feat(llm-gateway): lift posthog_code per-user caps for orgs billed for Code usage

[adboio]

Problem

PostHog Code is moving from seats to usage-based billing. Once seats are deleted every user is seatless, and the free cap from #70810 would apply to all of them, including users whose org is billed for their usage. The gateway needs to know, per request, whether the org pays for Code usage.

Changes

Billing grants a posthog_code_usage product feature on the paid Code usage plan, and product features already sync to organization.available_product_features. The quota_limits endpoint the gateway polls per team now returns that check as code_usage_billing_active, and the gateway carries it into the throttle context as code_usage_billed.

When it's true and the user has no seat, the per-user cost limit is infinite: usage bills to the org, so the org's own billing limit is the ceiling. Spend is still recorded. The bit fails closed (an org billing doesn't know about reads as not billed), but fetch failures serve the team's last known value from the most recent successful fetch (24h TTL) rather than stamping false into the fail-open cache — a Django blip or one caller's bad token must not re-cap a paying org's users for the window. Quota state keeps failing open. Seat holders keep their caps until seat deletion, since seat-covered usage is unbilled.

That org ceiling now actually reaches the callers it bills. The posthog_code_credits block was scoped to usage-based plan keys, which will never exist (the cutover is clean) — so post-cutover nothing would have blocked anyone once the org's billing limit, or a free org's monthly allocation, was exhausted. And with the seat-split (#69855) closed for the hard cutover, the usage reporter permanently counts every posthog_code generation into the bucket — so exhaustion now blocks every caller, exactly the population being counted. Blocking narrower would let exempted callers burn past the limit their own spend fills; it also means the org ceiling no longer depends on the plan resolver's seat state at all. The credit_bucket_scope machinery and the usage-based-plan vocabulary (is_usage_based_plan, usage_based_plan_prefixes, posthog-code-usage-*) are deleted.

Reads false for everyone until billing ships the posthog_code_usage product, so this deploys with no behavior change. Must be on both gateway regions before the seat deletion runs.

How did you test this code?

Automated only. Gateway suite green (1199): the resolver round-trips the new field through the per-team cache and serves the last-known value on fetch failure (4xx and exhausted retries — without the fallback, a blip re-caps paying users whose recorded spend exceeds the free cap), the cost-throttle matrix pins the bypass to seatless + billed (seat holders and unbilled orgs stay capped), and the bucket-block matrix pins that exhaustion blocks every caller regardless of seat or billing state — a carve-out would let exempted callers burn past the limit they're filling. Django quota_limits/billing_manager tests green (88): the quota_limits test sets real org features and asserts the response field, since dropping it silently re-caps paying users. hogli ci:preflight --fix clean.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

Docs update

None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

PostHog Code session (Claude). Skills: /improving-drf-endpoints, /writing-tests. An earlier revision read this from a new billing endpoint through a cached BillingManager helper; Adam redirected it to the product-features sync, which is how every other product gates paid behavior. A review pass on the open PR caught the fail-open cache overwriting the billing bit with the fail-closed default during upstream failures; fixed by serving the per-team last-known value on the failure paths. A reviewer comment then caught that the org credit ceiling never applied to seatless callers (the bucket block was scoped to plan keys that will never exist); first fixed by scoping the bucket to seatless users, then — after Richard flagged that the usage reporter counts seated generations too and the seat-split (#69855) was closed for the hard cutover — simplified to block every caller, matching the counted population.

---

Created with PostHog Code

[adboio]

• feat(llm-gateway): gate posthog_code models for orgs not billed for Code usage #70951
• feat(llm-gateway): drop posthog_code free valve to $20 #70947
• feat(llm-gateway): lift posthog_code per-user caps for orgs billed for Code usage #70946 👈 (View in Graphite)
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[trunk-io]

     

View Full Report ↗︎ ⋅ Docs

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(llm-gateway): keep last-known code u..." | Re-trigger Greptile}

[github-actions]

🤖 CI report

✅ Playwright — all passed

All tests passed.

View test results →

ℹ️ ClickHouse migration SQL — 1 migration(s)

ClickHouse migration SQL per cloud environment

• unset
  • all

    CREATE OR REPLACE VIEW custom_metrics_test
        AS SELECT
            'ClickHouseCustomMetric_Test' AS name,
            map('instance', hostname()) AS labels,
            1 AS value,
            'Test to check that the metric endpoint is working' AS help,
            'gauge' AS type

    CREATE OR REPLACE VIEW custom_metrics
        AS SELECT * REPLACE (toFloat64(value) as value)
        FROM custom_metrics_test

• US, EU, DEV
  • events, shufflehog

    CREATE OR REPLACE VIEW custom_metrics_test
        AS SELECT
            'ClickHouseCustomMetric_Test' AS name,
            map('instance', hostname()) AS labels,
            1 AS value,
            'Test to check that the metric endpoint is working' AS help,
            'gauge' AS type

    CREATE OR REPLACE VIEW custom_metrics
        AS SELECT * REPLACE (toFloat64(value) as value)
        FROM custom_metrics_test

[veria-ai]

High: Uncapped requests can be attributed to another team

This grants unlimited per-user usage based on context.user.team_id, but the captured billable event still accepts a caller-controlled x-posthog-property-team_id, which the usage reporter uses as the team to charge. A seatless user in a billed organization can therefore send uncapped requests while assigning the costs to an arbitrary or nonexistent team. Bind the billing team used by quota enforcement to the event attribution, or reject external team overrides on posthog_code.

