistingDnsRecords = Effect.fnUntraced(function* (
records: ReadonlyArray<{ readonly id: string }>,
Expand DownExpand Up@@ -504,6 +508,26 @@ export const make = Effect.gen(function* () {
environmentHash,
);
const requestedTunnelName = managedEndpointTunnelName(cf.namespace, environmentHash);
yield* tunnelLimits
.ensureCapacity({
userId: input.userId,
environmentId: input.environmentId,
})
.pipe(
Effect.catchTags({
ManagedTunnelLimitPersistenceError: (cause) =>
Effect.fail(
new ManagedEndpointProvisioningFailed({
userId: input.userId,
environmentId: input.environmentId,
stage: "check-tunnel-limit",
hostname: requestedHostname,
tunnelName: requestedTunnelName,
cause,
}),
),
}),
);
const allocation = yield* allocations
.reserve({
userId: input.userId,
Expand Down
145 changes: 145 additions & 0 deletions infra/relay/src/environments/ManagedTunnelLimits.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";

import * as RelayDb from "../db.ts";
import {
relayManagedEndpointAllocations,
relayManagedTunnelLimits,
} from "../persistence/schema.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const layerWithDb = (db: RelayDb.RelayDb["Service"]) =>
ManagedTunnelLimits.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db)));

function makeFakeDb(input: {
readonly overrideRows?: Effect.Effect<ReadonlyArray<{ readonly maxTunnels: number }>, Error>;
readonly countRows?: Effect.Effect<ReadonlyArray<{ readonly activeTunnels: number }>, Error>;
}) {
return {
select: () => ({
from: (table: unknown) => {
if (table === relayManagedTunnelLimits) {
return {
where: () => ({
limit: () => input.overrideRows ?? Effect.succeed([]),
}),
};
}
expect(table).toBe(relayManagedEndpointAllocations);
return {
where: () => input.countRows ?? Effect.succeed([{ activeTunnels: 0 }]),
};
},
}),
} as unknown as RelayDb.RelayDb["Service"];
}

describe("ManagedTunnelLimits", () => {
it.effect("allows provisioning below the default limit", () => {
const fakeDb = makeFakeDb({
countRows: Effect.succeed([
{ activeTunnels: ManagedTunnelLimits.DEFAULT_MANAGED_TUNNEL_LIMIT - 1 },
]),
});

return Effect.gen(function* () {
const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
}).pipe(Effect.provide(layerWithDb(fakeDb)));
});

it.effect("rejects provisioning at the default limit of 3", () => {
const fakeDb = makeFakeDb({
countRows: Effect.succeed([{ activeTunnels: 3 }]),
});

return Effect.gen(function* () {
const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
const error = yield* Effect.flip(
limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
);

expect(error).toMatchObject({
_tag: "ManagedTunnelLimitExceeded",
userId: "user-1",
environmentId: "environment-1",
maxTunnels: 3,
activeTunnels: 3,
});
}).pipe(Effect.provide(layerWithDb(fakeDb)));
});

it.effect("honors a per-user override above the default", () => {
const fakeDb = makeFakeDb({
overrideRows: Effect.succeed([{ maxTunnels: 25 }]),
countRows: Effect.succeed([{ activeTunnels: 10 }]),
});

return Effect.gen(function* () {
const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
}).pipe(Effect.provide(layerWithDb(fakeDb)));
});

it.effect("honors a per-user override below the default", () => {
const fakeDb = makeFakeDb({
overrideRows: Effect.succeed([{ maxTunnels: 1 }]),
countRows: Effect.succeed([{ activeTunnels: 1 }]),
});

return Effect.gen(function* () {
const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
const error = yield* Effect.flip(
limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
);

expect(error).toMatchObject({
_tag: "ManagedTunnelLimitExceeded",
maxTunnels: 1,
activeTunnels: 1,
});
}).pipe(Effect.provide(layerWithDb(fakeDb)));
});

it.effect("retains database failures with operation and user identity", () => {
const cause = new Error("database unavailable");
const fakeDb = makeFakeDb({
overrideRows: Effect.fail(cause),
});

return Effect.gen(function* () {
const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
const error = yield* Effect.flip(
limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
);

expect(error).toMatchObject({
_tag: "ManagedTunnelLimitPersistenceError",
operation: "load-limit",
userId: "user-1",
});
expect(error).toHaveProperty("cause", cause);
}).pipe(Effect.provide(layerWithDb(fakeDb)));
});

it.effect("retains count failures with operation and user identity", () => {
const cause = new Error("database unavailable");
const fakeDb = makeFakeDb({
countRows: Effect.fail(cause),
});

return Effect.gen(function* () {
const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
const error = yield* Effect.flip(
limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
);

expect(error).toMatchObject({
_tag: "ManagedTunnelLimitPersistenceError",
operation: "count-tunnels",
userId: "user-1",
});
}).pipe(Effect.provide(layerWithDb(fakeDb)));
});
});
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
feat(relay): limit managed tunnels per user by juliusmarminge · Pull Request #4530 · pingdotgg/t3code · GitHub
Skip to content
feat(relay): limit managed tunnels per user#4530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

juliusmarminge
merged 3 commits into

from

Jul 27, 2026
 Merged


feat(relay): limit managed tunnels per user
#4530
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
be658ec

feat(relay): limit managed tunnels per user


juliusmarminge Jul 25, 2026
aa658ab

fix(relay): address Effect convention review findings


juliusmarminge Jul 25, 2026
99bcad7

feat(relay): lower default managed tunnel limit to 3


juliusmarminge Jul 27, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
apps/mobile/src/features/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,6 +143,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

2 changes: 2 additions & 0 deletions
apps/web/src/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -154,6 +154,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

77 changes: 77 additions & 0 deletions
infra/relay/src/environments/ManagedEndpointProvider.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ import * as Redacted from "effect/Redacted";
import * as RelayConfiguration from "../Config.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const config = RelayConfiguration.RelayConfiguration.of({
 relayIssuer: "https://relay.example.test",
Expand DownExpand Up@@ -200,10 +201,24 @@ function makeAllocations(calls: AllocationCall[] = []) {
 });
}

function makeTunnelLimits(
 calls: Array<{ readonly userId: string; readonly environmentId: string }> = [],
 result: ManagedTunnelLimits.ManagedTunnelLimitExceeded | null = null,
) {
 return ManagedTunnelLimits.ManagedTunnelLimits.of({
 ensureCapacity: (input) =>
 Effect.suspend(() => {
 calls.push(input);
 return result === null ? Effect.void : Effect.fail(result);
 }),
 });
}

function providerLayer(
 tunnelClient = makeTunnelClient(),
 dnsClient = makeDnsClient(),
 allocations = makeAllocations(),
 tunnelLimits = makeTunnelLimits(),
) {
 return ManagedEndpointProvider.layer.pipe(
 Layer.provideMerge(NodeServices.layer),
Expand All@@ -213,6 +228,7 @@ function providerLayer(
 Layer.provide(
 Layer.succeed(ManagedEndpointAllocations.ManagedEndpointAllocations, allocations),
 ),
 Layer.provide(Layer.succeed(ManagedTunnelLimits.ManagedTunnelLimits, tunnelLimits)),
 );
}

Expand DownExpand Up@@ -311,6 +327,67 @@ describe("ManagedEndpointProvider", () => {
 );
 });

 it.effect("checks the managed tunnel limit before reserving an allocation", () => {
 const limitCalls: Array<{ readonly userId: string; readonly environmentId: string }> = [];

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 yield* provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 });

 expect(limitCalls).toEqual([{ userId: "user_ABC", environmentId: "env_ABC" }]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(),
 makeDnsClient(),
 makeAllocations(),
 makeTunnelLimits(limitCalls),
 ),
 ),
 );
 });

 it.effect("refuses to provision past the managed tunnel limit without side effects", () => {
 const tunnelCalls: TunnelCall[] = [];
 const dnsCalls: DnsCall[] = [];
 const allocationCalls: AllocationCall[] = [];
 const exceeded = new ManagedTunnelLimits.ManagedTunnelLimitExceeded({
 userId: "user_ABC",
 environmentId: "env_ABC",
 maxTunnels: 10,
 activeTunnels: 10,
 });

