From be9ac18c79e9dc58af1e8c4f11d92d24cb293aa9 Mon Sep 17 00:00:00 2001
From: okxint <cashmein.eth@gmail.com>
Date: Wed, 22 Jul 2026 11:17:40 +0530
Subject: [PATCH] fix(auth): initialize user limit from project policy instead
 of hardcoded 100

listPolicies omits the user limit policy entirely when no limit has been
configured, making userLimitPolicy undefined. The component then fell back
to the hardcoded 100 default. Added getDefaultUserLimitPolicy() to match the
pattern already used for passwordStrengthPolicy, and added a $effect in the
component so value/newLimit stay in sync with the policy prop after invalidation.
---
 .../project-[region]-[project]/auth/security/+page.ts    | 9 ++++++++-
 .../auth/security/updateUsersLimit.svelte                | 5 +++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/routes/(console)/project-[region]-[project]/auth/security/+page.ts b/src/routes/(console)/project-[region]-[project]/auth/security/+page.ts
index 94ba391e9d..b127fe81de 100644
--- a/src/routes/(console)/project-[region]-[project]/auth/security/+page.ts
+++ b/src/routes/(console)/project-[region]-[project]/auth/security/+page.ts
@@ -32,6 +32,11 @@ const getDefaultPasswordStrengthPolicy = (): Models.PolicyPasswordStrength => ({
     symbols: false
 });
 
+const getDefaultUserLimitPolicy = (): Models.PolicyUserLimit => ({
+    $id: ProjectPolicyId.Userlimit,
+    total: 0
+});
+
 export const load: PageLoad = async ({ depends, params }) => {
     depends(Dependencies.PROJECT);
 
@@ -64,7 +69,9 @@ export const load: PageLoad = async ({ depends, params }) => {
             ProjectPolicyId.Sessioninvalidation
         ] as Models.PolicySessionInvalidation,
         sessionLimitPolicy: policiesById[ProjectPolicyId.Sessionlimit] as Models.PolicySessionLimit,
-        userLimitPolicy: policiesById[ProjectPolicyId.Userlimit] as Models.PolicyUserLimit,
+        userLimitPolicy:
+            (policiesById[ProjectPolicyId.Userlimit] as Models.PolicyUserLimit) ??
+            getDefaultUserLimitPolicy(),
         denyAliasedEmailPolicy:
             (policiesById[ProjectEmailPolicyId.DenyAliasedEmail] as EnabledPolicy) ??
             getDefaultEnabledPolicy(ProjectEmailPolicyId.DenyAliasedEmail),
diff --git a/src/routes/(console)/project-[region]-[project]/auth/security/updateUsersLimit.svelte b/src/routes/(console)/project-[region]-[project]/auth/security/updateUsersLimit.svelte
index ee522ea8b9..f39afcb97c 100644
--- a/src/routes/(console)/project-[region]-[project]/auth/security/updateUsersLimit.svelte
+++ b/src/routes/(console)/project-[region]-[project]/auth/security/updateUsersLimit.svelte
@@ -23,6 +23,11 @@
     let value = $state(policy.total !== 0 ? 'limited' : 'unlimited');
     let newLimit = $state(policy.total !== 0 ? policy.total : 100);
 
+    $effect(() => {
+        value = policy.total !== 0 ? 'limited' : 'unlimited';
+        newLimit = policy.total !== 0 ? policy.total : 100;
+    });
+
     const isLimited = $derived(value === 'limited');
     const btnDisabled = $derived.by(() => {
         return (!isLimited && policy.total === 0) || (isLimited && policy.total === newLimit);