[adboio]

the per-user cap lift keys on the token's real current_team_id, not the header, so a caller can't spoof their way into being uncapped — only misattribute the cost of usage their org is already entitled to.

correcting my earlier take here: i'd said posthog_code shouldn't honor the x-posthog-property-team_id override at all, but that's wrong — it's load-bearing. the code client sets it deliberately (buildGatewayPropertyHeaders({ team_id: projectId })) because the gateway can authenticate with a shared key whose owner team isn't the project the work runs in; the header is what attributes the $ai_generation to the working project rather than the key owner's team. dropping it would misattribute legitimate spend, not fix anything.

so this is the flip side of a real feature: the same header that correctly redirects attribution to your working project can also be pointed at a project you aren't working in. the right fix isn't removing it — it's validating that the header team is one the caller is authorized for (membership / scoped_teams), which needs authorization context the gateway doesn't have cheaply at capture time. that's separate, bigger work, and since this only misattributes cost (no escalation) and needs a raw request bypassing the first-party client, we're not folding it into this stack.

[veria-ai]

Thanks for the detail. I can't automatically confirm this is safe to dismiss, so I'm leaving the thread open for a maintainer to make the call.

[veria-ai]

High: Authorization failures bypass both usage limits

A valid gateway token that lacks project:read can deliberately make the quota endpoint return 403, including through the usage endpoint, which does not enforce posthog_code product access. This path caches limited=False together with the team's last-known paid flag, so subsequent seatless Code requests bypass both the organization credit ceiling and the per-user cap; the caller can repeat the request whenever the one-minute entry expires. Treat caller-specific 4xx responses as a denied or non-cacheable result rather than the same fail-open state used for transient upstream failures.

[adboio]

real mechanism, but there's no reachable exploit for a real posthog_code token: they're minted via the read_only/full presets, both of which include project:read, so the 403 can't be self-induced without a custom-scoped token the product never issues.

and there isn't a clean small fix worth adding:

• serving the last-known billing bit on 4xx is deliberate — it's what stops one caller's bad token from re-capping every other user on the shared per-team cache (the earlier finding fixed in this stack). the cache is per-team but a 4xx is per-caller, so from one entry you can't keep the innocent teammate uncapped while capping the attacker. failing closed reopens that.
• gating the usage endpoint on product access looks like a fix but isn't one: the enforcement path already resolves quota itself, so it poisons the same entry directly — the usage endpoint isn't needed for the attack.

the limited=False-on-4xx fail-open itself came in with the quota enforcement in #69324 that this stack sits on top of (same rollout), not the cap lift here. so we're consciously not hardening this one: no reachable exploit, and the only real lever is Django-side (minter bundling project:read with llm_gateway:read), separable from this PR.

[veria-ai]

This remains reachable outside the presets: Django allows creating a personal API key with only llm_gateway:read when the gateway flag is enabled, and the gateway accepts that as sufficient auth. /v1/usage/{product} only requires get_authenticated_user, while quota_limits requires project:read; that 403 still populates the shared team cache with limited=false plus the last-known billing bit.

[adboio]

fixed in 87329f6 — but not by gating the endpoint. that would've been whack-a-mole (the models listing route resolves quota too, and it serves anonymous callers on purpose), so the fix is one level down in the resolver.

a permanent 4xx now fails open for that one request without writing the shared per-team cache; only transient 5xx/timeout still caches the fallback. so a caller who can force a 403 can no longer pin limited=false (or the last-known billing bit) team-wide — there's nothing left to persist. that covers all three callers (chat, usage, models) at once, and keeps the transient-outage behavior that stops one bad token from re-capping a team.

good catch on the personal-key-via-usage-endpoint path — that's what made it reachable past the OAuth presets, and it's what tipped this from 'not worth hardening' to a real fix.

[veria-ai]

PR overview

This PR changes llm-gateway Code usage throttling so organizations billed for Code usage are not subject to the normal per-user caps. The touched rate-limiting and quota resolution paths determine which team or organization is billed and whether Code requests should be limited.

There are still open security issues in the quota and billing attribution logic. A caller can potentially obtain uncapped Code usage while shifting or avoiding the intended team attribution, and certain authorization failures can be cached in a way that bypasses both organization and per-user limits. These are attacker-triggerable quota and billing bypasses with a clear financial and abuse impact, so the PR remains high risk until the enforcement and attribution paths are bound together correctly.

Open issues (2)

• High: Uncapped requests can be attributed to another team — services/llm-gateway/src/llm_gateway/rate_limiting/cost_throttles.py:256
• High: Authorization failures bypass both usage limits — services/llm-gateway/src/llm_gateway/services/quota_resolver.py:129

Fixed/addressed: 0 · PR risk: 7/10

[richardsolomou]

looks good! some veria comments might be worth looking into tho

[adboio]

Merge activity

• Jul 15, 3:19 PM UTC: @adboio merged this pull request with Graphite.

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-07-15 21:45 UTC	Run
prod-us	✅ Deployed	2026-07-15 22:03 UTC	Run
prod-eu	✅ Deployed	2026-07-15 22:04 UTC	Run