starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-25 16:02:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: exclude service accounts from the free AI tier

Browse Source 
Free-tier eligibility was keyed solely on authed.email. Workspace admins can
create and impersonate arbitrary service accounts (synthetic *.sa.wm.dev
identities), each of which would receive its own one-time grant — letting one
tenant mint many grants and drain the instance-wide daily allowance. Skip the
free-tier fallback for *.sa.wm.dev identities.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Diego Imbert
2026-07-15 13:45:47 +02:00
parent fb11fa5047
commit 0db2b9e95c
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api/src/ai.rs
+10 -2
View File
@@ -717,7 +717,14 @@ async fn proxy(
// one-time grant and the instance's daily cap have room.
// Errors once the grant is spent, the day is capped, or the
// user already has a request in flight; None otherwise.
if let Some((free_credentials, lease)) =
//
// Service accounts (synthetic `*.sa.wm.dev` identities) are
// excluded: a workspace admin can create/impersonate them in
// bulk, and each distinct email would otherwise mint its own
// grant and let one tenant drain the instance-wide daily cap.
let free = if authed.email.ends_with(".sa.wm.dev") {
None
} else {
crate::ai_free_tier_oss::resolve_free_tier_credentials(
&provider,
&db,
@@ -725,7 +732,8 @@ async fn proxy(
&authed.email,
)
.await?
{
};
if let Some((free_credentials, lease)) = free {
free_lease = Some(lease);
break 'cred free_credentials;
}