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 const error = yield* Effect.flip(
 provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 }),
 );

 expect(error).toBe(exceeded);
 expect(tunnelCalls).toEqual([]);
 expect(dnsCalls).toEqual([]);
 expect(allocationCalls).toEqual([]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(tunnelCalls),
 makeDnsClient(dnsCalls),
 makeAllocations(allocationCalls),
 makeTunnelLimits([], exceeded),
 ),
 ),
 );
 });

 it.effect("uses stage-scoped stable names without leaking unusual environment ids", () => {
 const tunnelCalls: TunnelCall[] = [];

Expand Down

26 changes: 25 additions & 1 deletion
infra/relay/src/environments/ManagedEndpointProvider.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -23,6 +23,7 @@ import {
 managedEndpointTunnelName,
} from "../deploymentConfig.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedErrorClass<ManagedEndpointProvisioningNotConfigured>()(
 "ManagedEndpointProvisioningNotConfigured",
Expand All@@ -41,6 +42,7 @@ export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedError

const ManagedEndpointProvisioningStage = Schema.Literals([
 "derive-environment-hash",
 "check-tunnel-limit",
 "reserve-allocation",
 "ensure-tunnel",
 "validate-tunnel-response",
Expand DownExpand Up@@ -112,7 +114,8 @@ export class ManagedEndpointOriginNotAllowed extends Schema.TaggedErrorClass<Man
export type ManagedEndpointProviderError =
 | ManagedEndpointProvisioningNotConfigured
 | ManagedEndpointProvisioningFailed
 | ManagedEndpointOriginNotAllowed;
 | ManagedEndpointOriginNotAllowed
 | ManagedTunnelLimits.ManagedTunnelLimitExceeded;

export interface ManagedEndpointProvisioningResult {
 readonly endpoint: RelayManagedEndpoint;
Expand DownExpand Up@@ -331,6 +334,7 @@ export const make = Effect.gen(function* () {
 const tunnels = yield* ManagedEndpointTunnelClient;
 const dns = yield* ManagedEndpointDnsClient;
 const allocations = yield* ManagedEndpointAllocations.ManagedEndpointAllocations;
 const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;

 const updateExistingDnsRecords = Effect.fnUntraced(function* (
 records: ReadonlyArray<{ readonly id: string }>,
Expand DownExpand Up@@ -504,6 +508,26 @@ export const make = Effect.gen(function* () {
 environmentHash,
 );
 const requestedTunnelName = managedEndpointTunnelName(cf.namespace, environmentHash);
 yield* tunnelLimits
 .ensureCapacity({
 userId: input.userId,
 environmentId: input.environmentId,
 })
 .pipe(
 Effect.catchTags({
 ManagedTunnelLimitPersistenceError: (cause) =>
 Effect.fail(
 new ManagedEndpointProvisioningFailed({
 userId: input.userId,
 environmentId: input.environmentId,
 stage: "check-tunnel-limit",
 hostname: requestedHostname,
 tunnelName: requestedTunnelName,
 cause,
 }),
 ),
 }),
 );
 const allocation = yield* allocations
 .reserve({
 userId: input.userId,
Expand Down

145 changes: 145 additions & 0 deletions
infra/relay/src/environments/ManagedTunnelLimits.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";

import * as RelayDb from "../db.ts";
import {
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
} from "../persistence/schema.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const layerWithDb = (db: RelayDb.RelayDb["Service"]) =>
 ManagedTunnelLimits.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db)));

function makeFakeDb(input: {
 readonly overrideRows?: Effect.Effect<ReadonlyArray<{ readonly maxTunnels: number }>, Error>;
 readonly countRows?: Effect.Effect<ReadonlyArray<{ readonly activeTunnels: number }>, Error>;
}) {
 return {
 select: () => ({
 from: (table: unknown) => {
 if (table === relayManagedTunnelLimits) {
 return {
 where: () => ({
 limit: () => input.overrideRows ?? Effect.succeed([]),
 }),
 };
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return {
 where: () => input.countRows ?? Effect.succeed([{ activeTunnels: 0 }]),
 };
 },
 }),
 } as unknown as RelayDb.RelayDb["Service"];
}

describe("ManagedTunnelLimits", () => {
 it.effect("allows provisioning below the default limit", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([
 { activeTunnels: ManagedTunnelLimits.DEFAULT_MANAGED_TUNNEL_LIMIT - 1 },
 ]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("rejects provisioning at the default limit of 3", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([{ activeTunnels: 3 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 userId: "user-1",
 environmentId: "environment-1",
 maxTunnels: 3,
 activeTunnels: 3,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override above the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 25 }]),
 countRows: Effect.succeed([{ activeTunnels: 10 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override below the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 1 }]),
 countRows: Effect.succeed([{ activeTunnels: 1 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 maxTunnels: 1,
 activeTunnels: 1,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains database failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 overrideRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "load-limit",
 userId: "user-1",
 });
 expect(error).toHaveProperty("cause", cause);
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains count failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 countRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "count-tunnels",
 userId: "user-1",
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });
});
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(relay): limit managed tunnels per user by juliusmarminge · Pull Request #4530 · pingdotgg/t3code · GitHub
Skip to content
feat(relay): limit managed tunnels per user#4530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

juliusmarminge
merged 3 commits into

from

Jul 27, 2026
 Merged


feat(relay): limit managed tunnels per user
#4530
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
be658ec

feat(relay): limit managed tunnels per user


juliusmarminge Jul 25, 2026
aa658ab

fix(relay): address Effect convention review findings


juliusmarminge Jul 25, 2026
99bcad7

feat(relay): lower default managed tunnel limit to 3


juliusmarminge Jul 27, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
apps/mobile/src/features/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,6 +143,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

2 changes: 2 additions & 0 deletions
apps/web/src/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -154,6 +154,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

77 changes: 77 additions & 0 deletions
infra/relay/src/environments/ManagedEndpointProvider.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ import * as Redacted from "effect/Redacted";
import * as RelayConfiguration from "../Config.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const config = RelayConfiguration.RelayConfiguration.of({
 relayIssuer: "https://relay.example.test",
Expand DownExpand Up@@ -200,10 +201,24 @@ function makeAllocations(calls: AllocationCall[] = []) {
 });
}

function makeTunnelLimits(
 calls: Array<{ readonly userId: string; readonly environmentId: string }> = [],
 result: ManagedTunnelLimits.ManagedTunnelLimitExceeded | null = null,
) {
 return ManagedTunnelLimits.ManagedTunnelLimits.of({
 ensureCapacity: (input) =>
 Effect.suspend(() => {
 calls.push(input);
 return result === null ? Effect.void : Effect.fail(result);
 }),
 });
}

function providerLayer(
 tunnelClient = makeTunnelClient(),
 dnsClient = makeDnsClient(),
 allocations = makeAllocations(),
 tunnelLimits = makeTunnelLimits(),
) {
 return ManagedEndpointProvider.layer.pipe(
 Layer.provideMerge(NodeServices.layer),
Expand All@@ -213,6 +228,7 @@ function providerLayer(
 Layer.provide(
 Layer.succeed(ManagedEndpointAllocations.ManagedEndpointAllocations, allocations),
 ),
 Layer.provide(Layer.succeed(ManagedTunnelLimits.ManagedTunnelLimits, tunnelLimits)),
 );
}

Expand DownExpand Up@@ -311,6 +327,67 @@ describe("ManagedEndpointProvider", () => {
 );
 });

 it.effect("checks the managed tunnel limit before reserving an allocation", () => {
 const limitCalls: Array<{ readonly userId: string; readonly environmentId: string }> = [];

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 yield* provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 });

 expect(limitCalls).toEqual([{ userId: "user_ABC", environmentId: "env_ABC" }]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(),
 makeDnsClient(),
 makeAllocations(),
 makeTunnelLimits(limitCalls),
 ),
 ),
 );
 });

 it.effect("refuses to provision past the managed tunnel limit without side effects", () => {
 const tunnelCalls: TunnelCall[] = [];
 const dnsCalls: DnsCall[] = [];
 const allocationCalls: AllocationCall[] = [];
 const exceeded = new ManagedTunnelLimits.ManagedTunnelLimitExceeded({
 userId: "user_ABC",
 environmentId: "env_ABC",
 maxTunnels: 10,
 activeTunnels: 10,
 });

