- Shipped
- September 7, 2026 at 6:52 AM UTC
- Author
- Kamo
- Commit
- 6c7ca3d
The launchpad is getting a storage meter, and the obvious way to feed it is a request of its own on every page load. The numbers do not deserve one: "used" comes from a snapshot the nightly sweep took last night, so a dedicated endpoint would be a round trip to re-fetch a figure that cannot have changed since. /api/security/entitlements/me is already one request per tab, shared by eleven consumers and cached fifteen minutes in Redis behind a ~60s browser cache. Riding it costs the launchpad nothing at all. And nothing had to be wired to do it: SecurityService already lists both com.kamo.z.shared.storage.usage and com.kamo.z.shared.commerce on its @EnableJpaRepositories, so StorageQuotaService has been live here the whole time — quota, trend and the purchasable block are five small indexed reads on a cache miss, and only for an owner. The field is computed ONLY for an organization owner, in both build paths. Withholding it on the server rather than hiding it in the browser is the same choice /self/plan makes about seats and renewal: a member who opens the network tab learns nothing about what the organization is holding or paying for. `asOf` is nullable and that is load-bearing. Null means the sweep has never run for this org, so usage is zero because nobody has looked — a client that reads it as an honest zero draws an empty bar for an organization that may be full.