You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(web): per-user collection cap and moderation plan for public collections #114
With SKILLX_COLLECTIONS_API enabled (#112), any signed-in user can create an unlimited number of collections (only the write rate limiter applies; listing is capped at 200), including public ones with user-chosen names up to 120 chars, without owning a publisher. Consider a per-user cap (e.g. reject over N with 409/429) and a moderation path (admin hide/quarantine) for public collections. Found during review of #112.
This shipped in #115 (squash commit dfcb3f1 on main).
Cap: each account can keep at most 100 collections. Set SKILLX_COLLECTIONS_MAX_PER_USER to change it. A create or clone over the cap returns 409 collection.limit_reached, and the check is atomic in the insert.
Moderation:POST /api/v1/collections/:id/moderation takes {from, to, reason?} (admin secret only) and moves a collection between active and hidden. It uses an audited compare-and-set in release_state_audit.
A hidden collection returns 404 to everyone except its owner.
The owner cannot clone or delete it.
GET on the same path returns the state, the latest revision and the history.
Evidence:
CI web-contracts-cli passed.
Local pnpm typecheck, pnpm test (2315 passed) and pnpm build were all clean.
Deploy follow-up: apply migration 0020_collection_moderation with pnpm run db:migrate:remote, after a backup. It is additive and safe in either deploy order. Until it runs, only the moderation route fails.
Activity
mrgoonie commentedon Oct 20, 2026
This shipped in #115 (squash commit
dfcb3f1onmain).SKILLX_COLLECTIONS_MAX_PER_USERto change it. A create or clone over the cap returns409 collection.limit_reached, and the check is atomic in the insert.POST /api/v1/collections/:id/moderationtakes{from, to, reason?}(admin secret only) and moves a collection betweenactiveandhidden. It uses an audited compare-and-set inrelease_state_audit.GETon the same path returns the state, the latest revision and the history.web-contracts-clipassed.pnpm typecheck,pnpm test(2315 passed) andpnpm buildwere all clean.Deploy follow-up: apply migration
0020_collection_moderationwithpnpm run db:migrate:remote, after a backup. It is additive and safe in either deploy order. Until it runs, only the moderation route fails.Generated by Claude Code
feat(web): per-account collection cap and admin moderation for collec…