fix(storage): count a finished Bunny upload the moment it lands

Two reasons the number on the storage page could read as nothing.

The per-user Bunny figure was computed inside a two minute cache. The declared
size lands on the row in the same transaction that deletes the reservation, so
for up to two minutes an upload that had just succeeded counted as nothing:
usage fell back towards zero and the next upload was measured against a total
that ignored the one before it. The call to Bunny stays cached, because it is
the slow half and its answer is the same for everybody. The join against our own
rows is now read fresh, per user, on every check.

A failed call to Bunny returned an empty map before it had looked at a single
row, so an account with gigabytes of declared uploads read as empty whenever
Bunny was unreachable. Bunny's figure being gone is not a reason to forget the
sizes we wrote down ourselves.

The rule for which of the two numbers to charge is unchanged, and the comment
above it now says why rather than guessing. What Bunny reports mid-encode is
partial: storageSize counts what has been written so far and climbs as each
rendition lands. A six minute cut uploaded at 2.5 GB read as 475 MB halfway
through and settled above 3 GB once it finished, because Bunny keeps the
original alongside every rendition. Taking the larger of the declared size and
Bunny's is right at every point on that curve; taking Bunny's whenever it is
non-zero would hand most of the quota back in the middle of an encode.

The settings card also claimed a 200 GB limit while showing a 3 GB one, and told
a trial account to delete files or contact support.

lib/admin-stats.ts

@@ -221,12 +221,97 @@ export const getCachedBunnyStorageStats = unstable_cache(
   { revalidate: STORAGE_CACHE_SECONDS }
 );
 
+/**
+ * What this video costs us, as the larger of the two numbers we have.
+ *
+ * Bunny reports nothing for a video until it starts encoding, and what it reports
+ * while encoding is partial: `storageSize` counts what has been written so far and
+ * climbs as each rendition lands. A six minute cut uploaded at 2.5 GB read as
+ * 475 MB midway through and settled above 3 GB once it finished, because Bunny
+ * keeps the original alongside every rendition it makes.
+ *
+ * Both halves of the rule follow from that. Taking Bunny's figure whenever it is
+ * non-zero would hand back most of the quota in the middle of an encode, which is
+ * the hole the declared size exists to close. Taking the declared size forever
+ * would ignore the renditions, which are the actual bill and end up larger than
+ * the source. The larger of the two is right at every point: the declared size
+ * covers the encode, and Bunny's own number takes over the moment it passes it.
+ */
+function chargeableSize(reported: number, declared: bigint | null): number {
+  const declaredBytes = declared === null ? 0 : Number(declared);
+  return reported > declaredBytes ? reported : declaredBytes;
+}
+
+/**
+ * Bunny's reported sizes, or an empty map when the call to Bunny failed.
+ *
+ * A failed stats call is not a reason to bill an account for nothing. Bunny's own
+ * figure is unavailable; the sizes declared at upload are sitting in our database
+ * either way, and reading the whole account as empty is how a full account gets
+ * waved through. Used to be an early return that skipped the rows entirely.
+ */
+function reportedSizes(stats: BunnyStorageStats): Record<string, number> {
+  return stats.totalBytes < 0 ? {} : stats.byVideoId;
+}
+
+/**
+ * What one account's Bunny videos cost, read fresh.
+ *
+ * This deliberately does not come from the cached per-user map. The declared size
+ * lands on the row at the moment an upload finalizes, and a map computed up to two
+ * minutes earlier does not have that row in it. For those two minutes the
+ * reservation is already gone and the row is not yet visible, so an upload that
+ * just succeeded reads as zero: the uploader watches their usage fall back to
+ * nothing, and the next upload is measured against a total that ignores the one
+ * before it.
+ *
+ * The call to Bunny stays cached. It is the slow half and its answer is the same
+ * for everybody. Only the join against our own rows has to be current.
+ */
+export async function getUserBunnyStorageBytes(userId: string): Promise<number> {
+  try {
+    const [bunnyStats, bunnyVersions, bunnyAssets] = await Promise.all([
+      getCachedBunnyStorageStats(),
+      db.videoVersion.findMany({
+        where: {
+          providerId: 'bunny',
+          // The workspace owner, not the project owner: this feeds
+          // getUserTotalStorageBytes, which bills every other provider the same way.
+          video: { project: { workspace: { ownerId: userId } } },
+        },
+        select: { videoId: true, sizeBytes: true },
+      }),
+      db.videoAsset.findMany({
+        where: { provider: 'BUNNY', providerVideoId: { not: null }, billedUserId: userId },
+        select: { providerVideoId: true, sizeBytes: true },
+      }),
+    ]);
+
+    const reported = reportedSizes(bunnyStats);
+    const seenVideoIds = new Set<string>();
+    let total = 0;
+
+    for (const row of [
+      ...bunnyVersions.map((v) => ({ videoId: v.videoId, sizeBytes: v.sizeBytes })),
+      ...bunnyAssets.map((a) => ({ videoId: a.providerVideoId!, sizeBytes: a.sizeBytes })),
+    ]) {
+      if (!row.videoId || seenVideoIds.has(row.videoId)) continue;
+      seenVideoIds.add(row.videoId);
+      total += chargeableSize(reported[row.videoId] || 0, row.sizeBytes);
+    }
+
+    return total;
+  } catch (err) {
+    logError('Failed to calculate Bunny storage for user:', err);
+    return 0;
+  }
+}
+
 export const getCachedUserBunnyStorage = unstable_cache(
   async () => {
     const perUserStorage: Record<string, number> = {};
     try {
       const bunnyStats = await getCachedBunnyStorageStats();
-      if (bunnyStats.totalBytes < 0) return perUserStorage;
 
