improvement(self-host): enterprise features enabling - #6028
improvement(self-host): enterprise features enabling#6028icecrasher321 wants to merge 12 commits into
Conversation
…rise-self-host # Conflicts: # scripts/check-api-validation-contracts.ts
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryMedium Risk Overview
Docs add a self-hosted enterprise guide; Helm 1.3.0 documents enterprise and instance-org env vars without hardcoding Reviewed by Cursor Bugbot for commit 7d55f38. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Greptile SummaryFollow-up only: prior retention-nav thread stands as intentional; no new eligible findings.
Confidence Score: 5/5Safe to merge from a follow-up perspective; the only prior finding was intentionally retained and no incomplete fix remains. No blocking failure remains. The retention settings nav gating was confirmed intentional by the author so the UI is not write-only theater when cleanup is off.
|
| Filename | Overview |
|---|---|
| apps/sim/components/settings/navigation.ts | Self-hosted settings overrides use resolved enterprise flags; retention nav intentionally tied to deletion enablement per author. |
| apps/sim/lib/core/config/env-flags.ts | Enterprise master switch and per-feature resolution with billing-off legacy defaults; no follow-up issue from prior thread. |
| apps/sim/lib/workspaces/policy.ts | Member org-workspace creation is gated behind !isBillingEnabled, matching the PR intent for instance-org / SSO members. |
Reviews (5): Last reviewed commit: "Merge remote-tracking branch 'origin/sta..." | Re-trigger Greptile
values.yaml gained the ENTERPRISE_ENABLED switch and INSTANCE_ORG_* keys, and the feature-flag envDefaults moved from "false" to empty so the master switch can resolve them. Additive and backward compatible, so a minor bump.
Drop the per-process instance-org id cache. It went stale once the organization was deleted through the Admin API, and clearing it from the delete handler would only heal the replica that served that request. The lookup runs on the signup path against a single-row table, so re-reading costs nothing and keeps every replica self-correcting. Scope the org-delete subscription conflict to entitled statuses. Matching any row regardless of status let a canceled subscription — which bills nobody — permanently block deletion.
|
@cursor review |
…led ones ENTITLED_SUBSCRIPTION_STATUSES excludes trialing, so a trial — which grants no entitlement but is a live Stripe subscription that will convert — slipped past the delete guard and could be stranded against a removed organization id. Adds TERMINAL_SUBSCRIPTION_STATUSES and inverts the predicate: block unless the row is finished. Expressed as the terminal set so a status Stripe adds later defaults to blocking, which is the safe direction for a destructive operation.
|
@cursor review |
…rise-self-host # Conflicts: # bun.lock
… env var Nine client consumers still read NEXT_PUBLIC_SSO_ENABLED / NEXT_PUBLIC_ACCESS_CONTROL_ENABLED directly while the server gates and settings nav had moved to the resolver. With only ENTERPRISE_ENABLED set that produced dead ends: the SSO settings section appeared but ssoClient() was never registered and no login button rendered, and the Access Control section appeared but its page reported "not entitled". Points every consumer at isSsoEnabled / isAccessControlEnabled so visibility and capability come from one place.
|
@cursor review |
retentionOverrides and per-workspace PII rules both name a workspace, and neither field is a foreign key. The settings UI rejected ids belonging to another organization; the Admin API did not, so the two paths could persist different data for the same org. Extracts the check as getForeignWorkspaceTargetsReason and points both routes at it, so they cannot drift apart again.
|
@cursor review |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit fb98a44. Configure here.
Make org delete atomic. detachOrganizationWorkspaces committed on its own, so a failed delete left workspaces detached and re-billed while the organization, its members, and its settings survived. Adds a Tx variant so both commit together. Gate the admin session-policy PATCH on entitlement, matching the settings UI. Without it the stored policy was inert — getSessionPolicy resolves to no-op when the feature is off, so the one eager clamp would be undone on the next refresh. Stop emitting plan-wide housekeeping when billing is off. It is keyed to the hosted free-tier 30-day window, the same default the per-workspace pass deliberately refuses to apply off-hosted.
|
@cursor review |
1 participant
Summary
Adds ENTERPRISE_ENABLED — one switch that turns on the full enterprise feature set on self-hosted deployments without billing — plus INSTANCE_ORG_NAME, which puts every user in a shared organization at signup so org-scoped features (whitelabeling, PII redaction, permission groups, data drains, audit scoping) actually have something to apply to.
Along the way it fixes three server flags that were never read, audit logs and retention deletion that could not work self-hosted at any setting, and a dead end where an auto-joined member could not create a workspace at all; deployments that set nothing keep exactly today's behavior.
Type of Change
Testing
Tested manually
Checklist