improvement(self-host): enterprise features enabling - #6028
Conversation
…rise-self-host # Conflicts: # scripts/check-api-validation-contracts.ts
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryHigh Risk Overview Instance organization mode ( Runtime fixes: audit log access without billing when audit logs are enabled; retention deletion only when Admin API: organization DELETE (slug confirm, detach workspaces in-tx, block live subscriptions), plus PATCH routes for whitelabel, data retention, and session policy with the same entitlement gates as the UI. Reviewed by Cursor Bugbot for commit 3390208. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Greptile SummaryAdds self-hosted enterprise master switch (
Confidence Score: 5/5Safe to merge; the prior retention-nav note was accepted as intentional and no remaining blocking failures were established for this follow-up scope. No blocking failure remains. The only prior inline thread (retention settings nav gated on isDataRetentionEnabled) was confirmed intentional by the author and left unchanged.
|
| Filename | Overview |
|---|---|
| apps/sim/lib/core/config/env-flags.ts | Central enterprise entitlement resolution (master switch, explicit overrides, billing-on vs off) for SSO, access control, retention deletion, and related flags. |
| apps/sim/lib/organizations/instance-org.ts | Idempotent instance-org provisioning and auto-join at signup when INSTANCE_ORG_NAME is set and billing is off. |
| apps/sim/components/settings/navigation.ts | Self-hosted settings sections use resolved env-flags; data retention nav intentionally gated on deletion enablement. |
| apps/sim/lib/billing/cleanup-dispatcher.ts | Retention cleanup runs when DATA_RETENTION_ENABLED without billing; avoids hosted free-tier default deletion off-hosted. |
| apps/sim/lib/workspaces/policy.ts | Org workspace creation policy updated so instance-org members can create workspaces where intended. |
Reviews (8): Last reviewed commit: "fix(self-host): refuse instance-org reso..." | Re-trigger Greptile
values.yaml gained the ENTERPRISE_ENABLED switch and INSTANCE_ORG_* keys, and the feature-flag envDefaults moved from "false" to empty so the master switch can resolve them. Additive and backward compatible, so a minor bump.
Drop the per-process instance-org id cache. It went stale once the organization was deleted through the Admin API, and clearing it from the delete handler would only heal the replica that served that request. The lookup runs on the signup path against a single-row table, so re-reading costs nothing and keeps every replica self-correcting. Scope the org-delete subscription conflict to entitled statuses. Matching any row regardless of status let a canceled subscription — which bills nobody — permanently block deletion.
|
@cursor review |
…led ones ENTITLED_SUBSCRIPTION_STATUSES excludes trialing, so a trial — which grants no entitlement but is a live Stripe subscription that will convert — slipped past the delete guard and could be stranded against a removed organization id. Adds TERMINAL_SUBSCRIPTION_STATUSES and inverts the predicate: block unless the row is finished. Expressed as the terminal set so a status Stripe adds later defaults to blocking, which is the safe direction for a destructive operation.
|
@cursor review |
…rise-self-host # Conflicts: # bun.lock
… env var Nine client consumers still read NEXT_PUBLIC_SSO_ENABLED / NEXT_PUBLIC_ACCESS_CONTROL_ENABLED directly while the server gates and settings nav had moved to the resolver. With only ENTERPRISE_ENABLED set that produced dead ends: the SSO settings section appeared but ssoClient() was never registered and no login button rendered, and the Access Control section appeared but its page reported "not entitled". Points every consumer at isSsoEnabled / isAccessControlEnabled so visibility and capability come from one place.
|
@cursor review |
retentionOverrides and per-workspace PII rules both name a workspace, and neither field is a foreign key. The settings UI rejected ids belonging to another organization; the Admin API did not, so the two paths could persist different data for the same org. Extracts the check as getForeignWorkspaceTargetsReason and points both routes at it, so they cannot drift apart again.
|
@cursor review |
Make org delete atomic. detachOrganizationWorkspaces committed on its own, so a failed delete left workspaces detached and re-billed while the organization, its members, and its settings survived. Adds a Tx variant so both commit together. Gate the admin session-policy PATCH on entitlement, matching the settings UI. Without it the stored policy was inert — getSessionPolicy resolves to no-op when the feature is off, so the one eager clamp would be undone on the next refresh. Stop emitting plan-wide housekeeping when billing is off. It is keyed to the hosted free-tier 30-day window, the same default the per-workspace pass deliberately refuses to apply off-hosted.
|
@cursor review |
…t-commit The Admin whitelabel PATCH skipped the entitlement check the settings UI runs, so an admin key could set branding the product had not granted the org. detachOrganizationWorkspacesTx also wrote its audit rows inside the caller's transaction, contradicting its own doc comment — a rolled-back delete would have left audit history describing detachments that never happened. It now returns the rows and callers emit them after commit.
|
@cursor review |
…uous organization.slug has no unique constraint, and the lookup took the first of however many matched. The choice is unordered, so two replicas could resolve different organizations and split new signups between them. Resolution is now three-state. Ambiguity is distinct from absence, so it both declines to adopt an arbitrary organization and declines to provision another one on top of the duplicates.
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 3390208. Configure here.
1 participant
Summary
Adds ENTERPRISE_ENABLED — one switch that turns on the full enterprise feature set on self-hosted deployments without billing — plus INSTANCE_ORG_NAME, which puts every user in a shared organization at signup so org-scoped features (whitelabeling, PII redaction, permission groups, data drains, audit scoping) actually have something to apply to.
Along the way it fixes three server flags that were never read, audit logs and retention deletion that could not work self-hosted at any setting, and a dead end where an auto-joined member could not create a workspace at all; deployments that set nothing keep exactly today's behavior.
Type of Change
Testing
Tested manually
Checklist