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 const error = yield* Effect.flip(
 provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 }),
 );

 expect(error).toBe(exceeded);
 expect(tunnelCalls).toEqual([]);
 expect(dnsCalls).toEqual([]);
 expect(allocationCalls).toEqual([]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(tunnelCalls),
 makeDnsClient(dnsCalls),
 makeAllocations(allocationCalls),
 makeTunnelLimits([], exceeded),
 ),
 ),
 );
 });

 it.effect("uses stage-scoped stable names without leaking unusual environment ids", () => {
 const tunnelCalls: TunnelCall[] = [];

Expand Down

26 changes: 25 additions & 1 deletion
infra/relay/src/environments/ManagedEndpointProvider.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -23,6 +23,7 @@ import {
 managedEndpointTunnelName,
} from "../deploymentConfig.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedErrorClass<ManagedEndpointProvisioningNotConfigured>()(
 "ManagedEndpointProvisioningNotConfigured",
Expand All@@ -41,6 +42,7 @@ export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedError

const ManagedEndpointProvisioningStage = Schema.Literals([
 "derive-environment-hash",
 "check-tunnel-limit",
 "reserve-allocation",
 "ensure-tunnel",
 "validate-tunnel-response",
Expand DownExpand Up@@ -112,7 +114,8 @@ export class ManagedEndpointOriginNotAllowed extends Schema.TaggedErrorClass<Man
export type ManagedEndpointProviderError =
 | ManagedEndpointProvisioningNotConfigured
 | ManagedEndpointProvisioningFailed
 | ManagedEndpointOriginNotAllowed;
 | ManagedEndpointOriginNotAllowed
 | ManagedTunnelLimits.ManagedTunnelLimitExceeded;

export interface ManagedEndpointProvisioningResult {
 readonly endpoint: RelayManagedEndpoint;
Expand DownExpand Up@@ -331,6 +334,7 @@ export const make = Effect.gen(function* () {
 const tunnels = yield* ManagedEndpointTunnelClient;
 const dns = yield* ManagedEndpointDnsClient;
 const allocations = yield* ManagedEndpointAllocations.ManagedEndpointAllocations;
 const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;

 const updateExistingDnsRecords = Effect.fnUntraced(function* (
 records: ReadonlyArray<{ readonly id: string }>,
Expand DownExpand Up@@ -504,6 +508,26 @@ export const make = Effect.gen(function* () {
 environmentHash,
 );
 const requestedTunnelName = managedEndpointTunnelName(cf.namespace, environmentHash);
 yield* tunnelLimits
 .ensureCapacity({
 userId: input.userId,
 environmentId: input.environmentId,
 })
 .pipe(
 Effect.catchTags({
 ManagedTunnelLimitPersistenceError: (cause) =>
 Effect.fail(
 new ManagedEndpointProvisioningFailed({
 userId: input.userId,
 environmentId: input.environmentId,
 stage: "check-tunnel-limit",
 hostname: requestedHostname,
 tunnelName: requestedTunnelName,
 cause,
 }),
 ),
 }),
 );
 const allocation = yield* allocations
 .reserve({
 userId: input.userId,
Expand Down

145 changes: 145 additions & 0 deletions
infra/relay/src/environments/ManagedTunnelLimits.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";

import * as RelayDb from "../db.ts";
import {
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
} from "../persistence/schema.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const layerWithDb = (db: RelayDb.RelayDb["Service"]) =>
 ManagedTunnelLimits.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db)));

function makeFakeDb(input: {
 readonly overrideRows?: Effect.Effect<ReadonlyArray<{ readonly maxTunnels: number }>, Error>;
 readonly countRows?: Effect.Effect<ReadonlyArray<{ readonly activeTunnels: number }>, Error>;
}) {
 return {
 select: () => ({
 from: (table: unknown) => {
 if (table === relayManagedTunnelLimits) {
 return {
 where: () => ({
 limit: () => input.overrideRows ?? Effect.succeed([]),
 }),
 };
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return {
 where: () => input.countRows ?? Effect.succeed([{ activeTunnels: 0 }]),
 };
 },
 }),
 } as unknown as RelayDb.RelayDb["Service"];
}

describe("ManagedTunnelLimits", () => {
 it.effect("allows provisioning below the default limit", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([
 { activeTunnels: ManagedTunnelLimits.DEFAULT_MANAGED_TUNNEL_LIMIT - 1 },
 ]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("rejects provisioning at the default limit of 3", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([{ activeTunnels: 3 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 userId: "user-1",
 environmentId: "environment-1",
 maxTunnels: 3,
 activeTunnels: 3,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override above the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 25 }]),
 countRows: Effect.succeed([{ activeTunnels: 10 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override below the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 1 }]),
 countRows: Effect.succeed([{ activeTunnels: 1 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 maxTunnels: 1,
 activeTunnels: 1,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains database failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 overrideRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "load-limit",
 userId: "user-1",
 });
 expect(error).toHaveProperty("cause", cause);
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains count failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 countRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "count-tunnels",
 userId: "user-1",
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });
});
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(relay): limit managed tunnels per user by juliusmarminge · Pull Request #4530 · pingdotgg/t3code · GitHub
Skip to content
feat(relay): limit managed tunnels per user#4530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

juliusmarminge
merged 3 commits into

from

Jul 27, 2026
 Merged


feat(relay): limit managed tunnels per user
#4530
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
be658ec

feat(relay): limit managed tunnels per user


juliusmarminge Jul 25, 2026
aa658ab

fix(relay): address Effect convention review findings


juliusmarminge Jul 25, 2026
99bcad7

feat(relay): lower default managed tunnel limit to 3


juliusmarminge Jul 27, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
apps/mobile/src/features/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,6 +143,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

2 changes: 2 additions & 0 deletions
apps/web/src/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -154,6 +154,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

77 changes: 77 additions & 0 deletions
infra/relay/src/environments/ManagedEndpointProvider.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ import * as Redacted from "effect/Redacted";
import * as RelayConfiguration from "../Config.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const config = RelayConfiguration.RelayConfiguration.of({
 relayIssuer: "https://relay.example.test",
Expand DownExpand Up@@ -200,10 +201,24 @@ function makeAllocations(calls: AllocationCall[] = []) {
 });
}

function makeTunnelLimits(
 calls: Array<{ readonly userId: string; readonly environmentId: string }> = [],
 result: ManagedTunnelLimits.ManagedTunnelLimitExceeded | null = null,
) {
 return ManagedTunnelLimits.ManagedTunnelLimits.of({
 ensureCapacity: (input) =>
 Effect.suspend(() => {
 calls.push(input);
 return result === null ? Effect.void : Effect.fail(result);
 }),
 });
}

function providerLayer(
 tunnelClient = makeTunnelClient(),
 dnsClient = makeDnsClient(),
 allocations = makeAllocations(),
 tunnelLimits = makeTunnelLimits(),
) {
 return ManagedEndpointProvider.layer.pipe(
 Layer.provideMerge(NodeServices.layer),
Expand All@@ -213,6 +228,7 @@ function providerLayer(
 Layer.provide(
 Layer.succeed(ManagedEndpointAllocations.ManagedEndpointAllocations, allocations),
 ),
 Layer.provide(Layer.succeed(ManagedTunnelLimits.ManagedTunnelLimits, tunnelLimits)),
 );
}

Expand DownExpand Up@@ -311,6 +327,67 @@ describe("ManagedEndpointProvider", () => {
 );
 });

 it.effect("checks the managed tunnel limit before reserving an allocation", () => {
 const limitCalls: Array<{ readonly userId: string; readonly environmentId: string }> = [];

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 yield* provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 });

 expect(limitCalls).toEqual([{ userId: "user_ABC", environmentId: "env_ABC" }]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(),
 makeDnsClient(),
 makeAllocations(),
 makeTunnelLimits(limitCalls),
 ),
 ),
 );
 });

 it.effect("refuses to provision past the managed tunnel limit without side effects", () => {
 const tunnelCalls: TunnelCall[] = [];
 const dnsCalls: DnsCall[] = [];
 const allocationCalls: AllocationCall[] = [];
 const exceeded = new ManagedTunnelLimits.ManagedTunnelLimitExceeded({
 userId: "user_ABC",
 environmentId: "env_ABC",
 maxTunnels: 10,
 activeTunnels: 10,
 });

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 const error = yield* Effect.flip(
 provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 }),
 );

 expect(error).toBe(exceeded);
 expect(tunnelCalls).toEqual([]);
 expect(dnsCalls).toEqual([]);
 expect(allocationCalls).toEqual([]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(tunnelCalls),
 makeDnsClient(dnsCalls),
 makeAllocations(allocationCalls),
 makeTunnelLimits([], exceeded),
 ),
 ),
 );
 });

 it.effect("uses stage-scoped stable names without leaking unusual environment ids", () => {
 const tunnelCalls: TunnelCall[] = [];

Expand Down

26 changes: 25 additions & 1 deletion
infra/relay/src/environments/ManagedEndpointProvider.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -23,6 +23,7 @@ import {
 managedEndpointTunnelName,
} from "../deploymentConfig.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedErrorClass<ManagedEndpointProvisioningNotConfigured>()(
 "ManagedEndpointProvisioningNotConfigured",
Expand All@@ -41,6 +42,7 @@ export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedError

const ManagedEndpointProvisioningStage = Schema.Literals([
 "derive-environment-hash",
 "check-tunnel-limit",
 "reserve-allocation",
 "ensure-tunnel",
 "validate-tunnel-response",
Expand DownExpand Up@@ -112,7 +114,8 @@ export class ManagedEndpointOriginNotAllowed extends Schema.TaggedErrorClass<Man
export type ManagedEndpointProviderError =
 | ManagedEndpointProvisioningNotConfigured
 | ManagedEndpointProvisioningFailed
 | ManagedEndpointOriginNotAllowed;
 | ManagedEndpointOriginNotAllowed
 | ManagedTunnelLimits.ManagedTunnelLimitExceeded;

export interface ManagedEndpointProvisioningResult {
 readonly endpoint: RelayManagedEndpoint;
Expand DownExpand Up@@ -331,6 +334,7 @@ export const make = Effect.gen(function* () {
 const tunnels = yield* ManagedEndpointTunnelClient;
 const dns = yield* ManagedEndpointDnsClient;
 const allocations = yield* ManagedEndpointAllocations.ManagedEndpointAllocations;
 const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;

 const updateExistingDnsRecords = Effect.fnUntraced(function* (
 records: ReadonlyArray<{ readonly id: string }>,
Expand DownExpand Up@@ -504,6 +508,26 @@ export const make = Effect.gen(function* () {
 environmentHash,
 );
 const requestedTunnelName = managedEndpointTunnelName(cf.namespace, environmentHash);
 yield* tunnelLimits
 .ensureCapacity({
 userId: input.userId,
 environmentId: input.environmentId,
 })
 .pipe(
 Effect.catchTags({
 ManagedTunnelLimitPersistenceError: (cause) =>
 Effect.fail(
 new ManagedEndpointProvisioningFailed({
 userId: input.userId,
 environmentId: input.environmentId,
 stage: "check-tunnel-limit",
 hostname: requestedHostname,
 tunnelName: requestedTunnelName,
 cause,
 }),
 ),
 }),
 );
 const allocation = yield* allocations
 .reserve({
 userId: input.userId,
Expand Down

145 changes: 145 additions & 0 deletions
infra/relay/src/environments/ManagedTunnelLimits.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";

import * as RelayDb from "../db.ts";
import {
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
} from "../persistence/schema.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const layerWithDb = (db: RelayDb.RelayDb["Service"]) =>
 ManagedTunnelLimits.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db)));

function makeFakeDb(input: {
 readonly overrideRows?: Effect.Effect<ReadonlyArray<{ readonly maxTunnels: number }>, Error>;
 readonly countRows?: Effect.Effect<ReadonlyArray<{ readonly activeTunnels: number }>, Error>;
}) {
 return {
 select: () => ({
 from: (table: unknown) => {
 if (table === relayManagedTunnelLimits) {
 return {
 where: () => ({
 limit: () => input.overrideRows ?? Effect.succeed([]),
 }),
 };
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return {
 where: () => input.countRows ?? Effect.succeed([{ activeTunnels: 0 }]),
 };
 },
 }),
 } as unknown as RelayDb.RelayDb["Service"];
}

describe("ManagedTunnelLimits", () => {
 it.effect("allows provisioning below the default limit", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([
 { activeTunnels: ManagedTunnelLimits.DEFAULT_MANAGED_TUNNEL_LIMIT - 1 },
 ]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("rejects provisioning at the default limit of 3", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([{ activeTunnels: 3 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 userId: "user-1",
 environmentId: "environment-1",
 maxTunnels: 3,
 activeTunnels: 3,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override above the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 25 }]),
 countRows: Effect.succeed([{ activeTunnels: 10 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override below the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 1 }]),
 countRows: Effect.succeed([{ activeTunnels: 1 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 maxTunnels: 1,
 activeTunnels: 1,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains database failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 overrideRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "load-limit",
 userId: "user-1",
 });
 expect(error).toHaveProperty("cause", cause);
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains count failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 countRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "count-tunnels",
 userId: "user-1",
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });
});
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
feat(relay): limit managed tunnels per user by juliusmarminge · Pull Request #4530 · pingdotgg/t3code · GitHub
Skip to content
feat(relay): limit managed tunnels per user#4530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

juliusmarminge
merged 3 commits into

from

Jul 27, 2026
 Merged


feat(relay): limit managed tunnels per user
#4530
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
be658ec

feat(relay): limit managed tunnels per user


juliusmarminge Jul 25, 2026
aa658ab

fix(relay): address Effect convention review findings


juliusmarminge Jul 25, 2026
99bcad7

feat(relay): lower default managed tunnel limit to 3


juliusmarminge Jul 27, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
apps/mobile/src/features/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,6 +143,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

2 changes: 2 additions & 0 deletions
apps/web/src/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -154,6 +154,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

77 changes: 77 additions & 0 deletions
infra/relay/src/environments/ManagedEndpointProvider.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ import * as Redacted from "effect/Redacted";
import * as RelayConfiguration from "../Config.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const config = RelayConfiguration.RelayConfiguration.of({
 relayIssuer: "https://relay.example.test",
Expand DownExpand Up@@ -200,10 +201,24 @@ function makeAllocations(calls: AllocationCall[] = []) {
 });
}

function makeTunnelLimits(
 calls: Array<{ readonly userId: string; readonly environmentId: string }> = [],
 result: ManagedTunnelLimits.ManagedTunnelLimitExceeded | null = null,
) {
 return ManagedTunnelLimits.ManagedTunnelLimits.of({
 ensureCapacity: (input) =>
 Effect.suspend(() => {
 calls.push(input);
 return result === null ? Effect.void : Effect.fail(result);
 }),
 });
}

function providerLayer(
 tunnelClient = makeTunnelClient(),
 dnsClient = makeDnsClient(),
 allocations = makeAllocations(),
 tunnelLimits = makeTunnelLimits(),
) {
 return ManagedEndpointProvider.layer.pipe(
 Layer.provideMerge(NodeServices.layer),
Expand All@@ -213,6 +228,7 @@ function providerLayer(
 Layer.provide(
 Layer.succeed(ManagedEndpointAllocations.ManagedEndpointAllocations, allocations),
 ),
 Layer.provide(Layer.succeed(ManagedTunnelLimits.ManagedTunnelLimits, tunnelLimits)),
 );
}

Expand DownExpand Up@@ -311,6 +327,67 @@ describe("ManagedEndpointProvider", () => {
 );
 });

 it.effect("checks the managed tunnel limit before reserving an allocation", () => {
 const limitCalls: Array<{ readonly userId: string; readonly environmentId: string }> = [];

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 yield* provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 });

 expect(limitCalls).toEqual([{ userId: "user_ABC", environmentId: "env_ABC" }]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(),
 makeDnsClient(),
 makeAllocations(),
 makeTunnelLimits(limitCalls),
 ),
 ),
 );
 });

 it.effect("refuses to provision past the managed tunnel limit without side effects", () => {
 const tunnelCalls: TunnelCall[] = [];
 const dnsCalls: DnsCall[] = [];
 const allocationCalls: AllocationCall[] = [];
 const exceeded = new ManagedTunnelLimits.ManagedTunnelLimitExceeded({
 userId: "user_ABC",
 environmentId: "env_ABC",
 maxTunnels: 10,
 activeTunnels: 10,
 });

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 const error = yield* Effect.flip(
 provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 }),
 );

 expect(error).toBe(exceeded);
 expect(tunnelCalls).toEqual([]);
 expect(dnsCalls).toEqual([]);
 expect(allocationCalls).toEqual([]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(tunnelCalls),
 makeDnsClient(dnsCalls),
 makeAllocations(allocationCalls),
 makeTunnelLimits([], exceeded),
 ),
 ),
 );
 });

 it.effect("uses stage-scoped stable names without leaking unusual environment ids", () => {
 const tunnelCalls: TunnelCall[] = [];

Expand Down

26 changes: 25 additions & 1 deletion
infra/relay/src/environments/ManagedEndpointProvider.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -23,6 +23,7 @@ import {
 managedEndpointTunnelName,
} from "../deploymentConfig.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedErrorClass<ManagedEndpointProvisioningNotConfigured>()(
 "ManagedEndpointProvisioningNotConfigured",
Expand All@@ -41,6 +42,7 @@ export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedError

const ManagedEndpointProvisioningStage = Schema.Literals([
 "derive-environment-hash",
 "check-tunnel-limit",
 "reserve-allocation",
 "ensure-tunnel",
 "validate-tunnel-response",
Expand DownExpand Up@@ -112,7 +114,8 @@ export class ManagedEndpointOriginNotAllowed extends Schema.TaggedErrorClass<Man
export type ManagedEndpointProviderError =
 | ManagedEndpointProvisioningNotConfigured
 | ManagedEndpointProvisioningFailed
 | ManagedEndpointOriginNotAllowed;
 | ManagedEndpointOriginNotAllowed
 | ManagedTunnelLimits.ManagedTunnelLimitExceeded;

export interface ManagedEndpointProvisioningResult {
 readonly endpoint: RelayManagedEndpoint;
Expand DownExpand Up@@ -331,6 +334,7 @@ export const make = Effect.gen(function* () {
 const tunnels = yield* ManagedEndpointTunnelClient;
 const dns = yield* ManagedEndpointDnsClient;
 const allocations = yield* ManagedEndpointAllocations.ManagedEndpointAllocations;
 const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;

 const updateExistingDnsRecords = Effect.fnUntraced(function* (
 records: ReadonlyArray<{ readonly id: string }>,
Expand DownExpand Up@@ -504,6 +508,26 @@ export const make = Effect.gen(function* () {
 environmentHash,
 );
 const requestedTunnelName = managedEndpointTunnelName(cf.namespace, environmentHash);
 yield* tunnelLimits
 .ensureCapacity({
 userId: input.userId,
 environmentId: input.environmentId,
 })
 .pipe(
 Effect.catchTags({
 ManagedTunnelLimitPersistenceError: (cause) =>
 Effect.fail(
 new ManagedEndpointProvisioningFailed({
 userId: input.userId,
 environmentId: input.environmentId,
 stage: "check-tunnel-limit",
 hostname: requestedHostname,
 tunnelName: requestedTunnelName,
 cause,
 }),
 ),
 }),
 );
 const allocation = yield* allocations
 .reserve({
 userId: input.userId,
Expand Down

145 changes: 145 additions & 0 deletions
infra/relay/src/environments/ManagedTunnelLimits.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";

import * as RelayDb from "../db.ts";
import {
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
} from "../persistence/schema.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const layerWithDb = (db: RelayDb.RelayDb["Service"]) =>
 ManagedTunnelLimits.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db)));

function makeFakeDb(input: {
 readonly overrideRows?: Effect.Effect<ReadonlyArray<{ readonly maxTunnels: number }>, Error>;
 readonly countRows?: Effect.Effect<ReadonlyArray<{ readonly activeTunnels: number }>, Error>;
}) {
 return {
 select: () => ({
 from: (table: unknown) => {
 if (table === relayManagedTunnelLimits) {
 return {
 where: () => ({
 limit: () => input.overrideRows ?? Effect.succeed([]),
 }),
 };
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return {
 where: () => input.countRows ?? Effect.succeed([{ activeTunnels: 0 }]),
 };
 },
 }),
 } as unknown as RelayDb.RelayDb["Service"];
}

describe("ManagedTunnelLimits", () => {
 it.effect("allows provisioning below the default limit", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([
 { activeTunnels: ManagedTunnelLimits.DEFAULT_MANAGED_TUNNEL_LIMIT - 1 },
 ]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("rejects provisioning at the default limit of 3", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([{ activeTunnels: 3 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 userId: "user-1",
 environmentId: "environment-1",
 maxTunnels: 3,
 activeTunnels: 3,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override above the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 25 }]),
 countRows: Effect.succeed([{ activeTunnels: 10 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override below the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 1 }]),
 countRows: Effect.succeed([{ activeTunnels: 1 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 maxTunnels: 1,
 activeTunnels: 1,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains database failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 overrideRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "load-limit",
 userId: "user-1",
 });
 expect(error).toHaveProperty("cause", cause);
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains count failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 countRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "count-tunnels",
 userId: "user-1",
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });
});
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(relay): limit managed tunnels per user by juliusmarminge · Pull Request #4530 · pingdotgg/t3code · GitHub
Skip to content
feat(relay): limit managed tunnels per user#4530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

juliusmarminge
merged 3 commits into

from

Jul 27, 2026
 Merged


feat(relay): limit managed tunnels per user
#4530
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
be658ec

feat(relay): limit managed tunnels per user


juliusmarminge Jul 25, 2026
aa658ab

fix(relay): address Effect convention review findings


juliusmarminge Jul 25, 2026
99bcad7

feat(relay): lower default managed tunnel limit to 3


juliusmarminge Jul 27, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
apps/mobile/src/features/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,6 +143,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

2 changes: 2 additions & 0 deletions
apps/web/src/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -154,6 +154,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

77 changes: 77 additions & 0 deletions
infra/relay/src/environments/ManagedEndpointProvider.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ import * as Redacted from "effect/Redacted";
import * as RelayConfiguration from "../Config.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const config = RelayConfiguration.RelayConfiguration.of({
 relayIssuer: "https://relay.example.test",
Expand DownExpand Up@@ -200,10 +201,24 @@ function makeAllocations(calls: AllocationCall[] = []) {
 });
}

function makeTunnelLimits(
 calls: Array<{ readonly userId: string; readonly environmentId: string }> = [],
 result: ManagedTunnelLimits.ManagedTunnelLimitExceeded | null = null,
) {
 return ManagedTunnelLimits.ManagedTunnelLimits.of({
 ensureCapacity: (input) =>
 Effect.suspend(() => {
 calls.push(input);
 return result === null ? Effect.void : Effect.fail(result);
 }),
 });
}

function providerLayer(
 tunnelClient = makeTunnelClient(),
 dnsClient = makeDnsClient(),
 allocations = makeAllocations(),
 tunnelLimits = makeTunnelLimits(),
) {
 return ManagedEndpointProvider.layer.pipe(
 Layer.provideMerge(NodeServices.layer),
Expand All@@ -213,6 +228,7 @@ function providerLayer(
 Layer.provide(
 Layer.succeed(ManagedEndpointAllocations.ManagedEndpointAllocations, allocations),
 ),
 Layer.provide(Layer.succeed(ManagedTunnelLimits.ManagedTunnelLimits, tunnelLimits)),
 );
}

Expand DownExpand Up@@ -311,6 +327,67 @@ describe("ManagedEndpointProvider", () => {
 );
 });

 it.effect("checks the managed tunnel limit before reserving an allocation", () => {
 const limitCalls: Array<{ readonly userId: string; readonly environmentId: string }> = [];

