Merge remote-tracking branch 'origin/main' into enforce-key-limits-under-user-limits

Author: steebchen

apps/api/src/routes/admin.ts

@@ -142,6 +142,8 @@ const organizationSchema = z.object({
 	devPlan: z.string(),
 	// Manual seat-limit override; null = use the plan default.
 	seats: z.number().int().nullable().optional(),
+	// Manual API-key-limit override; null = use the plan default.
+	apiKeyLimit: z.number().int().nullable().optional(),
 	credits: z.string(),
 	totalCreditsAllTime: z.string().optional(),
 	totalSpent: z.string().optional(),
@@ -2023,6 +2025,7 @@ admin.openapi(getOrganizationMetrics, async (c) => {
 			plan: org.plan,
 			devPlan: org.devPlan,
 			seats: org.seats,
+			apiKeyLimit: org.apiKeyLimit,
 			credits: String(org.credits),
 			createdAt: org.createdAt.toISOString(),
 			status: org.status,
@@ -2104,6 +2107,7 @@ admin.openapi(getOrganizationTransactions, async (c) => {
 			plan: org.plan,
 			devPlan: org.devPlan,
 			seats: org.seats,
+			apiKeyLimit: org.apiKeyLimit,
 			credits: String(org.credits),
 			createdAt: org.createdAt.toISOString(),
 			status: org.status,
@@ -5334,7 +5338,7 @@ admin.openapi(updateReferralBonusRoute, async (c) => {
 	});
 });
 
-// Manage an organization's plan tier and seat-limit override
+// Manage an organization's plan tier, seat-limit and API-key-limit overrides
 const manageOrganizationRoute = createRoute({
 	method: "patch",
 	path: "/organizations/{orgId}/manage",
@@ -5349,6 +5353,8 @@ const manageOrganizationRoute = createRoute({
 						plan: z.enum(["free", "pro", "enterprise"]),
 						// Null clears the override and reverts to the plan default.
 						seats: z.number().int().min(0).max(100000).nullable(),
+						// Null clears the override and reverts to the plan default.
+						apiKeyLimit: z.number().int().min(0).max(100000).nullable(),
 					}),
 				},
 			},
@@ -5362,6 +5368,7 @@ const manageOrganizationRoute = createRoute({
 						message: z.string(),
 						plan: z.string(),
 						seats: z.number().int().nullable(),
+						apiKeyLimit: z.number().int().nullable(),
 					}),
 				},
 			},
@@ -5383,7 +5390,7 @@ const manageOrganizationRoute = createRoute({
 admin.openapi(manageOrganizationRoute, async (c) => {
 	const user = c.get("user");
 	const { orgId } = c.req.valid("param");
-	const { plan, seats } = c.req.valid("json");
+	const { plan, seats, apiKeyLimit } = c.req.valid("json");
 
 	const org = await db.query.organization.findFirst({
 		where: {
@@ -5402,6 +5409,7 @@ admin.openapi(manageOrganizationRoute, async (c) => {
 		.set({
 			plan,
 			seats,
+			apiKeyLimit,
 		})
 		.where(eq(tables.organization.id, orgId));
 
@@ -5416,13 +5424,16 @@ admin.openapi(manageOrganizationRoute, async (c) => {
 			newPlan: plan,
 			previousSeats: org.seats,
 			newSeats: seats,
+			previousApiKeyLimit: org.apiKeyLimit,
+			newApiKeyLimit: apiKeyLimit,
 		},
 	});
 
 	return c.json({
 		message: "Organization updated successfully",
 		plan,
 		seats,
+		apiKeyLimit,
 	});
 });
 

apps/api/src/routes/keys-api.spec.ts

@@ -829,9 +829,10 @@ describe("keys route", () => {
 		expect(reactivated?.expiresAt?.toISOString()).toBe(newExpiry);
 	});
 
