From c3fe8e93c82d641eda780bb380a676c5bf0e5201 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Thu, 14 Sep 2023 08:48:17 +0200
Subject: [PATCH] restrict nb of workspaces to 3 + number of oauth users to 50

---
 ...00b97166c789ab1cf6487679d092eebf3a48b.json | 20 -------------------
 backend/windmill-api/src/groups.rs            |  2 ++
 backend/windmill-api/src/oauth2.rs            |  1 +
 backend/windmill-api/src/users.rs             | 19 ++++++++++++++++++
 backend/windmill-api/src/workspaces.rs        | 19 ++++++++++++++++++
 5 files changed, 41 insertions(+), 20 deletions(-)
 delete mode 100644 backend/.sqlx/query-cec906e3bcfe5b477f23e8bb44500b97166c789ab1cf6487679d092eebf3a48b.json

diff --git a/backend/.sqlx/query-cec906e3bcfe5b477f23e8bb44500b97166c789ab1cf6487679d092eebf3a48b.json b/backend/.sqlx/query-cec906e3bcfe5b477f23e8bb44500b97166c789ab1cf6487679d092eebf3a48b.json
deleted file mode 100644
index e6003b9b34..0000000000
--- a/backend/.sqlx/query-cec906e3bcfe5b477f23e8bb44500b97166c789ab1cf6487679d092eebf3a48b.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM group_ WHERE name != 'all' AND name != 'error_handler' AND name != 'slack'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "cec906e3bcfe5b477f23e8bb44500b97166c789ab1cf6487679d092eebf3a48b"
-}
diff --git a/backend/windmill-api/src/groups.rs b/backend/windmill-api/src/groups.rs
index 29f364b55e..44b5a7c83e 100644
--- a/backend/windmill-api/src/groups.rs
+++ b/backend/windmill-api/src/groups.rs
@@ -200,6 +200,7 @@ pub async fn require_is_owner(
     }
 }
 
+#[cfg(not(feature = "enterprise"))]
 async fn _check_nb_of_groups(db: &DB) -> Result<()> {
     let nb_groups = sqlx::query_scalar!("SELECT COUNT(*) FROM group_ WHERE name != 'all' AND name != 'error_handler' AND name != 'slack'",)
         .fetch_one(db)
@@ -212,6 +213,7 @@ async fn _check_nb_of_groups(db: &DB) -> Result<()> {
     }
     return Ok(());
 }
+
 async fn create_group(
     authed: ApiAuthed,
     Extension(_db): Extension<DB>,
diff --git a/backend/windmill-api/src/oauth2.rs b/backend/windmill-api/src/oauth2.rs
index ee29ccdcfa..6aef1eca6f 100644
--- a/backend/windmill-api/src/oauth2.rs
+++ b/backend/windmill-api/src/oauth2.rs
@@ -341,6 +341,7 @@ struct CreateAccount {
     refresh_token: Option<String>,
     expires_in: i64,
 }
+
 async fn create_account(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index c7a391efd7..b9c54987b8 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -2240,6 +2240,21 @@ pub struct LoginUserInfo {
     pub displayName: Option<String>,
 }
 
+#[cfg(not(feature = "enterprise"))]
+async fn _check_nb_of_user(db: &DB) -> Result<()> {
+    let nb_groups =
+        sqlx::query_scalar!("SELECT COUNT(*) FROM password WHERE login_type != 'password'",)
+            .fetch_one(db)
+            .await?;
+    if nb_groups.unwrap_or(0) >= 50 {
+        return Err(Error::BadRequest(
+            "You have reached the maximum number of oauth users accounts (50) without an enterprise license"
+                .to_string(),
+        ));
+    }
+    return Ok(());
+}
+
 pub async fn login_externally(
     db: DB,
     email: &String,
@@ -2292,6 +2307,10 @@ pub async fn login_externally(
         if (name.is_none() || name == Some(String::new())) && user.is_some() {
             name = user.clone().unwrap().displayName;
         }
+
+        #[cfg(not(feature = "enterprise"))]
+        _check_nb_of_user(&db).await?;
+
         sqlx::query(&format!(
             "INSERT INTO password (email, name, company, login_type, verified) VALUES ($1, \
                  $2, $3, '{}', true)",
diff --git a/backend/windmill-api/src/workspaces.rs b/backend/windmill-api/src/workspaces.rs
index bc0a830a55..b6d8219457 100644
--- a/backend/windmill-api/src/workspaces.rs
+++ b/backend/windmill-api/src/workspaces.rs
@@ -849,6 +849,21 @@ lazy_static::lazy_static! {
 
 }
 
+#[cfg(not(feature = "enterprise"))]
+async fn _check_nb_of_workspaces(db: &DB) -> Result<()> {
+    let nb_workspaces = sqlx::query_scalar!("SELECT COUNT(*) FROM workspace WHERE id != 'admins' AND deleted = false",)
+        .fetch_one(db)
+        .await?;
+    if nb_workspaces.unwrap_or(0) >= 3 {
+        return Err(Error::BadRequest(
+            "You have reached the maximum number of workspaces (3 outside of default group 'admins') without an enterprise license. Archive/delete another workspace to create a new one"
+                .to_string(),
+        ));
+    }
+    return Ok(());
+}
+
+
 async fn create_workspace(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -858,6 +873,10 @@ async fn create_workspace(
     if *CREATE_WORKSPACE_REQUIRE_SUPERADMIN {
         require_super_admin(&db, &authed.email).await?;
     }
+
+    #[cfg(not(feature = "enterprise"))]
+    _check_nb_of_workspace(&db).await?;
+
     let mut tx: Transaction<'_, Postgres> = db.begin().await?;
 
     check_name_conflict(&mut tx, &nw.id).await?;