active_storage_quota 0.1.0

data/db/migrate/20260918000001_create_active_storage_quota_charges.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+class CreateActiveStorageQuotaCharges < ActiveRecord::Migration[7.1]
+  def change
+    create_table :active_storage_quota_charges do |t|
+      t.references :quota_account, null: false, index: false,
+                   foreign_key: { to_table: :active_storage_quota_accounts }
+
+      # blob_id is a string for the same reason owner_id is: Active Storage's
+      # primary key type follows the host application's generator config, so it
+      # is bigint in one application and uuid in the next. A string also lets
+      # the Active Storage tables live in a different database, which a foreign
+      # key would forbid -- and there is deliberately no foreign key here.
+      t.string :blob_id, null: false, limit: 255
+
+      # Kept rather than joined from the blob: the blob may already be gone when
+      # we need to decrement, and the Active Storage tables may not even be
+      # reachable from this connection.
+      t.bigint :byte_size, null: false
+
+      # How many attachments of this account reference this blob. One charge
+      # covers all of them; the account is charged the blob's size once.
+      t.integer :attachment_count, null: false, default: 0
+
+      t.timestamps
+
+      t.index %i[quota_account_id blob_id], unique: true,
+              name: "index_asq_charges_on_account_and_blob"
+      # The blob-destroy path fans out across every account holding a charge.
+      t.index :blob_id, name: "index_asq_charges_on_blob_id"
+
+      t.check_constraint "byte_size >= 0",
+                         name: "asq_charges_byte_size_non_negative"
+      t.check_constraint "attachment_count >= 0",
+                         name: "asq_charges_attachment_count_non_negative"
+    end
+
+    # Correlates a direct-upload hold with the blob it was taken for. Nullable
+    # because server-side attachments never need a hold.
+    add_column :active_storage_quota_reservations, :blob_id, :string, limit: 255
+    add_index :active_storage_quota_reservations,
+              %i[blob_id quota_account_id status],
+              name: "index_asq_reservations_on_blob_and_account"
+  end
+end

data/lib/active_storage_quota/account.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+module ActiveStorageQuota
+  # The byte counters for one quota owner and scope.
+  #
+  # +used_bytes+ is committed storage; +reserved_bytes+ is storage claimed by
+  # in-flight uploads. Both are maintained by the reservation system rather
+  # than by this model, which is why there are no callbacks here.
+  #
+  # The validations mirror the database CHECK constraints so that mistakes
+  # surface as validation errors in application code. The constraints remain
+  # authoritative: quota counters are updated by conditional UPDATE statements
+  # that bypass validations by design.
+  class Account < Record
+    self.table_name = "active_storage_quota_accounts"
+
+    # optional: false rather than relying on belongs_to_required_by_default,
+    # which depends on the host application's Rails defaults.
+    belongs_to :owner, polymorphic: true, optional: false
+
+    has_many :reservations,
+             class_name: "ActiveStorageQuota::Reservation",
+             foreign_key: :quota_account_id,
+             inverse_of: :quota_account,
+             dependent: :delete_all
+
+    has_many :charges,
+             class_name: "ActiveStorageQuota::Charge",
+             foreign_key: :quota_account_id,
+             inverse_of: :quota_account,
+             dependent: :delete_all
+
+    validates :scope_name, presence: true
+    validates :used_bytes, :reserved_bytes,
+              numericality: { only_integer: true, greater_than_or_equal_to: 0 }
+
+    # No uniqueness validation on [owner, scope_name]. It would add a SELECT to
+    # every save and still lose the race it appears to prevent; the unique index
+    # is what actually enforces it.
+
+    class << self
+      # Claims +byte_size+ bytes for +owner+ and returns the resulting
+      # Reservation. Raises QuotaExceeded when the bytes do not fit under
+      # +limit_bytes+, and ArgumentError for a byte size that is not an exact
+      # non-negative Integer.
+      #
+      # +limit_bytes+ is the limit already resolved for this call. Passing it in
+      # rather than resolving it here is what makes the guarantee precise: the
+      # reservation is admitted against that value, atomically. A concurrent
+      # change to whatever produced it is not serialised against -- see the
+      # README on dynamic limits.
+      #
+      # Everything happens in one transaction. There is never an incremented
+      # reserved_bytes without its reservation row, nor the reverse.
+      def reserve!(owner:, byte_size:, limit_bytes:, blob_id: nil,
+                   scope_name: ActiveStorageQuota::DEFAULT_SCOPE)
+        byte_size = validate_byte_size!(byte_size)
+        now = Time.current
+
+        # requires_new so the whole claim is one atomic unit even inside a host
+        # application transaction: if the reservation INSERT fails, the capacity
+        # claim rolls back with it whether or not the caller rescues.