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 yield* provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 });

 expect(limitCalls).toEqual([{ userId: "user_ABC", environmentId: "env_ABC" }]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(),
 makeDnsClient(),
 makeAllocations(),
 makeTunnelLimits(limitCalls),
 ),
 ),
 );
 });

 it.effect("refuses to provision past the managed tunnel limit without side effects", () => {
 const tunnelCalls: TunnelCall[] = [];
 const dnsCalls: DnsCall[] = [];
 const allocationCalls: AllocationCall[] = [];
 const exceeded = new ManagedTunnelLimits.ManagedTunnelLimitExceeded({
 userId: "user_ABC",
 environmentId: "env_ABC",
 maxTunnels: 10,
 activeTunnels: 10,
 });

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 const error = yield* Effect.flip(
 provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 }),
 );

 expect(error).toBe(exceeded);
 expect(tunnelCalls).toEqual([]);
 expect(dnsCalls).toEqual([]);
 expect(allocationCalls).toEqual([]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(tunnelCalls),
 makeDnsClient(dnsCalls),
 makeAllocations(allocationCalls),
 makeTunnelLimits([], exceeded),
 ),
 ),
 );
 });

 it.effect("uses stage-scoped stable names without leaking unusual environment ids", () => {
 const tunnelCalls: TunnelCall[] = [];

Expand Down

26 changes: 25 additions & 1 deletion
infra/relay/src/environments/ManagedEndpointProvider.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -23,6 +23,7 @@ import {
 managedEndpointTunnelName,
} from "../deploymentConfig.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedErrorClass<ManagedEndpointProvisioningNotConfigured>()(
 "ManagedEndpointProvisioningNotConfigured",
Expand All@@ -41,6 +42,7 @@ export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedError

const ManagedEndpointProvisioningStage = Schema.Literals([
 "derive-environment-hash",
 "check-tunnel-limit",
 "reserve-allocation",
 "ensure-tunnel",
 "validate-tunnel-response",
Expand DownExpand Up@@ -112,7 +114,8 @@ export class ManagedEndpointOriginNotAllowed extends Schema.TaggedErrorClass<Man
export type ManagedEndpointProviderError =
 | ManagedEndpointProvisioningNotConfigured
 | ManagedEndpointProvisioningFailed
 | ManagedEndpointOriginNotAllowed;
 | ManagedEndpointOriginNotAllowed
 | ManagedTunnelLimits.ManagedTunnelLimitExceeded;

export interface ManagedEndpointProvisioningResult {
 readonly endpoint: RelayManagedEndpoint;
Expand DownExpand Up@@ -331,6 +334,7 @@ export const make = Effect.gen(function* () {
 const tunnels = yield* ManagedEndpointTunnelClient;
 const dns = yield* ManagedEndpointDnsClient;
 const allocations = yield* ManagedEndpointAllocations.ManagedEndpointAllocations;
 const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;

 const updateExistingDnsRecords = Effect.fnUntraced(function* (
 records: ReadonlyArray<{ readonly id: string }>,
Expand DownExpand Up@@ -504,6 +508,26 @@ export const make = Effect.gen(function* () {
 environmentHash,
 );
 const requestedTunnelName = managedEndpointTunnelName(cf.namespace, environmentHash);
 yield* tunnelLimits
 .ensureCapacity({
 userId: input.userId,
 environmentId: input.environmentId,
 })
 .pipe(
 Effect.catchTags({
 ManagedTunnelLimitPersistenceError: (cause) =>
 Effect.fail(
 new ManagedEndpointProvisioningFailed({
 userId: input.userId,
 environmentId: input.environmentId,
 stage: "check-tunnel-limit",
 hostname: requestedHostname,
 tunnelName: requestedTunnelName,
 cause,
 }),
 ),
 }),
 );
 const allocation = yield* allocations
 .reserve({
 userId: input.userId,
Expand Down

145 changes: 145 additions & 0 deletions
infra/relay/src/environments/ManagedTunnelLimits.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";

import * as RelayDb from "../db.ts";
import {
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
} from "../persistence/schema.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const layerWithDb = (db: RelayDb.RelayDb["Service"]) =>
 ManagedTunnelLimits.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db)));

function makeFakeDb(input: {
 readonly overrideRows?: Effect.Effect<ReadonlyArray<{ readonly maxTunnels: number }>, Error>;
 readonly countRows?: Effect.Effect<ReadonlyArray<{ readonly activeTunnels: number }>, Error>;
}) {
 return {
 select: () => ({
 from: (table: unknown) => {
 if (table === relayManagedTunnelLimits) {
 return {
 where: () => ({
 limit: () => input.overrideRows ?? Effect.succeed([]),
 }),
 };
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return {
 where: () => input.countRows ?? Effect.succeed([{ activeTunnels: 0 }]),
 };
 },
 }),
 } as unknown as RelayDb.RelayDb["Service"];
}

describe("ManagedTunnelLimits", () => {
 it.effect("allows provisioning below the default limit", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([
 { activeTunnels: ManagedTunnelLimits.DEFAULT_MANAGED_TUNNEL_LIMIT - 1 },
 ]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("rejects provisioning at the default limit of 3", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([{ activeTunnels: 3 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 userId: "user-1",
 environmentId: "environment-1",
 maxTunnels: 3,
 activeTunnels: 3,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override above the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 25 }]),
 countRows: Effect.succeed([{ activeTunnels: 10 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override below the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 1 }]),
 countRows: Effect.succeed([{ activeTunnels: 1 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 maxTunnels: 1,
 activeTunnels: 1,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains database failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 overrideRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "load-limit",
 userId: "user-1",
 });
 expect(error).toHaveProperty("cause", cause);
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains count failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 countRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "count-tunnels",
 userId: "user-1",
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });
});
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(relay): limit managed tunnels per user by juliusmarminge · Pull Request #4530 · pingdotgg/t3code · GitHub
Skip to content
feat(relay): limit managed tunnels per user#4530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

juliusmarminge
merged 3 commits into

from

Jul 27, 2026
 Merged


feat(relay): limit managed tunnels per user
#4530
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
be658ec

feat(relay): limit managed tunnels per user


juliusmarminge Jul 25, 2026
aa658ab

fix(relay): address Effect convention review findings


juliusmarminge Jul 25, 2026
99bcad7

feat(relay): lower default managed tunnel limit to 3


juliusmarminge Jul 27, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
apps/mobile/src/features/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,6 +143,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

2 changes: 2 additions & 0 deletions
apps/web/src/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -154,6 +154,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

77 changes: 77 additions & 0 deletions
infra/relay/src/environments/ManagedEndpointProvider.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ import * as Redacted from "effect/Redacted";
import * as RelayConfiguration from "../Config.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const config = RelayConfiguration.RelayConfiguration.of({
 relayIssuer: "https://relay.example.test",
Expand DownExpand Up@@ -200,10 +201,24 @@ function makeAllocations(calls: AllocationCall[] = []) {
 });
}

function makeTunnelLimits(
 calls: Array<{ readonly userId: string; readonly environmentId: string }> = [],
 result: ManagedTunnelLimits.ManagedTunnelLimitExceeded | null = null,
) {
 return ManagedTunnelLimits.ManagedTunnelLimits.of({
 ensureCapacity: (input) =>
 Effect.suspend(() => {
 calls.push(input);
 return result === null ? Effect.void : Effect.fail(result);
 }),
 });
}

function providerLayer(
 tunnelClient = makeTunnelClient(),
 dnsClient = makeDnsClient(),
 allocations = makeAllocations(),
 tunnelLimits = makeTunnelLimits(),
) {
 return ManagedEndpointProvider.layer.pipe(
 Layer.provideMerge(NodeServices.layer),
Expand All@@ -213,6 +228,7 @@ function providerLayer(
 Layer.provide(
 Layer.succeed(ManagedEndpointAllocations.ManagedEndpointAllocations, allocations),
 ),
 Layer.provide(Layer.succeed(ManagedTunnelLimits.ManagedTunnelLimits, tunnelLimits)),
 );
}

