Skip to content

docs: document undocumented customer-facing changes from the last week - #11677

Open
keydunov wants to merge 1 commit into
masterfrom
claude/gallant-ramanujan-t02wsm
Open

docs: document undocumented customer-facing changes from the last week#11677
keydunov wants to merge 1 commit into
masterfrom
claude/gallant-ramanujan-t02wsm

Conversation

@keydunov

Copy link
Copy Markdown
Member

Check List

  • Docs have been added / updated if required
  • Tests have been run in packages where changes have been made if available
  • Linter has been run for changed code
  • Tests for the changes have been added if not covered yet

Description of Changes Made

Weekly documentation audit against recent cube-js/cube and cubedevinc/cubejs-enterprise
commits, filtered against the customer-facing criteria. Three shipped features were
missing docs (or had gone stale):

  • Provisioning embed users ahead of a session — new POST /embed-tenants/{embedTenantName}/user and .../users admin endpoints let an
    integration create/update embed users from its own directory before they ever
    open the embed. Documented under the existing "Embed-tenant admin API" section
    of the Generate Session reference.
  • Cube Store per-user WebSocket connection capCUBESTORE_MAX_WS_CONNECTIONS_PER_USER
    was already in the environment variables reference but not cross-linked from the
    Cube Store architecture page's connection/transport docs. Added a short
    "Connection limits" subsection next to the existing "Message size limits" one.
  • AI Tokens Usage tab split into AI Usage / AI Requests — the billing docs still
    referenced the old single "AI Tokens Usage" tab, which was split into two tabs
    with different scopes (aggregate spend vs. raw request log). Updated the
    "Tracking usage" section and a stale cross-reference in the BYOM docs.

All other candidate changes from the last week were checked and found already
documented (e.g. COPY ... FROM STDIN, the queue fast-track flag, cube dbt sync,
multi-sheet placements in the Sheets/Excel add-on) or not customer-facing
(internal instrumentation/analytics events).


Generated by Claude Code

- Provisioning embed users ahead of their first session (POST
  /embed-tenants/{embedTenantName}/user and /users)
- Cube Store's per-user WebSocket connection cap
  (CUBESTORE_MAX_WS_CONNECTIONS_PER_USER)
- The AI Tokens Usage tab split into AI Usage and AI Requests
@mintlify

mintlify Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated (UTC)
cubed3 🟢 Ready View Preview Aug 28, 2026, 12:22 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

@claude

claude Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Claude finished @keydunov's task in 2m 32s —— View job


Review complete — docs-only, no blockers. 0 high, 2 medium, 2 low (4 inline comments).

The Cube Store section is accurate against the Rust source; the two mediums are both in generate-session.mdx (a heading that now reads as the wrong endpoint's response, and a tenantGroups reference with nowhere to look it up).

Full review
  • Read PR diff
  • Verify CUBESTORE_MAX_WS_CONNECTIONS_PER_USER claims against Rust source
  • Verify anchors/links resolve
  • Check embed provisioning endpoint docs for internal consistency
  • Post review

What I verified

Cube Store connection limits — accurate, no changes needed. Every claim in the new section checks out against rust/cubestore/cubestore/src/http/mod.rs:169-278 and config/mod.rs:1972:

Claim Source
Env var exists, parsed as usize config/mod.rs:1972
Default 0, disables the cap config/mod.rs:1974; acquire short-circuits when limit > 0 is false (mod.rs:225)
Oldest connection closed to admit the new one mod.rs:254-263 — evicts entries.keys().next() (BTreeMap keyed by monotonic id)
"a client that still needs it reconnects" Matches the doc comment at mod.rs:173-175 almost verbatim
Counted per node Counter is per-HttpServer (mod.rs:386)

The anchor #cubestore_max_ws_connections_per_user resolves to the heading at environment-variables.mdx:1978, and matches the linking style used elsewhere in that file. #groups in the embed page resolves to ## Groups (line 153).

One thing the docs don't mention and arguably shouldn't: the counter fails open on lock timeout (mod.rs:194-196, 238-252), admitting an untracked connection. That's correct behavior for a safety net and probably below the customer-facing bar — noting it only so the omission is a decision rather than an oversight.

Findings

# Severity File Issue
1 Medium generate-session.mdx:315 ### Response (Generate Session's { sessionId }) now sits directly after the new provisioning section, so it reads as the response of POST .../users — which the same section says returns succeeded/failed. Pre-existing mis-nesting that this PR makes materially more misleading.
2 Medium generate-session.mdx:296-303 tenantGroups is presented as one of the fields "generate-session accepts", but it's documented nowhere on the page (only in api-reference/api.yaml). The [Groups](#groups) link sends the reader to a section exclusively about the tenant-wide groups field.
3 Low ai-tokens.mdx:78-84 The rewrite drops "Remaining allocation from per-seat grants and token packages"; the page now never says where an admin sees remaining balance, even though ## When limits are reached immediately tells them to buy more. Plus: "a rolling window of hours" is vague, and AI Usage collides with the existing AI Usage dashboard in usage-analytics.mdx:60.
4 Low generate-session.mdx:289-292 The two new POST endpoints aren't in the generated api-reference/api.yaml (which only has GET .../users, listEmbedUsers). Worth re-running scripts/extract-api.mjs so prose and OpenAPI agree.

