Method handleInvalidateLimits

internal/agent/limits_api.go:63–102

handleInvalidateLimits busts the in-process limits cache for the given user. Called by the external provisioner (billing sidecar) immediately after it writes account_limits, so the next request from that user sees the new caps without waiting ~60s for natural TTL expiry. Authentication is a shared

(w http.ResponseWriter, r *http.Request)

// provisioner. Self-hosters who don't run a provisioner simply leave
// InternalAPISecret empty and the endpoint 503s.
func (a *API) handleInvalidateLimits(w http.ResponseWriter, r *http.Request) {
	if a.internalAPISecret == "" {
		http.Error(w, "internal api not configured", http.StatusServiceUnavailable)
		return
	}
	if a.enforcer == nil {
		http.Error(w, "limits subsystem not configured", http.StatusServiceUnavailable)
		return
	}

	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 1024))
	if err != nil {
		http.Error(w, "invalid request body", http.StatusBadRequest)
		return
	}

	sig := r.Header.Get("X-E2A-Internal-Signature")
	if sig == "" {
		http.Error(w, "missing signature", http.StatusUnauthorized)
		return
	}
	expected := hmacHexSHA256([]byte(a.internalAPISecret), body)
	if subtle.ConstantTimeCompare([]byte(sig), []byte(expected)) != 1 {
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}

	var req invalidateLimitsRequest
	if err := json.Unmarshal(body, &req); err != nil {
		http.Error(w, "invalid request body", http.StatusBadRequest)
		return
	}
	if req.UserID == "" {
		http.Error(w, "user_id is required", http.StatusBadRequest)
		return
	}

	a.enforcer.Invalidate(req.UserID)
	w.WriteHeader(http.StatusNoContent)
}

func hmacHexSHA256(key, body []byte) string {
	h := hmac.New(sha256.New, key)