feat: support namespace lockdown

[turip]

Overview

Achieve parity with the billing implementation of namespace lockdown.

Notes for reviewer

Summary by CodeRabbit

• New Features
  • Added namespace lockdown validation to the billing system. Restricted namespaces are now prevented from performing charge creation, advancement, and invoicing operations. The system validates namespace access before executing these transactions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ac50517e-5b0f-42ae-8645-33ae7973c8b7

📥 Commits

Reviewing files that changed from the base of the PR and between 32b5260 and 3a667da.

📒 Files selected for processing (6)

• app/common/billing.go
• app/common/charges.go
• openmeter/billing/charges/service/advance.go
• openmeter/billing/charges/service/create.go
• openmeter/billing/charges/service/invoicependinglines.go
• openmeter/billing/charges/service/service.go

---

📝 Walkthrough

Walkthrough

This PR threads namespace lockdown configuration through the charges service initialization and adds validation checks to prevent operations on locked namespaces. The FSNamespaceLockdown parameter flows from billing registry construction into the charges service, which then validates this constraint before executing Create, AdvanceCharges, and InvoicePendingLines operations.

Changes

Cohort / File(s)	Summary
Service Configuration & Wiring app/common/billing.go, app/common/charges.go	Pass FSNamespaceLockdown parameter through billing registry and charges service constructors into service configuration.
Service Implementation openmeter/billing/charges/service/service.go	Add fsNamespaceLockdown field to service struct and Config, implement validateNamespaceLockdown method to check namespace membership and return a locked namespace error.
Validation Integration openmeter/billing/charges/service/{create,advance,invoicependinglines}.go	Add pre-transaction namespace lockdown validation calls at the start of Create, AdvanceCharges, and InvoicePendingLines methods; skip transaction if validation fails.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix: invoice pending lines via charges #4059: Both PRs modify charges service and billing registry wiring; this PR adds namespace lockdown validation while the related PR re-routes InvoicePendingLines through the charges backend.

Suggested labels

area/api, release-note/misc

Suggested reviewers

• tothandras

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: support namespace lockdown' directly and accurately reflects the main change: adding namespace lockdown functionality across billing charges components.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/support-namespace-lockdown

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}