Notes

  • Not verifiable from this repo. The embed provisioning endpoints live in cubedevinc/cubejs-enterprise, so I could not confirm the behavioral claims — the accepted/rejected field lists, "always returns 200", the succeeded/failed ordering guarantee, idempotency on externalId, or on-demand embed-tenant creation. Those need a reviewer with access to the implementation. The api.yaml regeneration in finding Self reference guard in schema compiler #4 would settle most of them.
  • Style. Reads well and follows docs-mintlify/CLAUDE.md: surgical edits to existing pages, no new pages, no padding, root-relative internal links, correct heading levels. The explanation of why session-only fields are rejected ("provisioning can't be a second source of truth for row-level security") is the kind of rationale that saves a support ticket — good call including it.
  • No prior review threads on this PR, so nothing to resolve or dedupe against.
  • Nothing to run: docs-only change, no lint or test surface touched.
• [`claude/gallant-ramanujan-t02wsm`](https://github.com/cube-js/cube/tree/claude/gallant-ramanujan-t02wsm)

rejected — and the embed tenant itself is created on demand if it doesn't
exist yet.

### Response

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

### Response now reads as the provisioning endpoints' response.

### Response documents the Generate Session response ({ "sessionId": ... }). It was already awkwardly nested under ## Embed-tenant admin API, but before this PR it at least sat right after a short paragraph. Now it immediately follows a section that describes two POST endpoints and explicitly says the bulk one returns succeeded/failed — so a reader scrolling in lands on "Response → { "sessionId": ... }" and reasonably concludes that's what POST .../users returns.

Cheapest fix while you're in here: promote it back out of the admin-API section, e.g. rename to ## Generate Session response and move it above ## Embed-tenant admin API, or at minimum retitle it ### Generate Session response.

Fix this →

Comment on lines +296 to +303
The single-user endpoint takes one body with the same fields `generate-session`
accepts for an external user — `externalId`, `email`, `userProfile`, `groups`,
`tenantGroups` — so an integration uses one vocabulary whether it pushes its
directory ahead of time or lets a session provision the user. Session-only
fields (`userAttributes`, `securityContext`) aren't accepted here: a later
session re-applies them anyway, so provisioning can't be a second source of
truth for row-level security. `groups` and `tenantGroups` follow the same
replace-when-supplied, clear-with-`[]`, preserve-when-omitted rules as

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tenantGroups isn't documented on this page — the framing and the #groups link both dead-end.

Two problems in this paragraph:

  1. It presents the accepted fields as "the same fields generate-session accepts for an external user — externalId, email, userProfile, groups, tenantGroups", but tenantGroups appears nowhere else in this file: it's not a row in the Request Body table and not in the <Info> list of fields disallowed with internalId. So the sentence's whole point ("one vocabulary") is undercut — the reader can't look the field up. It's only described in api-reference/api.yaml and api-reference/changelog.mdx.
  2. [Groups](#groups) resolves, but that section is exclusively about groups (tenant-wide names, embed_user_groups in creator mode). Sending the reader there for tenantGroups semantics gives them the wrong scope, and the replace/clear/preserve table there never mentions tenantGroups.

Suggest adding a tenantGroups row to the Request Body table and a short paragraph under ## Groups (or a sibling ## Tenant groups) before pointing at it from here.

Fix this →

Comment on lines +78 to +84
Administrators can monitor token consumption on the billing settings page,
under two tabs:

- Total token usage over time
- Remaining allocation from per-seat grants and token packages
- Breakdown by usage dimension
- **AI Usage** — aggregate spend per user or per role over a billing period,
with a chart and a table. Covers the full period, not just recent activity.
- **AI Requests** — the raw request log, on a rolling window of hours with a
live tail of new requests as they come in.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rewrite drops "remaining allocation" and nothing else on the page covers it.

The old bullet list included "Remaining allocation from per-seat grants and token packages" — that's the one thing an admin most wants from this page, and it's now unmentioned anywhere in the file. It matters directly for the very next section (## When limits are reached), which tells admins to go buy packages but never says where they can see how much is left. If the AI Usage tab still shows remaining balance, keep a clause for it.

Two smaller things:

  • "on a rolling window of hours" is vague — say the actual window (e.g. "the last 24 hours") or drop the qualifier and just call it a live log of recent requests.
  • AI Usage collides with the existing AI Usage dashboard in Usage Analytics. Same name, different surface. Worth a parenthetical here (or in the Usage Analytics row) so the two don't get confused — the BYOM line names the tabs with no location qualifier at all.
  • "aggregate spend per user or per role" — the page is about tokens, and spend only applies to on-demand/contract customers. If the tab shows tokens with a cost column, say "token usage and cost".

Fix this →

Comment on lines +289 to +292
your own user directory, before their first session — use:

```text
POST /api/v1/embed-tenants/{embedTenantName}/user

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit / follow-up: neither POST /api/v1/embed-tenants/{embedTenantName}/user nor POST .../users is in docs-mintlify/api-reference/api.yaml — it currently only has GET /api/v1/embed-tenants/{embedTenantName}/users (listEmbedUsers, line 3047). Since that file is generated by scripts/extract-api.mjs from the enterprise repo, the prose here will be ahead of the OpenAPI reference until the next extraction. Not blocking, and the same is already true of the user-attributes endpoints listed just above, but worth a re-run so the two references agree — that's also where the bulk-action limit and the exact succeeded/failed shape would get pinned down.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants