fix(custom-blocks): stop forwarding the publisher's personal quota to consumers

Author: TheodoreSpeaks

apps/sim/lib/workflows/custom-blocks/child-execution.test.ts

@@ -51,17 +51,49 @@ describe('admitCustomBlockChildExecution', () => {
     await expect(admitCustomBlockChildExecution(attribution)).resolves.toBeUndefined()
   })
 
-  it('throws with the payer message when headroom is exhausted', async () => {
+  it('forwards the payer-scoped message, which describes the shared org', async () => {
     mockCheckAttributedUsageLimits.mockResolvedValue({
       isExceeded: true,
-      message: 'Organization usage limit exceeded',
+      scope: 'payer',
+      message: 'Organization usage limit exceeded: $50.00 pooled of $50.00 organization limit.',
     })
 
-    await expect(admitCustomBlockChildExecution(attribution)).rejects.toBeInstanceOf(
-      CustomBlockAdmissionError
+    await expect(admitCustomBlockChildExecution(attribution)).rejects.toThrow(
+      'Organization usage limit exceeded: $50.00 pooled of $50.00 organization limit.'
     )
   })
 
+  it("never forwards the owner's personal member-cap message to a consumer", async () => {
+    mockCheckAttributedUsageLimits.mockResolvedValue({
+      isExceeded: true,
+      scope: 'member',
+      message:
+        'Member credit limit exceeded: 900 of 1,000 credits used. Ask an admin to raise your credit limit.',
+    })
+
+    const error = await admitCustomBlockChildExecution(attribution).catch((e: Error) => e)
+
+    expect(error).toBeInstanceOf(CustomBlockAdmissionError)
+    expect(error.message).not.toContain('Member credit limit')
+    expect(error.message).not.toContain('900')
+    expect(error.message).toBe(
+      'This custom block is unavailable because a usage limit was reached. Ask an organization admin to review it.'
+    )
+  })
+
+  it("never forwards the owner's account-block message to a consumer", async () => {
+    mockCheckAttributedUsageLimits.mockResolvedValue({
+      isExceeded: true,
+      scope: 'actor',
+      message: 'Account frozen. Please contact support to resolve this issue.',
+    })
+
+    const error = await admitCustomBlockChildExecution(attribution).catch((e: Error) => e)
+
+    expect(error.message).not.toContain('Account frozen')
+    expect(error.message).not.toContain('support')
+  })
+
   it('takes no concurrency reservation', async () => {
     mockCheckAttributedUsageLimits.mockResolvedValue({ isExceeded: false })
 

apps/sim/lib/workflows/custom-blocks/child-execution.ts

@@ -11,11 +11,11 @@ import {
 import { BoundarySafeError } from '@/executor/errors/boundary'
 
 /**
- * The source workspace's payer has no headroom for this custom-block child run.
+ * The payer has no headroom for this custom-block child run.
  *
- * Boundary-safe: publishing and invocation are both gated on a single
- * organization, so the exhausted limit always belongs to the consumer's own org.
- * Surfacing it lets them act on it instead of seeing an opaque failure.
+ * Boundary-safe only as far as the message allows: see
+ * {@link admitCustomBlockChildExecution} for why actor-scoped denials are
+ * collapsed to {@link GENERIC_USAGE_LIMIT_MESSAGE} before reaching here.
  */
 export class CustomBlockAdmissionError extends BoundarySafeError {
   constructor(message: string) {
@@ -24,6 +24,13 @@ export class CustomBlockAdmissionError extends BoundarySafeError {
   }
 }
 
+/**
+ * Consumer-safe stand-in for a denial whose real message describes the SOURCE
+ * workflow owner's personal billing state rather than the shared organization.
+ */
+const GENERIC_USAGE_LIMIT_MESSAGE =
+  'This custom block is unavailable because a usage limit was reached. Ask an organization admin to review it.'
+
 /**
  * Admits one custom-block child run against the SOURCE workspace's payer.
  *
@@ -39,9 +46,23 @@ export async function admitCustomBlockChildExecution(
   attribution: BillingAttributionSnapshot
 ): Promise<void> {
   const usage = await checkAttributedUsageLimits(attribution)
-  if (usage.isExceeded) {
-    throw new CustomBlockAdmissionError(usage.message ?? 'Workspace usage limit exceeded')
-  }
+  if (!usage.isExceeded) return
+
+  // Only the payer-scoped denial describes the shared organization ("Organization
+  // usage limit exceeded: $X pooled of $Y organization limit"), which both sides
+  // genuinely share and which the consumer can act on.
+  //
+  // The other gates are evaluated against `actorUserId` — the SOURCE workflow's
+  // owner — and their text is addressed to that person: their account-frozen /
+  // payment-method state, or "Ask an organization admin to raise YOUR credit
+  // limit" against their individual member cap. Forwarding those verbatim would
+  // show one org member another's private billing state. Being in the same
+  // organization makes the *payer* shared; it does not make personal quotas
+  // shared. The `usage_limit` type still tells the consumer what kind of failure
+  // this was.
+  const message =
+    usage.scope === 'payer' && usage.message ? usage.message : GENERIC_USAGE_LIMIT_MESSAGE
+  throw new CustomBlockAdmissionError(message)
 }
 
 /**