+        transaction(requires_new: true) do
+          account = find_or_create_for!(owner, scope_name)
+          account.claim_capacity!(byte_size, limit_bytes, now)
+
+          account.reservations.create!(
+            byte_size: byte_size,
+            blob_id: blob_id&.to_s,
+            status: Reservation::STATUS_ACTIVE,
+            expires_at: now + ActiveStorageQuota.config.reservation_ttl
+          )
+        end
+      end
+
+      # Finds the account for this owner and scope, creating it if it is not
+      # there yet.
+      #
+      # Two first-ever reservations can reach the INSERT together; the unique
+      # index settles it and the loser re-finds the winning row. The INSERT sits
+      # in a savepoint because on PostgreSQL a constraint violation poisons the
+      # enclosing transaction, and this one is nested inside reserve!'s.
+      #
+      # Only RecordNotUnique is rescued: that is the one race expected here, and
+      # anything else is a real failure that must surface.
+      def find_or_create_for!(owner, scope_name = ActiveStorageQuota::DEFAULT_SCOPE)
+        scope_name = scope_name.to_s
+
+        find_by(owner: owner, scope_name: scope_name) ||
+          create_for!(owner, scope_name)
+      end
+
+      private
+        def create_for!(owner, scope_name)
+          transaction(requires_new: true) do
+            create!(owner: owner, scope_name: scope_name)
+          end
+        rescue ActiveRecord::RecordNotUnique
+          find_by!(owner: owner, scope_name: scope_name)
+        end
+
+        def validate_byte_size!(value)
+          unless value.is_a?(Integer) && !value.negative?
+            raise ArgumentError,
+                  "byte size must be a non-negative Integer number of bytes, " \
+                  "got #{value.inspect} (#{value.class})"
+          end
+
+          value
+        end
+    end
+
+    # Adds +byte_size+ to reserved_bytes, but only if it fits under
+    # +limit_bytes+. One statement: the capacity test is the WHERE clause of the
+    # very UPDATE that claims the bytes, so there is no window between checking
+    # and claiming for another transaction to slip through.
+    #
+    # A nil limit means unlimited, and the same claim runs without the test.
+    #
+    # Raises QuotaExceeded when nothing matched. Note this does not refresh the
+    # receiver: like any update_all, the in-memory object is now stale by
+    # design. Reload if you need its counters.
+    def claim_capacity!(byte_size, limit_bytes, now = Time.current)
+      rows = self.class.where(id: id)
+      rows = rows.where("used_bytes + reserved_bytes + ? <= ?", byte_size, limit_bytes) if limit_bytes
+
+      claimed = rows.update_all(
+        [ "reserved_bytes = reserved_bytes + ?, updated_at = ?", byte_size, now ]
+      ) == 1
+
+      return true if claimed
+
+      raise_claim_failure!(byte_size, limit_bytes)
+    end
+
+    # Adds +byte_size+ to used_bytes, but only if it fits under +limit_bytes+.
+    #
+    # Called only by Charge, in the transaction that inserted the charge row.
+    # Charge is the sole writer of used_bytes; nothing else in the gem adds to
+    # it, which is what keeps used_bytes == SUM(charges.byte_size) true by
+    # construction rather than by hope.
+    def claim_used_capacity!(byte_size, limit_bytes, now = Time.current)
+      rows = self.class.where(id: id)
+      rows = rows.where("used_bytes + reserved_bytes + ? <= ?", byte_size, limit_bytes) if limit_bytes
+
+      claimed = rows.update_all(
+        [ "used_bytes = used_bytes + ?, updated_at = ?", byte_size, now ]
+      ) == 1
+
+      return true if claimed
+
+      raise_claim_failure!(byte_size, limit_bytes)
+    end
+
+    # Subtracts a discarded charge's bytes from used_bytes.
+    #
+    # Guarded so a drifted counter cannot go negative, and so the drift is
+    # reported rather than silently absorbed. Called only by Charge, in the
+    # transaction that deleted the charge row.
+    def self.release_used_bytes!(quota_account_id, byte_size, now = Time.current)
+      affected = where(id: quota_account_id).where("used_bytes >= ?", byte_size)
+                 .update_all([ "used_bytes = used_bytes - ?, updated_at = ?", byte_size, now ])
+
+      return true if affected == 1
+
+      raise CounterInvariantViolation,
+            "account #{quota_account_id} is charged fewer than #{byte_size} used " \
+            "bytes; refusing to lower the counter. Its counters have drifted " \
+            "from its charges."
+    end
+
+    private
+      def raise_claim_failure!(byte_size, limit_bytes)
+        # Re-read only here, on the failure path, so the exception can carry real
+        # numbers without costing the successful path an extra SELECT.
+        fresh = self.class.find_by(id: id)
+
+        if fresh.nil?
+          raise ActiveRecord::RecordNotFound,
+                "quota account #{id} no longer exists"
+        end
+
+        # An unlimited claim has no capacity test to fail, so a missed row can
+        # only mean the account went away between the UPDATE and this read.
+        if limit_bytes.nil?
