b021f85af9
Add an optional channel_budget (INTEGER, nullable) to workspace_channels
via migration 024. When channel_budget IS NOT NULL and message_count has
reached the budget, the Send handler returns 429 {"error":"channel budget
exceeded"} and aborts before calling SendOutbound.
Implementation details:
- Single SELECT query reads both message_count and channel_budget in one
round-trip (avoids TOCTOU window between read and write)
- Fail-open on DB error: transient failures log but don't block sends
- Early-return on budget hit is before SendOutbound so message_count
cannot be incremented past the limit by a concurrent send that slips
through the window (best-effort; atomic enforcement requires DB-level CAS)
- NULL channel_budget = unlimited (default, backward-compatible)
Migration is idempotent (ADD COLUMN IF NOT EXISTS). Down migration drops
the column cleanly.
Four sqlmock tests cover: at-limit → 429, above-limit → 429, NULL budget
passes through, under-limit passes through.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
7 lines
350 B
SQL
7 lines
350 B
SQL
-- Per-channel message budget (#368).
|
|
-- NULL means no limit. When message_count reaches channel_budget, the Send
|
|
-- handler returns 429 {"error":"channel budget exceeded"} and rejects further
|
|
-- outbound messages until the budget is cleared or raised.
|
|
ALTER TABLE workspace_channels
|
|
ADD COLUMN IF NOT EXISTS channel_budget INTEGER DEFAULT NULL;
|