Skip to content

fix: reject quota deductions that would go negative - #2446

Open
BetterAndBetterII wants to merge 1 commit into
songquanpeng:mainfrom
BetterAndBetterII:fix/quota-oversell-guard
Open

fix: reject quota deductions that would go negative#2446
BetterAndBetterII wants to merge 1 commit into
songquanpeng:mainfrom
BetterAndBetterII:fix/quota-oversell-guard

Conversation

@BetterAndBetterII

Copy link
Copy Markdown

decreaseUserQuota and decreaseTokenQuota used an unguarded UPDATE ... SET quota = quota - ?. The sufficiency check happens earlier on a stale read, so concurrent requests can all pass and drive users.quota / tokens.remain_quota negative.

This makes the deduction itself atomic: the UPDATE includes WHERE remaining >= amount and treats RowsAffected == 0 as insufficient quota. Unlimited tokens are unchanged; callers already skip DecreaseTokenQuota when UnlimitedQuota is set.

Fixes #2440

Guard decreaseUserQuota and decreaseTokenQuota with a WHERE remaining >= amount
check so concurrent consumption cannot drive balances below zero.
Copilot AI lite review requested due to automatic review settings August 25, 2026 04:15

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Quota consumption TOCTOU race — user/token quota can be oversold via concurrent requests

2 participants