Expand DownExpand Up@@ -311,6 +327,67 @@ describe("ManagedEndpointProvider", () => {
 );
 });

 it.effect("checks the managed tunnel limit before reserving an allocation", () => {
 const limitCalls: Array<{ readonly userId: string; readonly environmentId: string }> = [];

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 yield* provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 });

 expect(limitCalls).toEqual([{ userId: "user_ABC", environmentId: "env_ABC" }]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(),
 makeDnsClient(),
 makeAllocations(),
 makeTunnelLimits(limitCalls),
 ),
 ),
 );
 });

 it.effect("refuses to provision past the managed tunnel limit without side effects", () => {
 const tunnelCalls: TunnelCall[] = [];
 const dnsCalls: DnsCall[] = [];
 const allocationCalls: AllocationCall[] = [];
 const exceeded = new ManagedTunnelLimits.ManagedTunnelLimitExceeded({
 userId: "user_ABC",
 environmentId: "env_ABC",
 maxTunnels: 10,
 activeTunnels: 10,
 });

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 const error = yield* Effect.flip(
 provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 }),
 );

 expect(error).toBe(exceeded);
 expect(tunnelCalls).toEqual([]);
 expect(dnsCalls).toEqual([]);
 expect(allocationCalls).toEqual([]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(tunnelCalls),
 makeDnsClient(dnsCalls),
 makeAllocations(allocationCalls),
 makeTunnelLimits([], exceeded),
 ),
 ),
 );
 });

 it.effect("uses stage-scoped stable names without leaking unusual environment ids", () => {
 const tunnelCalls: TunnelCall[] = [];

Expand Down

26 changes: 25 additions & 1 deletion
infra/relay/src/environments/ManagedEndpointProvider.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -23,6 +23,7 @@ import {
 managedEndpointTunnelName,
} from "../deploymentConfig.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedErrorClass<ManagedEndpointProvisioningNotConfigured>()(
 "ManagedEndpointProvisioningNotConfigured",
Expand All@@ -41,6 +42,7 @@ export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedError

const ManagedEndpointProvisioningStage = Schema.Literals([
 "derive-environment-hash",
 "check-tunnel-limit",
 "reserve-allocation",
 "ensure-tunnel",
 "validate-tunnel-response",
Expand DownExpand Up@@ -112,7 +114,8 @@ export class ManagedEndpointOriginNotAllowed extends Schema.TaggedErrorClass<Man
export type ManagedEndpointProviderError =
 | ManagedEndpointProvisioningNotConfigured
 | ManagedEndpointProvisioningFailed
 | ManagedEndpointOriginNotAllowed;
 | ManagedEndpointOriginNotAllowed
 | ManagedTunnelLimits.ManagedTunnelLimitExceeded;

export interface ManagedEndpointProvisioningResult {
 readonly endpoint: RelayManagedEndpoint;
Expand DownExpand Up@@ -331,6 +334,7 @@ export const make = Effect.gen(function* () {
 const tunnels = yield* ManagedEndpointTunnelClient;
 const dns = yield* ManagedEndpointDnsClient;
 const allocations = yield* ManagedEndpointAllocations.ManagedEndpointAllocations;
 const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;

 const updateExistingDnsRecords = Effect.fnUntraced(function* (
 records: ReadonlyArray<{ readonly id: string }>,
Expand DownExpand Up@@ -504,6 +508,26 @@ export const make = Effect.gen(function* () {
 environmentHash,
 );
 const requestedTunnelName = managedEndpointTunnelName(cf.namespace, environmentHash);
 yield* tunnelLimits
 .ensureCapacity({
 userId: input.userId,
 environmentId: input.environmentId,
 })
 .pipe(
 Effect.catchTags({
 ManagedTunnelLimitPersistenceError: (cause) =>
 Effect.fail(
 new ManagedEndpointProvisioningFailed({
 userId: input.userId,
 environmentId: input.environmentId,
 stage: "check-tunnel-limit",
 hostname: requestedHostname,
 tunnelName: requestedTunnelName,
 cause,
 }),
 ),
 }),
 );
 const allocation = yield* allocations
 .reserve({
 userId: input.userId,
Expand Down

145 changes: 145 additions & 0 deletions
infra/relay/src/environments/ManagedTunnelLimits.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";

import * as RelayDb from "../db.ts";
import {
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
} from "../persistence/schema.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const layerWithDb = (db: RelayDb.RelayDb["Service"]) =>
 ManagedTunnelLimits.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db)));

function makeFakeDb(input: {
 readonly overrideRows?: Effect.Effect<ReadonlyArray<{ readonly maxTunnels: number }>, Error>;
 readonly countRows?: Effect.Effect<ReadonlyArray<{ readonly activeTunnels: number }>, Error>;
}) {
 return {
 select: () => ({
 from: (table: unknown) => {
 if (table === relayManagedTunnelLimits) {
 return {
 where: () => ({
 limit: () => input.overrideRows ?? Effect.succeed([]),
 }),
 };
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return {
 where: () => input.countRows ?? Effect.succeed([{ activeTunnels: 0 }]),
 };
 },
 }),
 } as unknown as RelayDb.RelayDb["Service"];
}

describe("ManagedTunnelLimits", () => {
 it.effect("allows provisioning below the default limit", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([
 { activeTunnels: ManagedTunnelLimits.DEFAULT_MANAGED_TUNNEL_LIMIT - 1 },
 ]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("rejects provisioning at the default limit of 3", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([{ activeTunnels: 3 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 userId: "user-1",
 environmentId: "environment-1",
 maxTunnels: 3,
 activeTunnels: 3,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override above the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 25 }]),
 countRows: Effect.succeed([{ activeTunnels: 10 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override below the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 1 }]),
 countRows: Effect.succeed([{ activeTunnels: 1 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 maxTunnels: 1,
 activeTunnels: 1,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains database failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 overrideRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "load-limit",
 userId: "user-1",
 });
 expect(error).toHaveProperty("cause", cause);
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains count failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 countRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "count-tunnels",
 userId: "user-1",
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });
});
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
feat(relay): limit managed tunnels per user by juliusmarminge · Pull Request #4530 · pingdotgg/t3code · GitHub
Skip to content
feat(relay): limit managed tunnels per user#4530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

juliusmarminge
merged 3 commits into

from

Jul 27, 2026
 Merged


feat(relay): limit managed tunnels per user
#4530
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
be658ec

feat(relay): limit managed tunnels per user


juliusmarminge Jul 25, 2026
aa658ab

fix(relay): address Effect convention review findings


juliusmarminge Jul 25, 2026
99bcad7

feat(relay): lower default managed tunnel limit to 3


juliusmarminge Jul 27, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
apps/mobile/src/features/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,6 +143,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

2 changes: 2 additions & 0 deletions
apps/web/src/cloud/linkEnvironment.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -154,6 +154,8 @@ function relayProtectedErrorMessage(error: RelayProtectedErrorType): string {
 return `Relay could not link the environment (${error.reason}).`;
 case "RelayEnvironmentLinkUnavailableError":
 return `Relay cannot provision the managed endpoint (${error.reason}).`;
 case "RelayEnvironmentLinkLimitExceededError":
 return `Relay refused the link: this account already has its maximum of ${error.maxTunnels} managed tunnels. Unlink an environment to free one up.`;
 case "RelayAgentActivityPublishProofExpiredError":
 return "Relay rejected an expired agent activity publish proof.";
 case "RelayAgentActivityPublishProofInvalidError":
Expand Down