-	test("POST /keys/api should enforce API key limit of 20", async () => {
-		// Create 19 more API keys to reach the limit of 20
-		for (let i = 2; i <= 20; i++) {
+	test("POST /keys/api enforces the org-wide free-plan limit of 5", async () => {
+		// beforeEach already created 1 active key; add 4 more to reach the free
+		// org-wide cap of 5 active keys.
+		for (let i = 2; i <= 5; i++) {
 			await db.insert(tables.apiKey).values({
 				id: `test-api-key-id-${i}`,
 				token: `test-token-${i}`,
@@ -842,15 +843,15 @@ describe("keys route", () => {
 			});
 		}
 
-		// Try to create the 21st API key, should fail
+		// Try to create the 6th API key, should fail
 		const res = await app.request("/keys/api", {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
 				Cookie: token,
 			},
 			body: JSON.stringify({
-				description: "Twenty-first API Key",
+				description: "Sixth API Key",
 				projectId: "test-project-id",
 				usageLimit: null,
 			}),
@@ -859,6 +860,44 @@ describe("keys route", () => {
 		expect(res.status).toBe(400);
 		const json = await res.json();
 		expect(json.message).toContain("API key limit reached");
-		expect(json.message).toContain("Maximum 20 API keys per project");
+		expect(json.message).toContain(
+			"Maximum 5 active API keys per organization",
+		);
+	});
+
+	test("POST /keys/api respects the admin apiKeyLimit override", async () => {
+		await db
+			.update(tables.organization)
+			.set({ apiKeyLimit: 2 })
+			.where(eq(tables.organization.id, "test-org-id"));
+
+		// beforeEach created 1 active key; add 1 more to reach the override of 2.
+		await db.insert(tables.apiKey).values({
+			id: "test-api-key-id-2",
+			token: "test-token-2",
+			projectId: "test-project-id",
+			description: "Test API Key 2",
+			status: "active",
+			createdBy: "test-user-id",
+		});
+
+		const res = await app.request("/keys/api", {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Cookie: token,
+			},
+			body: JSON.stringify({
+				description: "Third API Key",
+				projectId: "test-project-id",
+				usageLimit: null,
+			}),
+		});
+
+		expect(res.status).toBe(400);
+		const json = await res.json();
+		expect(json.message).toContain(
+			"Maximum 2 active API keys per organization",
+		);
 	});
 });

apps/api/src/routes/keys-api.ts

@@ -792,6 +792,18 @@ export const createIamRuleSchema = z.object({
 	status: iamRuleStatusEnum.default("active"),
 });
 
+// Org-wide cap on active developer API keys. An explicit `organization.apiKeyLimit`
+// override (set by admins) always takes precedence over these plan defaults.
+export function resolveApiKeyLimit(
+	plan: string | null | undefined,
+	apiKeyLimit: number | null | undefined,
+): number {
+	if (apiKeyLimit !== null && apiKeyLimit !== undefined) {
+		return apiKeyLimit;
+	}
+	return plan === "enterprise" ? 500 : plan === "pro" ? 20 : 5;
+}
+
 // Create a new API key
 const create = createRoute({
 	method: "post",
@@ -955,26 +967,37 @@ export async function createApiKeyForProject(
 		});
 	}
 
-	const existingApiKeys = await db.query.apiKey.findMany({
+	const orgProjects = await db.query.project.findMany({
+		where: { organizationId: { eq: project.organization.id } },
+		columns: { id: true },
+	});
+	const orgProjectIds = orgProjects.map((p) => p.id);
+
+	// Org-wide cap on active developer API keys across all of the org's projects.
+	// Platform and hidden LLM SDK aggregate keys are excluded (keyType: "user").
+	const orgActiveApiKeys = await db.query.apiKey.findMany({
 		where: {
-			projectId: { eq: projectId },
-			status: { ne: "deleted" },
-			// Only count developer keys toward the per-project cap; platform and
-			// hidden LLM SDK aggregate keys are excluded.
+			projectId: { in: orgProjectIds },
+			status: { eq: "active" },
 			keyType: { eq: "user" },
 		},
+		columns: { id: true },
 	});
 
-	const maxApiKeys = project.organization.plan === "enterprise" ? 500 : 20;
+	const maxApiKeys = resolveApiKeyLimit(
+		project.organization.plan,
+		project.organization.apiKeyLimit,
+	);
 
