feat: Add Redis-based workspace stream quota for WebRTC sessions#2025
Merged
rafel-roboflow merged 51 commits intomainfrom Mar 19, 2026
Merged
Conversation
- Limit concurrent WebRTC streams per workspace (default: 10) - Return HTTP 429 when quota exceeded - Add heartbeat endpoint for Modal workers to refresh session TTL
rafel-roboflow
requested review from
PawelPeczek-Roboflow,
dkosowski87,
grzegorz-roboflow,
hansent,
probicheaux and
yeldarby
as code owners
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…streams-and-update
Collaborator
|
@rafel-roboflow - sorry, will not be added to todays release |
…-set-rate-limit-to-10-concurrent-streams-and-update
…-update' of github.com:roboflow/inference into feat/dg-232-set-rate-limit-to-10-concurrent-streams-and-update
Contributor
⚡️ Codeflash found optimizations for this PR📄 153% (1.53x) speedup for
|
…etr' into feat/dg-232-set-rate-limit-to-10-concurrent-streams-and-update
…streams-and-update
…-set-rate-limit-to-10-concurrent-streams-and-update
…-update' of github.com:roboflow/inference into feat/dg-232-set-rate-limit-to-10-concurrent-streams-and-update
…streams-and-update
grzegorz-roboflow
previously approved these changes
Mar 4, 2026
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
…streams-and-update
The heartbeat and session-end endpoints were returning plain dicts with
{"status": "error"} on auth failure, which FastAPI serialized as HTTP 200.
This caused the watchdog client to log these as successful heartbeats,
masking authentication failures from operators.
Now raises HTTPException with 401 for unauthorized and 404 for session
not found.
…-set-rate-limit-to-10-concurrent-streams-and-update
…-update' of github.com:roboflow/inference into feat/dg-232-set-rate-limit-to-10-concurrent-streams-and-update
…streams-and-update
…-set-rate-limit-to-10-concurrent-streams-and-update
…-set-rate-limit-to-10-concurrent-streams-and-update
…-update' of github.com:roboflow/inference into feat/dg-232-set-rate-limit-to-10-concurrent-streams-and-update
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
…-set-rate-limit-to-10-concurrent-streams-and-update
…streams-and-update
| raise HTTPException( | ||
| status_code=401, | ||
| detail={"status": "error", "message": "unauthorized"}, | ||
| ) |
Collaborator
There was a problem hiding this comment.
lets raise if workspace_id is empty / None
grzegorz-roboflow
previously approved these changes
Mar 19, 2026
…-set-rate-limit-to-10-concurrent-streams-and-update
…-update' of github.com:roboflow/inference into feat/dg-232-set-rate-limit-to-10-concurrent-streams-and-update
grzegorz-roboflow
approved these changes
Mar 19, 2026
rafel-roboflow
deleted the
feat/dg-232-set-rate-limit-to-10-concurrent-streams-and-update
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Related Issue(s): DG-232
Type of Change
Testing
Test details:
I put max connections=3;
Checklist
Additional Context
Note
Medium Risk
Adds Redis-backed quota enforcement to WebRTC session startup plus new heartbeat/end endpoints, which can block sessions (HTTP 429) if misconfigured or if Redis/heartbeat traffic behaves unexpectedly.
Overview
Adds an optional per-workspace concurrent WebRTC stream quota enforced via Redis, including new env knobs (
WEBRTC_WORKSPACE_STREAM_QUOTA_ENABLED, quota, TTL, and heartbeat URL/interval).WebRTC worker startup now assigns a
session_id/workspace_id, checks the workspace quota, registers the session, and returns HTTP 429 (WorkspaceStreamQuotaError) when exceeded. Modal workers periodically call new HTTP endpoints (/webrtc/session/heartbeatand/webrtc/session/heartbeat/end) via an updated watchdog to refresh or release session slots, and heartbeat callbacks are made nullable-safe.Written by Cursor Bugbot for commit 4f0476c. This will update automatically on new commits. Configure here.