Concurrent User limit

[miraserver]

令牌并发限制（Concurrent）好像没法从用户那里继承 也就是说即便给用户设了 15 的限制 令牌（Key）那边还是可以无限并发

[github-actions]

Thank you for reporting this issue.

Analysis:

You are correct. The key-level concurrent session limit (limitConcurrentSessions) does not inherit from the user-level concurrent session limit. They are checked independently.

Here's what happens in the rate limit guard (src/app/v1/_lib/proxy/rate-limit-guard.ts):

Step 1 — Key concurrent check (line 121-124):

const sessionCheck = await RateLimitService.checkSessionLimit(
  key.id,
  "key",
  key.limitConcurrentSessions ?? 0  // uses the KEY's own limit
);

Step 2 — User concurrent check (line 157-162):

if (user.limitConcurrentSessions != null && user.limitConcurrentSessions > 0) {
  const userSessionCheck = await RateLimitService.checkSessionLimit(
    user.id,
    "user",
    user.limitConcurrentSessions  // uses the USER's own limit
  );
}

The key check uses key.limitConcurrentSessions ?? 0, and in the schema (src/drizzle/schema.ts:114), the key's default is 0. When the limit is 0, checkSessionLimit (src/lib/rate-limit/service.ts:519) immediately returns { allowed: true } — effectively no limit.

The user-level check (step 2) does enforce the user's limit, but it counts user-level active sessions via SessionTracker.getUserSessionCount(userId). This means:

• If a user has limitConcurrentSessions = 15, the user as a whole is capped at 15 concurrent sessions across all their keys.
• But each individual key under that user has no concurrent limit of its own (default 0 = unlimited), so there's no per-key enforcement that respects the user's cap at the key level.

In practice, the user-level check should still block requests once the user reaches 15 total concurrent sessions across all keys. However, if you're observing that keys bypass this entirely, the issue may be related to how sessions are tracked separately per key vs. per user in Redis (different sorted sets: key:{id}:active_sessions vs user:{id}:active_sessions).

Potentially affected code:

• src/app/v1/_lib/proxy/rate-limit-guard.ts (lines 121-193) — concurrent limit enforcement
• src/lib/rate-limit/service.ts (lines 514-545) — checkSessionLimit implementation
• src/lib/session-tracker.ts — session counting per key/user
• src/drizzle/schema.ts (line 114) — key limitConcurrentSessions default value

To help diagnose further, could you clarify:

• When you set the user's concurrent limit to 15, are you seeing more than 15 total concurrent sessions for that user (across all keys)?
• Or is the concern that individual keys under the user don't show/enforce the "15" limit in the UI/API?
• Are you checking the key's concurrent limit field in the dashboard and seeing it as 0/empty rather than inheriting 15 from the user?

If the expectation is that keys should inherit the user's concurrent limit as a default when the key's own limit is unset, that would require a code change — currently there is no such inheritance logic for limitConcurrentSessions (or any other limit field) from user to key.

---

Automated response from Claude AI