fix: ent gating

[TEJASNARAYANS]

What changed?

This PR separates open-source (OSS) limits from Enterprise-only capabilities across the backend, frontend, and docs. Without a valid EFFICIENTAI_LICENSE, deployments run in OSS mode with enforced caps; with a license, Enterprise features unlock automatically.

Backend — OSS quotas

New app/core/oss_quotas.py enforces per-org limits when there is no enterprise entitlement:

Resource	OSS limit
User metrics	5
Agents	3
Org members	1 (solo use)
Workspaces	1

Quotas are enforced on create/invite flows (metrics, agents, IAM invitations, workspace creation, etc.).

Backend — Enterprise license gating

• app/core/license.py — DEFAULT_ENTERPRISE_OFFERINGS auto-enable for any valid license:
  • alerts, metric_studio, db_sharding, llm_gateway
• API routes gated behind require_enterprise_feature() or require_enterprise_entitlement():
  • Alerts, Metric Studio, Workspace IAM, LLM gateway settings
  • Gateway/inherit routing on AI providers & integrations (OSS must use direct routing)
• LLM gateway resolver — has_valid_license() required before Bifrost/LiteLLM routing applies
• DB sharding — sessions gated by enterprise entitlement
• Settings API — /license-info exposes quotas, usage, and enabled features

Frontend — entitlement-aware UI

• useOssQuotas hook + apiErrors.ts for structured 403 handling (oss_quota_exceeded, enterprise_license_required)
• licenseStore expanded with feature flags and quota state
• Gated/disabled UI on IAM, Integrations, Voice Bundles, Prompt Partials, Metrics, Agents, workspace switcher

Docs

• Advanced guides: IAM and Alerting
• Enterprise comparison table and license clarifications in LICENSE / enterprise/LICENSE.md

Tests & CI fixes

• New suites: test_enterprise_gating, test_oss_quotas, test_license_offerings, sharding session tests
• Root conftest autouse fixture simulates a deployment-wide license in CI (GHA has no real license)
• Fixes for voice-agent cookie auth (media_urls.py) and operational health endpoint trusted-host tests

---

Why?

v1.5.34 shipped IAM, Alerting, and LLM gateway as Enterprise capabilities, but enforcement was incomplete — OSS installs could still use gateway routing, multi-member IAM, and unlimited resources. This PR makes licensing boundaries consistent in API responses, UI, and tests so OSS and Enterprise behavior match the docs.

---

How to test

1. OSS mode (no license):

   unset EFFICIENTAI_LICENSE
   pytest tests/test_api/test_enterprise_gating.py -v

   Expect 403 on alerts, metric studio, workspace IAM, gateway routing.

2. Enterprise mode (with license):

   export EFFICIENTAI_LICENSE=<your-jwt>
   pytest tests/test_services/test_ai/test_llm_gateway.py tests/test_api/test_workspace_iam.py -v

3. Full suite (CI parity):

   make test-parallel

4. Manual UI checks:

   • Without license: IAM invite blocked, integration gateway routing disabled, quota banners shown
   • With license: IAM, alerting, gateway settings accessible

---

Scope note

The branch includes the merged docs revamp from #127 (already released as v1.5.34). The net new work in #128 is roughly 62 files, +3,053 / −417 lines focused on enterprise gating, OSS quotas, frontend entitlement UX, and test/CI fixes.

---

The PR body on GitHub is still the default template — I can paste this into #128 if you want.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the prior quota race, sharding fallback, stale quota display, and expired-license provider-edit issues are addressed in the current code.

Findings

1.  Quota usage stays stale ▶

Summary

This PR revises enterprise licensing and feature gates, adds concurrency-safe OSS resource quotas, fails closed when configured database sharding loses entitlement, and aligns the frontend with the resulting feature availability.

• Adds organization-level locking around OSS quota enforcement and refreshes frontend quota usage after mutations.
• Gates alerts, Metric Studio, LLM gateway configuration, custom providers, and sharding while making prompt optimization available in OSS.
• Updates AI-provider editing so expired or missing licenses do not prevent unrelated edits or cleanup of existing gateway configuration.
• Updates documentation, licensing terms, tests, and test entitlement isolation for the revised product boundaries.

_{Reviews (7) · Last reviewed commit: "fix: updating test cases"}

[greptile-apps]

Quota usage stays stale

These controls use the quota usage stored by the one-time license fetch, but successful resource creation and deletion do not refresh that store. After creating the final allowed resource, the UI remains enabled and leads to an avoidable server rejection. After deleting from a full quota, the UI remains disabled and blocks a valid action until the page is reloaded.

Knowledge Base Used: Web application experience

[greptile-apps]

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

•  Release dates depend on timezone docs-fumadocs/scripts/generate-changelog-nav.mjs:50 ▶

  published_at is formatted using the process-local timezone. Running this generator in different environments can therefore move a release to the previous or next calendar day, producing unstable documentation; several regenerated pages already shifted by one day.

    return new Date(iso).toLocaleDateString('en-US', {
      year: 'numeric',
      month: 'short',
      day: 'numeric',
      timeZone: 'UTC',
    });
  

•  Template text becomes release notes docs-fumadocs/scripts/generate-changelog-nav.mjs:89 ▶

  The generator accepts any non-empty matching PR section as release content, including untouched template instructions such as “Briefly describe what this PR changes.” It then skips the release-body fallback, so generated pages such as v1.5.5 publish boilerplate instead of useful release notes.