       const [bunnyVersions, bunnyAssets] = await Promise.all([
         db.videoVersion.findMany({
@@ -262,23 +347,7 @@ export const getCachedUserBunnyStorage = unstable_cache(
         }),
       ]);
 
-      /**
-       * What this video costs us, as the larger of the two numbers we have.
-       *
-       * Bunny reports nothing for a video until it has finished encoding it,
-       * which on a half-hour source is most of an hour, and reading that zero
-       * literally meant an upload was free for as long as it was being
-       * processed: it did not show on the uploader's storage page and it did not
-       * count against the next upload's quota check. The size declared when the
-       * upload was admitted stands in until Bunny has a figure of its own, and
-       * Bunny's wins once it arrives, because the renditions it makes are the
-       * real bill and they are larger than the source.
-       */
-      const chargeableSize = (reported: number, declared: bigint | null): number => {
-        const declaredBytes = declared === null ? 0 : Number(declared);
-        return reported > declaredBytes ? reported : declaredBytes;
-      };
-
+      const reported = reportedSizes(bunnyStats);
       const seenVideoIds = new Set<string>();
       for (const version of bunnyVersions) {
         const ownerId = version.video.project.workspace.ownerId;
@@ -286,7 +355,7 @@ export const getCachedUserBunnyStorage = unstable_cache(
         if (seenVideoIds.has(dedupeKey)) continue;
         seenVideoIds.add(dedupeKey);
 
-        const size = chargeableSize(bunnyStats.byVideoId[version.videoId] || 0, version.sizeBytes);
+        const size = chargeableSize(reported[version.videoId] || 0, version.sizeBytes);
         perUserStorage[ownerId] = (perUserStorage[ownerId] || 0) + size;
       }
 
@@ -297,10 +366,7 @@ export const getCachedUserBunnyStorage = unstable_cache(
         if (seenVideoIds.has(dedupeKey)) continue;
         seenVideoIds.add(dedupeKey);
 
-        const size = chargeableSize(
-          bunnyStats.byVideoId[asset.providerVideoId] || 0,
-          asset.sizeBytes
-        );
+        const size = chargeableSize(reported[asset.providerVideoId] || 0, asset.sizeBytes);
         perUserStorage[billedUserId] = (perUserStorage[billedUserId] || 0) + size;
       }
     } catch (err) {

lib/storage-quota.ts

@@ -2,7 +2,7 @@ import type { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { apiErrors } from '@/lib/api-response';
 import { isStripeFeatureEnabled } from '@/lib/feature-flags';
-import { getCachedUserBunnyStorage } from '@/lib/admin-stats';
+import { getUserBunnyStorageBytes } from '@/lib/admin-stats';
 import { isPaidTier } from '@/lib/billing';
 import { getStorageLimitBytes } from '@/lib/trial-limits';
 
@@ -18,12 +18,59 @@ export const PLAN_STORAGE_LIMIT_BYTES = BigInt(200) * BigInt(1024) * BigInt(1024
  * forget to pass it.
  */
 export async function getStorageLimitForUser(userId: string): Promise<bigint> {
+  return (await getStorageContextForUser(userId)).limitBytes;
+}
+
+export interface StorageContext {
+  /** The ceiling this account is held to. */
+  limitBytes: bigint;
+  /** Whether that ceiling is the plan's or the trial's. */
+  isPaid: boolean;
+}
+
+/**
+ * The ceiling and the reason for it, read together.
+ *
+ * The two travel as a pair because a refusal has to say which one it is: an
+ * unpaid account is out of room because it has not subscribed, and telling it to
+ * delete files is advice that does not apply.
+ */
+export async function getStorageContextForUser(userId: string): Promise<StorageContext> {
   const user = await db.user.findUnique({
     where: { id: userId },
     select: { subscriptionStatus: true, stripeCurrentPeriodEnd: true },
   });
 
