rzyfront/vendix-redis-quota
skills/vendix-redis-quota/SKILL.md
Periodic quota counters with Redis, UTC period keys, Lua-based idempotent AI quota consumption, request-id deduplication, and post-success consumption. Trigger: When building quota counters, enforcing monthly/daily feature caps, or reusing AI quota patterns for uploads, emails, exports, or rate-limited features.
$ install --global
skillsauthnpx skillsauth add rzyfront/vendix vendix-redis-quotaInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 16, 2026, 5:13 AM159.5s1 file scanned
SKILL.md
- name:
- vendix-redis-quota
- description:
- >
- consumption, request-id deduplication, and post-success consumption. Trigger:
- When
- license:
- MIT
- author:
- rzyfront
- version:
- 2.0
- scope:
- [root]
Vendix Redis Quota
Source of Truth
apps/backend/src/domains/store/subscriptions/services/subscription-access.service.tsapps/backend/src/domains/store/subscriptions/types/access.types.tsapps/backend/src/common/redis/redis.module.ts
Current AI Pattern
AI quota checks are read-only. Consumption happens only after a successful operation and requires a stable requestId.
- Quota key:
ai:quota:{storeId}:{feature}:{period}. - Dedup key:
ai:quota:dedup:{storeId}:{feature}:{period}. - Period keys use UTC:
YYYYMMDDfor daily,YYYYMMfor monthly. consumeAIQuota()requires non-emptyrequestId; missing request id throwsInternalServerErrorException.- Consumption uses Redis Lua
evalto deduplicate by request id and increment quota once. - Redis errors during consumption are logged/swallowed because the AI operation already succeeded.
Rules
- Check quota before work; consume only after success.
- Never pre-increment before provider/API work.
- Use UTC period keys to avoid timezone/DST rollover bugs.
- Validate entity ids before interpolating Redis keys.
- Units must be positive integers; floor fractional units when needed.
- Unlimited quota is represented by null, undefined, or
<= 0, not a huge sentinel number. - TTL should outlive the period enough for cleanup: daily about 48h, monthly about 40d.
- If strict retry idempotency matters, require a request id and dedup key.
Generic Non-AI Reuse
For non-AI quotas, either reuse the same Lua+dedup approach or create a dedicated quota service. Use domain-specific prefixes like:
emails:quota:{storeId}:transactional:{YYYYMM}exports:quota:{userId}:pdf:{YYYYMMDD}uploads:quota:{storeId}:images:{YYYYMM}
Do not copy old bare INCRBY + EXPIRE examples for flows where duplicate retries matter.
Failure Semantics
- Check path can fail open or closed depending on the surrounding gate policy.
- Consume path should not throw for Redis infrastructure errors after the protected operation succeeded.
- Missing
requestIdis a programming error in the current AI implementation and should not be swallowed.
Related Skills
vendix-subscription-gatevendix-ai-platform-corevendix-error-handling
Related Skills
rzyfront/mobile-dev
development
VerifiedTrustedCommunity
Mobile app development rules for Vendix Expo/React Native project. Trigger: When editing, creating, or modifying any file under apps/mobile, or when developing mobile-specific features.
5SKILL.mdUpdated May 29, 2026
rzyfront/vendix-subscription-gate
development
VerifiedTrustedCommunity
Feature gating by store subscription state: global store write guard, AI feature gate, Redis feature resolution, quota consumption, frontend paywall interceptor, banner, and subscription UI states. Trigger: When adding feature gates, paywalls, subscription-based access control, protecting store write operations, AI feature gates, or rollout flags.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-saas-billing
testing
VerifiedTrustedCommunity
SaaS subscription billing for Vendix stores: plan pricing, invoices, Wompi platform payments, manual payments, partner commissions, payouts, proration, and dunning. Trigger: When creating SaaS invoices, working with partner rev-share, margin/surcharge pricing, invoice sequence allocation, partner payout batches, subscription payments, manual payments, or dunning flows.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-product-variants
data-ai
VerifiedTrustedCommunity
Product and service variant rules for Vendix: variants as sellable options, inventory-independent availability, service variant booking overrides, and ecommerce/POS/cart behavior. Trigger: When creating, editing, validating, or selling product variants, service variants, products without stock, or any flow where variant availability must not be confused with inventory.
5SKILL.mdUpdated May 16, 2026