Open Source instances report the Enterprise project/environment limits in ui-config resourceLimits (500/50 instead of 1/2)

[truecourse-agent]

Summary

On an Open Source instance, GET /api/admin/ui-config reports resourceLimits.projects: 500 and resourceLimits.environments: 50 — the Enterprise numbers. The documented Open Source limits are 1 project and 2 environments, and those are the real effective limits: an OSS build does not route POST /api/admin/projects or POST /api/admin/environments at all.

The documentation is correct here; it is the server's self-description that is wrong.

Tested on main at 3d91a51635859f13a5bc23547d323c19718629fb (unleash-server 8.1.0), OSS, stock config (no UNLEASH_*_LIMIT env vars set), Postgres 15.

What the server reports

GET /api/admin/ui-config
-> 200
{
  "environment": "Open Source",
  "version": "8.1.0",
  "authenticationType": "open-source",
  ...
  "resourceLimits": {
    "segmentValues": 1000, "strategySegments": 5, "signalEndpoints": 5,
    "actionSetActions": 10, "actionSetsPerProject": 5, "actionSetFilters": 5,
    "actionSetFilterValues": 25, "signalTokensPerEndpoint": 5,
    "featureEnvironmentStrategies": 30, "constraintValues": 250, "constraints": 30,
    "environments": 50, "projects": 500,
    "apiTokens": 2000, "segments": 300, "featureFlags": 5000, "releaseTemplates": 10
  }
}

"environment": "Open Source" and "authenticationType": "open-source" in the same document as projects: 500 / environments: 50.

What the docs say

https://docs.getunleash.io/concepts/resource-limits:

Resource	Open Source limit	Enterprise limit	Environment variable
Projects	1	500	UNLEASH_PROJECTS_LIMIT
Environments	2	50	UNLEASH_ENVIRONMENTS_LIMIT

and, on the same page: "The only limits that can't be changed, are projects and environments for Open Source instances."

The docs are right — the resources cannot be created at all on OSS

# instance already has 1 project ('default')
POST /api/admin/projects        -> 404
{"name":"NotFoundError","message":"The path you were looking for (/api/admin/projects) is not available.", ...}

# instance already has 2 environments (development, production)
POST /api/admin/environments    -> 404
{"name":"NotFoundError","message":"The path you were looking for (/api/admin/environments) is not available.", ...}

The OSS build's own published OpenAPI declares only get for /api/admin/projects and /api/admin/environments, matching src/lib/features/project/project-controller.ts, where every this.route({...}) is method: 'get'.

Control — the same object is correct for other fields

Two of the four rows where the Open Source and Enterprise columns differ are reported at the Open Source number and enforced there:

# constraintValues: documented 250 (OSS) / 1,000 (Enterprise); reported 250
strategy with 251 constraint values -> 400
strategy with 250 constraint values -> 200

featureFlags is likewise reported at the OSS 5,000, not the Enterprise 50,000. So this is a two-field inconsistency inside one object, not a blanket "OSS serves the Enterprise defaults".

Where the numbers come from

src/lib/create-config.ts:763-776:

        environments: Math.max(
            1,
            parseEnvVarNumber(
                process.env.UNLEASH_ENVIRONMENTS_LIMIT,
                options?.resourceLimits?.environments ?? 50,
            ),
        ),
        projects: Math.max(
            1,
            parseEnvVarNumber(
                process.env.UNLEASH_PROJECTS_LIMIT,
                options?.resourceLimits?.projects ?? 500,
            ),
        ),

The defaults are the Enterprise values and nothing lowers them for an OSS build.

Why it matters

resourceLimits is not just informational — the frontend renders limit warnings from it (frontend/src/component/project/Project/CreateProject/CreateProjectForm/CreateProjectDialog.tsx:156, frontend/src/component/environments/CreateEnvironment/CreateEnvironment.tsx:19), and it is the natural thing for an external tool or a support conversation to read when asking "what can this instance hold?". On OSS it currently answers with a number 500x the truth.

Suggested labels: bug