hardcode some limits (for now)

[naps62]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
stacks	Ready	Preview, Comment	Jan 26, 2026 5:16pm

[Copilot]

Pull request overview

This PR adds hardcoded resource limits to prevent unbounded stack creation in the system. It introduces a per-user limit of 3 stacks and a global limit of 100 stacks across all users.

Changes:

• Added limit constants and validation functions to check user and global stack counts
• Refactored create_stack functions to validate limits before insertion
• Added error handling in the stack controller for limit exceeded scenarios

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
server/lib/ethui/stacks.ex	Adds limit constants, count queries, validation functions, and integrates limit checks into stack creation logic
server/lib/ethui_web/controllers/api/stack_controller.ex	Adds HTTP error responses (403/503) for user and global limit exceeded scenarios

Comments suppressed due to low confidence (2)

server/lib/ethui/stacks.ex:159

• The limit checking has a race condition vulnerability. The count is checked separately from the insert operation, which means multiple concurrent requests could pass the limit check before any insertions complete. This could allow the global limit to be exceeded.

Consider wrapping the count check and insert in a database transaction, or using a database constraint to enforce the limit atomically.

  def get_user_stack_by_slug(nil, slug) do
    Repo.get_by(Stack, slug: slug)
    |> Repo.preload(:api_key)
  end

server/lib/ethui/stacks.ex:164

• The limit checking has a race condition vulnerability. The count is checked separately from the insert operation, which means multiple concurrent requests could pass the limit check before any insertions complete. This could allow users to exceed both the per-user limit and global limit.

Consider wrapping the count check and insert in a database transaction, or using a database constraint to enforce the limits atomically. For example, you could add the count check as part of the Ecto.Multi transaction.

    get_user_stack_by_slug(user_id, slug)
  end

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.