-	if (existingApiKeys.length >= maxApiKeys) {
+	if (orgActiveApiKeys.length >= maxApiKeys) {
 		throw new HTTPException(400, {
-			message: `API key limit reached. Maximum ${maxApiKeys} API keys per project. Contact us at contact@llmgateway.io to unlock more.`,
+			message: `API key limit reached. Maximum ${maxApiKeys} active API keys per organization. Contact us at contact@llmgateway.io to unlock more.`,
 		});
 	}
 
-	// Enforce the active-key cap. The creator's own per-member cap wins; for
-	// developers with no explicit cap the org-wide default developer cap applies.
+	// Enforce the per-member active-key cap. The creator's own per-member cap
+	// wins; for developers with no explicit cap the org-wide default developer
+	// cap applies.
 	const creatorMembership = await db.query.userOrganization.findFirst({
 		where: {
 			userId: { eq: userId },
@@ -1013,12 +1036,6 @@ export async function createApiKeyForProject(
 			: null);
 
 	if (typeof effectiveMaxApiKeys === "number") {
-		const orgProjects = await db.query.project.findMany({
-			where: { organizationId: { eq: project.organization.id } },
-			columns: { id: true },
-		});
-		const orgProjectIds = orgProjects.map((p) => p.id);
-
 		const memberActiveKeys = await db.query.apiKey.findMany({
 			where: {
 				createdBy: { eq: userId },
@@ -1234,7 +1251,9 @@ keysApi.openapi(list, async (c) => {
 		},
 	});
 
-	// Get organization plan info if projectId is specified
+	// Get organization plan info if projectId is specified. The cap is org-wide,
+	// so currentCount counts active developer keys across ALL of the org's
+	// projects, not just the selected one.
 	let currentCount = 0;
 	let maxKeys = 0;
 	let plan: "free" | "pro" | "enterprise" = "free";
@@ -1253,8 +1272,21 @@ keysApi.openapi(list, async (c) => {
 
 		if (project?.organization) {
 			plan = project.organization.plan as "free" | "pro" | "enterprise";
-			maxKeys = plan === "enterprise" ? 500 : plan === "pro" ? 20 : 5;
-			currentCount = apiKeys.filter((key) => key.status !== "deleted").length;
+			maxKeys = resolveApiKeyLimit(plan, project.organization.apiKeyLimit);
+
+			const orgProjects = await db.query.project.findMany({
+				where: { organizationId: { eq: project.organization.id } },
+				columns: { id: true },
+			});
+			const orgActiveKeys = await db.query.apiKey.findMany({
+				where: {
+					projectId: { in: orgProjects.map((p) => p.id) },
+					status: { eq: "active" },
+					keyType: { eq: "user" },
+				},
+				columns: { id: true },
+			});
+			currentCount = orgActiveKeys.length;
 		}
 	}
 

apps/api/src/routes/organization.ts

@@ -59,6 +59,8 @@ const organizationSchema = z.object({
 	planExpiresAt: z.date().nullable(),
 	// Manual seat-limit override; null = use the plan default.
 	seats: z.number().nullable(),
+	// Manual API-key-limit override; null = use the plan default.
+	apiKeyLimit: z.number().nullable(),
 	retentionLevel: z.enum(["retain", "none"]),
 	providerCompliancePolicy: providerCompliancePolicySchema.nullable(),
 	status: z.enum(["active", "inactive", "deleted"]).nullable(),

apps/api/src/routes/sso.ts

@@ -256,7 +256,7 @@ const registerBodySchema = z.object({
 	cert: z.string().trim().min(1).openapi({
 		description: "IdP X.509 signing certificate (PEM or base64 body)",
 	}),
-	enforced: z.boolean().default(true).openapi({
+	enforced: z.boolean().default(false).openapi({
 		description:
 			"When true, users whose email domain matches may only sign in via SSO",
 	}),