-  return getStorageLimitBytes(user ? isPaidTier(user) : false, PLAN_STORAGE_LIMIT_BYTES);
+  const isPaid = user ? isPaidTier(user) : false;
+  return { limitBytes: getStorageLimitBytes(isPaid, PLAN_STORAGE_LIMIT_BYTES), isPaid };
+}
+
+/**
+ * Whole gigabytes where the number is whole, which every ceiling we ship is.
+ * A host that sets an odd one gets a decimal rather than a rounded lie.
+ */
+function formatStorageLimit(bytes: bigint): string {
+  const gigabytes = Number(bytes) / 1024 ** 3;
+  return `${Number.isInteger(gigabytes) ? gigabytes : gigabytes.toFixed(1)} GB`;
+}
+
+/**
+ * The refusal, in the words that fit the account it is being given to.
+ *
+ * A paying account that has filled 200 GB has to delete something. An unpaid one
+ * has three gigabytes because it has not subscribed, so the way out is the
+ * subscription, and the response says so under its own error code rather than
+ * leaving the client to guess from the number.
+ */
+export function storageExceededResponse(context: StorageContext): NextResponse {
+  if (context.isPaid) {
+    return apiErrors.storageExceeded() as NextResponse;
+  }
+
+  return apiErrors.trialStorageExceeded(
+    `Your free trial includes ${formatStorageLimit(context.limitBytes)} of storage. ` +
+      `Upgrade to get ${formatStorageLimit(PLAN_STORAGE_LIMIT_BYTES)}.`
+  ) as NextResponse;
 }
 
 // TTL for upload reservations: 30 minutes is enough for R2 image/audio uploads
@@ -66,7 +113,7 @@ class QuotaExceededError extends Error {}
  * every upload.
  */
 export async function getUserTotalStorageBytes(userId: string): Promise<bigint> {
-  const [r2AssetRows, r2VideoRows, bunnyByUser, reservationRows] = await Promise.all([
+  const [r2AssetRows, r2VideoRows, bunnyUserBytes, reservationRows] = await Promise.all([
     db.$queryRaw<[{ total: bigint }]>`
       SELECT COALESCE(SUM(size_bytes), 0)::bigint AS total
       FROM video_assets
@@ -82,7 +129,7 @@ export async function getUserTotalStorageBytes(userId: string): Promise<bigint>
       WHERE w."ownerId" = ${userId}
         AND vv."providerId" = 'r2'
     `,
-    getCachedUserBunnyStorage(),
+    getUserBunnyStorageBytes(userId),
     db.$queryRaw<[{ total: bigint }]>`
       SELECT COALESCE(SUM("sizeBytes"), 0)::bigint AS total
       FROM upload_reservations
@@ -93,7 +140,7 @@ export async function getUserTotalStorageBytes(userId: string): Promise<bigint>
 
   const r2AssetBytes = r2AssetRows[0]?.total ?? BigInt(0);
   const r2VideoBytes = r2VideoRows[0]?.total ?? BigInt(0);
-  const bunnyBytes = BigInt(bunnyByUser[userId] ?? 0);
+  const bunnyBytes = BigInt(bunnyUserBytes);
   const reservedBytes = reservationRows[0]?.total ?? BigInt(0);
 
   return r2AssetBytes + r2VideoBytes + bunnyBytes + reservedBytes;
@@ -136,13 +183,13 @@ export async function enforceStorageQuota(
     return null;
   }
 
-  const [usedBytes, limitBytes] = await Promise.all([
+  const [usedBytes, storage] = await Promise.all([
     getUserTotalStorageBytes(userId),
-    getStorageLimitForUser(userId),
+    getStorageContextForUser(userId),
   ]);
 
-  if (usedBytes + incomingSizeBytes >= limitBytes) {
-    return apiErrors.storageExceeded() as NextResponse;
+  if (usedBytes + incomingSizeBytes >= storage.limitBytes) {
+    return storageExceededResponse(storage);
   }
 
   return null;
@@ -176,11 +223,11 @@ export async function reserveStorageQuota(
   // Fetch Bunny storage and the account's ceiling BEFORE entering the transaction,
   // to avoid holding the advisory lock during a potentially slow/failing HTTP call
   // on cache miss or an extra round trip to Postgres.
-  const [bunnyData, limitBytes] = await Promise.all([
-    getCachedUserBunnyStorage(),
-    getStorageLimitForUser(userId),
+  const [bunnyUserBytes, storage] = await Promise.all([
+    getUserBunnyStorageBytes(userId),
+    getStorageContextForUser(userId),
   ]);
-  const bunnyBytes = BigInt(bunnyData[userId] ?? 0);
+  const bunnyBytes = BigInt(bunnyUserBytes);
 
   try {
     const reservationId = await db.$transaction(async (tx) => {
@@ -222,7 +269,7 @@ export async function reserveStorageQuota(
       const reservedBytes = resRow?.total ?? BigInt(0);
 
       const totalUsed = r2Bytes + reservedBytes + bunnyBytes;
-      if (totalUsed + incomingSizeBytes >= limitBytes) {
+      if (totalUsed + incomingSizeBytes >= storage.limitBytes) {
         throw new QuotaExceededError();
       }
 
@@ -237,7 +284,7 @@ export async function reserveStorageQuota(
     return { reservationId };
   } catch (e) {
     if (e instanceof QuotaExceededError) {
-      return { error: apiErrors.storageExceeded() as NextResponse };
+      return { error: storageExceededResponse(storage) };
     }
     throw e;
   }