77 changes: 77 additions & 0 deletions
infra/relay/src/environments/ManagedEndpointProvider.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ import * as Redacted from "effect/Redacted";
import * as RelayConfiguration from "../Config.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedEndpointProvider from "./ManagedEndpointProvider.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const config = RelayConfiguration.RelayConfiguration.of({
 relayIssuer: "https://relay.example.test",
Expand DownExpand Up@@ -200,10 +201,24 @@ function makeAllocations(calls: AllocationCall[] = []) {
 });
}

function makeTunnelLimits(
 calls: Array<{ readonly userId: string; readonly environmentId: string }> = [],
 result: ManagedTunnelLimits.ManagedTunnelLimitExceeded | null = null,
) {
 return ManagedTunnelLimits.ManagedTunnelLimits.of({
 ensureCapacity: (input) =>
 Effect.suspend(() => {
 calls.push(input);
 return result === null ? Effect.void : Effect.fail(result);
 }),
 });
}

function providerLayer(
 tunnelClient = makeTunnelClient(),
 dnsClient = makeDnsClient(),
 allocations = makeAllocations(),
 tunnelLimits = makeTunnelLimits(),
) {
 return ManagedEndpointProvider.layer.pipe(
 Layer.provideMerge(NodeServices.layer),
Expand All@@ -213,6 +228,7 @@ function providerLayer(
 Layer.provide(
 Layer.succeed(ManagedEndpointAllocations.ManagedEndpointAllocations, allocations),
 ),
 Layer.provide(Layer.succeed(ManagedTunnelLimits.ManagedTunnelLimits, tunnelLimits)),
 );
}

Expand DownExpand Up@@ -311,6 +327,67 @@ describe("ManagedEndpointProvider", () => {
 );
 });

 it.effect("checks the managed tunnel limit before reserving an allocation", () => {
 const limitCalls: Array<{ readonly userId: string; readonly environmentId: string }> = [];

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 yield* provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 });

 expect(limitCalls).toEqual([{ userId: "user_ABC", environmentId: "env_ABC" }]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(),
 makeDnsClient(),
 makeAllocations(),
 makeTunnelLimits(limitCalls),
 ),
 ),
 );
 });

 it.effect("refuses to provision past the managed tunnel limit without side effects", () => {
 const tunnelCalls: TunnelCall[] = [];
 const dnsCalls: DnsCall[] = [];
 const allocationCalls: AllocationCall[] = [];
 const exceeded = new ManagedTunnelLimits.ManagedTunnelLimitExceeded({
 userId: "user_ABC",
 environmentId: "env_ABC",
 maxTunnels: 10,
 activeTunnels: 10,
 });

 return Effect.gen(function* () {
 const provider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
 const error = yield* Effect.flip(
 provider.provision({
 userId: "user_ABC",
 environmentId: "env_ABC",
 origin: { localHttpHost: "127.0.0.1", localHttpPort: 3773 },
 }),
 );

 expect(error).toBe(exceeded);
 expect(tunnelCalls).toEqual([]);
 expect(dnsCalls).toEqual([]);
 expect(allocationCalls).toEqual([]);
 }).pipe(
 Effect.provide(
 providerLayer(
 makeTunnelClient(tunnelCalls),
 makeDnsClient(dnsCalls),
 makeAllocations(allocationCalls),
 makeTunnelLimits([], exceeded),
 ),
 ),
 );
 });

 it.effect("uses stage-scoped stable names without leaking unusual environment ids", () => {
 const tunnelCalls: TunnelCall[] = [];

Expand Down

26 changes: 25 additions & 1 deletion
infra/relay/src/environments/ManagedEndpointProvider.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -23,6 +23,7 @@ import {
 managedEndpointTunnelName,
} from "../deploymentConfig.ts";
import * as ManagedEndpointAllocations from "./ManagedEndpointAllocations.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedErrorClass<ManagedEndpointProvisioningNotConfigured>()(
 "ManagedEndpointProvisioningNotConfigured",
Expand All@@ -41,6 +42,7 @@ export class ManagedEndpointProvisioningNotConfigured extends Schema.TaggedError

const ManagedEndpointProvisioningStage = Schema.Literals([
 "derive-environment-hash",
 "check-tunnel-limit",
 "reserve-allocation",
 "ensure-tunnel",
 "validate-tunnel-response",
Expand DownExpand Up@@ -112,7 +114,8 @@ export class ManagedEndpointOriginNotAllowed extends Schema.TaggedErrorClass<Man
export type ManagedEndpointProviderError =
 | ManagedEndpointProvisioningNotConfigured
 | ManagedEndpointProvisioningFailed
 | ManagedEndpointOriginNotAllowed;
 | ManagedEndpointOriginNotAllowed
 | ManagedTunnelLimits.ManagedTunnelLimitExceeded;

export interface ManagedEndpointProvisioningResult {
 readonly endpoint: RelayManagedEndpoint;
Expand DownExpand Up@@ -331,6 +334,7 @@ export const make = Effect.gen(function* () {
 const tunnels = yield* ManagedEndpointTunnelClient;
 const dns = yield* ManagedEndpointDnsClient;
 const allocations = yield* ManagedEndpointAllocations.ManagedEndpointAllocations;
 const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;

 const updateExistingDnsRecords = Effect.fnUntraced(function* (
 records: ReadonlyArray<{ readonly id: string }>,
Expand DownExpand Up@@ -504,6 +508,26 @@ export const make = Effect.gen(function* () {
 environmentHash,
 );
 const requestedTunnelName = managedEndpointTunnelName(cf.namespace, environmentHash);
 yield* tunnelLimits
 .ensureCapacity({
 userId: input.userId,
 environmentId: input.environmentId,
 })
 .pipe(
 Effect.catchTags({
 ManagedTunnelLimitPersistenceError: (cause) =>
 Effect.fail(
 new ManagedEndpointProvisioningFailed({
 userId: input.userId,
 environmentId: input.environmentId,
 stage: "check-tunnel-limit",
 hostname: requestedHostname,
 tunnelName: requestedTunnelName,
 cause,
 }),
 ),
 }),
 );
 const allocation = yield* allocations
 .reserve({
 userId: input.userId,
Expand Down

145 changes: 145 additions & 0 deletions
infra/relay/src/environments/ManagedTunnelLimits.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";

import * as RelayDb from "../db.ts";
import {
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
} from "../persistence/schema.ts";
import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";

const layerWithDb = (db: RelayDb.RelayDb["Service"]) =>
 ManagedTunnelLimits.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db)));

function makeFakeDb(input: {
 readonly overrideRows?: Effect.Effect<ReadonlyArray<{ readonly maxTunnels: number }>, Error>;
 readonly countRows?: Effect.Effect<ReadonlyArray<{ readonly activeTunnels: number }>, Error>;
}) {
 return {
 select: () => ({
 from: (table: unknown) => {
 if (table === relayManagedTunnelLimits) {
 return {
 where: () => ({
 limit: () => input.overrideRows ?? Effect.succeed([]),
 }),
 };
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return {
 where: () => input.countRows ?? Effect.succeed([{ activeTunnels: 0 }]),
 };
 },
 }),
 } as unknown as RelayDb.RelayDb["Service"];
}

describe("ManagedTunnelLimits", () => {
 it.effect("allows provisioning below the default limit", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([
 { activeTunnels: ManagedTunnelLimits.DEFAULT_MANAGED_TUNNEL_LIMIT - 1 },
 ]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("rejects provisioning at the default limit of 3", () => {
 const fakeDb = makeFakeDb({
 countRows: Effect.succeed([{ activeTunnels: 3 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 userId: "user-1",
 environmentId: "environment-1",
 maxTunnels: 3,
 activeTunnels: 3,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override above the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 25 }]),
 countRows: Effect.succeed([{ activeTunnels: 10 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 yield* limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("honors a per-user override below the default", () => {
 const fakeDb = makeFakeDb({
 overrideRows: Effect.succeed([{ maxTunnels: 1 }]),
 countRows: Effect.succeed([{ activeTunnels: 1 }]),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitExceeded",
 maxTunnels: 1,
 activeTunnels: 1,
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains database failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 overrideRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "load-limit",
 userId: "user-1",
 });
 expect(error).toHaveProperty("cause", cause);
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });

 it.effect("retains count failures with operation and user identity", () => {
 const cause = new Error("database unavailable");
 const fakeDb = makeFakeDb({
 countRows: Effect.fail(cause),
 });

 return Effect.gen(function* () {
 const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
 const error = yield* Effect.flip(
 limits.ensureCapacity({ userId: "user-1", environmentId: "environment-1" }),
 );

 expect(error).toMatchObject({
 _tag: "ManagedTunnelLimitPersistenceError",
 operation: "count-tunnels",
 userId: "user-1",
 });
 }).pipe(Effect.provide(layerWithDb(fakeDb)));
 });
});
Loading
Loading