apps/gateway/src/lib/rate-limit.spec.ts

@@ -91,6 +91,7 @@ describe("Rate Limiting", () => {
 				plan: "free" as const,
 				planExpiresAt: null,
 				seats: null,
+				apiKeyLimit: null,
 				subscriptionCancelled: false,
 				trialStartDate: null,
 				trialEndDate: null,
@@ -180,6 +181,7 @@ describe("Rate Limiting", () => {
 				plan: "free" as const,
 				planExpiresAt: null,
 				seats: null,
+				apiKeyLimit: null,
 				subscriptionCancelled: false,
 				trialStartDate: null,
 				trialEndDate: null,
@@ -270,6 +272,7 @@ describe("Rate Limiting", () => {
 				plan: "free" as const,
 				planExpiresAt: null,
 				seats: null,
+				apiKeyLimit: null,
 				subscriptionCancelled: false,
 				trialStartDate: null,
 				trialEndDate: null,
@@ -354,6 +357,7 @@ describe("Rate Limiting", () => {
 				plan: "free" as const,
 				planExpiresAt: null,
 				seats: null,
+				apiKeyLimit: null,
 				subscriptionCancelled: false,
 				trialStartDate: null,
 				trialEndDate: null,
@@ -446,6 +450,7 @@ describe("Rate Limiting", () => {
 				plan: "free" as const,
 				planExpiresAt: null,
 				seats: null,
+				apiKeyLimit: null,
 				subscriptionCancelled: false,
 				trialStartDate: null,
 				trialEndDate: null,
@@ -538,6 +543,7 @@ describe("Rate Limiting", () => {
 				plan: "free" as const,
 				planExpiresAt: null,
 				seats: null,
+				apiKeyLimit: null,
 				subscriptionCancelled: false,
 				trialStartDate: null,
 				trialEndDate: null,

apps/ui/src/components/api-keys/api-keys-client.tsx

@@ -95,7 +95,7 @@ export function ApiKeysClient({ initialData }: { initialData: ApiKey[] }) {
 							}
 							disabledMessage={
 								planLimits
-									? `${planLimits.plan === "enterprise" ? "Enterprise" : planLimits.plan === "pro" ? "Pro" : "Free"} plan allows maximum ${planLimits.maxKeys} API keys per project`
+									? `${planLimits.plan === "enterprise" ? "Enterprise" : planLimits.plan === "pro" ? "Pro" : "Free"} plan allows maximum ${planLimits.maxKeys} API keys per organization`
 									: undefined
 							}
 						>

apps/ui/src/components/api-keys/api-keys-list.tsx

@@ -462,7 +462,7 @@ export function ApiKeysList({
 					}
 					disabledMessage={
 						planLimits
-							? `${planLimits.plan === "enterprise" ? "Enterprise" : planLimits.plan === "pro" ? "Pro" : "Free"} plan allows maximum ${planLimits.maxKeys} API keys per project`
+							? `${planLimits.plan === "enterprise" ? "Enterprise" : planLimits.plan === "pro" ? "Pro" : "Free"} plan allows maximum ${planLimits.maxKeys} API keys per organization`
 							: undefined
 					}
 				>

apps/ui/src/components/dashboard/dashboard-client.tsx

@@ -309,7 +309,7 @@ export function DashboardClient({
 									}
 									disabledMessage={
 										planLimits
-											? `${planLimits.plan === "enterprise" ? "Enterprise" : planLimits.plan === "pro" ? "Pro" : "Free"} plan allows maximum ${planLimits.maxKeys} API keys per project`
+											? `${planLimits.plan === "enterprise" ? "Enterprise" : planLimits.plan === "pro" ? "Pro" : "Free"} plan allows maximum ${planLimits.maxKeys} API keys per organization`
 											: undefined
 									}
 								>

apps/ui/src/components/sso/sso-client.tsx

@@ -132,7 +132,7 @@ export function SsoClient() {
 	const [domain, setDomain] = useState("");
 	const [entryPoint, setEntryPoint] = useState("");
 	const [cert, setCert] = useState("");
-	const [enforced, setEnforced] = useState(true);
+	const [enforced, setEnforced] = useState(false);
 	const [generatedToken, setGeneratedToken] = useState<string | null>(null);
 	const [groupName, setGroupName] = useState("");
 	const [role, setRole] = useState<"owner" | "admin" | "developer">(