fix: require billing permission to allocate concurrency and apply allocations atomically

Reallocating purchased concurrency across environments now requires
billing permissions, matching purchases, and allocations are applied
atomically so simultaneous changes can no longer exceed the purchased
amount.

Mono-RevId: 0ff535b7126ef285de9d815196545022ae2236b5

Author: matt-aitken

.server-changes/concurrency-allocation-hardening.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Allocating extra concurrency to environments now requires billing permissions, the same as purchasing it. Allocation changes are also applied atomically, so simultaneous edits can no longer exceed your purchased concurrency.

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.concurrency-limits/route.tsx

@@ -66,7 +66,7 @@ import { rbac } from "~/services/rbac.server";
 import { requireUserId } from "~/services/session.server";
 import { cn } from "~/utils/cn";
 import { formatCurrency, formatNumber } from "~/utils/numberFormatter";
-import { isPaidAddOnPurchase } from "~/utils/paidAddOnPermissions";
+import { requiresManageBilling } from "~/utils/paidAddOnPermissions";
 import { concurrencyLimitsPath, EnvironmentParamSchema, v3BillingPath } from "~/utils/pathBuilder";
 import { AllocateConcurrencyService } from "~/v3/services/allocateConcurrency.server";
 import { SetConcurrencyAddOnService } from "~/v3/services/setConcurrencyAddOn.server";
@@ -170,15 +170,19 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
     return json(submission.reply());
   }
 
-  if (isPaidAddOnPurchase(submission.value.action)) {
+  if (requiresManageBilling(submission.value.action)) {
     const auth = await rbac.authenticateSession(request, {
       userId,
       organizationId: project.organizationId,
     });
     if (!auth.ok || !auth.ability.can("manage", { type: "billing" })) {
+      const permissionError = ["You don't have permission to manage billing."];
       return json(
         submission.reply({
-          fieldErrors: { amount: ["You don't have permission to manage billing."] },
+          fieldErrors:
+            submission.value.action === "allocate"
+              ? { environments: permissionError }
+              : { amount: permissionError },
         }),
         { status: 403 }
       );
@@ -479,7 +483,12 @@ function Upgradable({
                             variant="primary/small"
                             type="submit"
                             form="allocate"
-                            disabled={unallocated < 0 || isLoading}
+                            disabled={!canManageBilling || unallocated < 0 || isLoading}
+                            tooltip={
+                              canManageBilling
+                                ? undefined
+                                : "You don't have permission to manage billing"
+                            }
                             LeadingIcon={isLoading ? SpinnerWhite : undefined}
                           >
                             Save

apps/webapp/app/utils/paidAddOnPermissions.ts

@@ -1,3 +1,11 @@
 export function isPaidAddOnPurchase(action: string): boolean {
   return action === "purchase";
 }
+
+/**
+ * Allocating purchased concurrency consumes the org-wide unallocated pool and changes live
+ * environment limits, so it is gated by the same manage-billing permission as a purchase.
+ */
+export function requiresManageBilling(action: string): boolean {
+  return isPaidAddOnPurchase(action) || action === "allocate";
+}

apps/webapp/app/utils/securityBoundaries.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { billingMessageFromKey, billingMessages } from "./billingMessages";
-import { isPaidAddOnPurchase } from "./paidAddOnPermissions";
+import { isPaidAddOnPurchase, requiresManageBilling } from "./paidAddOnPermissions";
 
 describe("billing messages", () => {
   it("resolves known message keys and rejects arbitrary copy", () => {
@@ -19,4 +19,10 @@ describe("paid add-on permissions", () => {
     expect(isPaidAddOnPurchase("quota-increase")).toBe(false);
     expect(isPaidAddOnPurchase("allocate")).toBe(false);
   });
+
+  it("requires manage billing for purchases and allocations but not quota requests", () => {
+    expect(requiresManageBilling("purchase")).toBe(true);
+    expect(requiresManageBilling("allocate")).toBe(true);
+    expect(requiresManageBilling("quota-increase")).toBe(false);
+  });
 });