Check limits when creating users / locations

crates/defguard_core/src/handlers/user.rs

@@ -43,7 +43,8 @@ use crate::{
                 ldap_handle_user_modify, ldap_remove_user_from_groups, ldap_update_user_state,
             },
         },
-        limits::update_counts,
+        license::get_cached_license,
+        limits::{get_counts, update_counts},
     },
     error::WebError,
     events::{ApiEvent, ApiEventType, ApiRequestContext},
@@ -315,6 +316,18 @@ pub async fn add_user(
     let username = user_data.username.clone();
     debug!("User {} adding user {username}", session.user.username);
 
+    // check if adding new user will go over limits
+    let user_count = get_counts().user();
+
+    if get_cached_license()
+        .as_ref()
+        .and_then(|l| l.limits.as_ref())
+        .is_some_and(|l| l.users == user_count)
+    {
+        error!("Adding user {username} blocked! License limit reached.");
+        return Ok(WebError::Forbidden("License limit reached.".into()).into());
+    }
+
     // check username
     if let Err(err) = check_username(&username) {
         debug!("Username {username} rejected: {err}");

crates/defguard_core/src/handlers/wireguard.rs

@@ -40,7 +40,8 @@ use crate::{
         firewall::try_get_location_firewall_config,
         handlers::CanManageDevices,
         is_business_license_active,
-        limits::update_counts,
+        license::get_cached_license,
+        limits::{get_counts, update_counts},
     },
     events::{ApiEvent, ApiEventType, ApiRequestContext},
     grpc::gateway::events::GatewayEvent,
@@ -223,6 +224,18 @@ pub(crate) async fn create_network(
         session.user.username
     );
 
+    // check if adding new network will go over license limits
+    let location_count = get_counts().location();
+
+    if get_cached_license()
+        .as_ref()
+        .and_then(|l| l.limits.as_ref())
+        .is_some_and(|l| l.locations == location_count)
+    {
+        error!("Adding location {network_name} blocked! License limit reached.");
+        return Ok(WebError::Forbidden("License limit reached.".into()).into());
+    }
+
     data.validate_location_mfa_mode(&appstate.pool).await?;
 
     let allowed_ips = data.parse_allowed_ips();

web/biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.3.14/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.3.15/schema.json",
   "vcs": {
     "enabled": false,
     "clientKind": "git",

web/package.json

@@ -20,7 +20,7 @@
     "@shortercode/webzip": "1.1.1-0",
     "@stablelib/base64": "^2.0.1",
     "@stablelib/x25519": "^2.0.1",
-    "@tanstack/react-form": "^1.28.0",
+    "@tanstack/react-form": "^1.28.1",
     "@tanstack/react-query": "^5.90.21",
     "@tanstack/react-router": "^1.159.5",
     "@tanstack/react-table": "^8.21.3",
@@ -51,7 +51,7 @@
     "zustand": "^5.0.11"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.3.14",
+    "@biomejs/biome": "2.3.15",
     "@inlang/paraglide-js": "2.11.0",
     "@tanstack/devtools-vite": "^0.5.1",
     "@tanstack/react-devtools": "^0.9.5",
@@ -71,7 +71,7 @@
     "prettier": "^3.8.1",
     "sass": "^1.97.3",
     "sharp": "^0.34.5",
-    "stylelint": "^17.2.0",
+    "stylelint": "^17.3.0",
     "stylelint-config-standard-scss": "^17.0.0",
     "stylelint-scss": "^7.0.0",
     "typescript": "~5.9.3",