+          raise ActiveRecord::RecordNotFound,
+                "quota account #{id} could not be updated"
+        end
+
+        raise QuotaExceeded.new(
+          owner: owner,
+          scope_name: scope_name,
+          requested_bytes: byte_size,
+          limit_bytes: limit_bytes,
+          used_bytes: fresh.used_bytes,
+          reserved_bytes: fresh.reserved_bytes
+        )
+      end
+  end
+end

data/lib/active_storage_quota/attachable.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module ActiveStorageQuota
+  # Declares which quota owner pays for a model's attachments.
+  #
+  #   class Contract < ApplicationRecord
+  #     belongs_to :company
+  #     storage_quota_owner :company
+  #
+  #     has_many_attached :documents
+  #   end
+  #
+  # Models that do not declare this are never charged. Models that do are always
+  # charged: an owner resolving to nil raises MissingQuotaOwner rather than
+  # quietly storing bytes nobody pays for.
+  module Attachable
+    extend ActiveSupport::Concern
+
+    # Extended onto ActiveRecord::Base so any model can declare its payer.
+    module Macro
+      # See ActiveStorageQuota::OwnerSource for the accepted forms.
+      #
+      # Subclasses may redeclare it without affecting the parent.
+      def storage_quota_owner(source)
+        include ActiveStorageQuota::Attachable
+
+        self.storage_quota_owner_source = ActiveStorageQuota::OwnerSource.new(source)
+      end
+    end
+
+    included do
+      class_attribute :storage_quota_owner_source, instance_accessor: false
+    end
+
+    # The quota owner charged for this record's attachments.
+    #
+    # Raises MissingQuotaOwner if it resolves to nil.
+    def storage_quota_owner
+      self.class.storage_quota_owner_source.resolve(self)
+    end
+  end
+end

data/lib/active_storage_quota/attachment_accounting.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module ActiveStorageQuota
+  # Mixed into ActiveStorage::Attachment through the :active_storage_attachment
+  # load hook. No Active Storage internals are patched.
+  #
+  # Creation and destruction hook in at deliberately different points:
+  #
+  #   after_create          in the attachment's transaction  -> fails CLOSED
+  #   after_update          in the attachment's transaction  -> fails CLOSED
+  #   after_destroy_commit  after it has committed           -> fails OPEN
+  #
+  # after_update covers attachment.update!(blob: other), which re-points an
+  # attachment at a different blob in place. That is an admission like a
+  # create, so a refusal must roll the update back with it.
+  #
+  # Failing closed on create is the whole point of a quota. Failing closed on
+  # delete would be far worse than useless: an account over its limit could not
+  # delete files to get back under it. So deletion accounting can never undo a
+  # deletion, and reports its failures instead.
+  #
+  # Not every removal is observable. Active Storage's purge and detach paths use
+  # delete / delete_all, which fire no callbacks at all, so attachment.purge is
+  # seen through the blob's destruction instead (see BlobAccounting) and detach
+  # is not seen at all. Those are reconciliation's job, not a reason to patch
+  # Rails.
+  module AttachmentAccounting
+    extend ActiveSupport::Concern
+
+    included do
+      after_create :record_storage_quota_charge
+      after_update :move_storage_quota_charge, if: :storage_quota_blob_swapped?
+      before_destroy :snapshot_storage_quota_accounting
+      after_destroy_commit :discard_storage_quota_charge
+    end
+
+    private
+      # Records whose model never declared storage_quota_owner are ignored
+      # entirely. That includes Active Storage's own internal attachments, such
+      # as a blob's preview_image.
+      def storage_quota_accountable?
+        record.class.respond_to?(:storage_quota_owner_source) &&
+          record.class.storage_quota_owner_source.present?
+      end
+
+      def record_storage_quota_charge
+        return unless storage_quota_accountable?
+
+        owner = record.storage_quota_owner
+        account = ActiveStorageQuota::Account.find_or_create_for!(owner)
+
+        ActiveStorageQuota::Charge.record!(
+          account: account,
+          blob_id: blob_id,
+          byte_size: blob.byte_size,
+          limit_bytes: owner.storage_limit
+        )
+      end
+
+      # Only a change of blob on the same record. Moving an attachment to a
+      # different record is not accounted here: the old charge belongs to the
+      # previous record's owner, and guessing it risks debiting the wrong
+      # account. Reconciliation repairs it.
+      def storage_quota_blob_swapped?
+        saved_change_to_blob_id? && !saved_change_to_record_id? && !saved_change_to_record_type?
+      end
+
+      def move_storage_quota_charge
+        return unless storage_quota_accountable?
+
+        owner = record.storage_quota_owner
+        account = ActiveStorageQuota::Account.find_or_create_for!(owner)
+
+        ActiveStorageQuota::Charge.move!(
+          account: account,
+          from_blob_id: blob_id_before_last_save,
+          to_blob_id: blob_id,
+          byte_size: blob.byte_size,
+          limit_bytes: owner.storage_limit
+        )
+      end
+
+      # Captures the accounting identity while the owning record still exists.
+      #
+      # By the time after_destroy_commit runs, `contract.destroy!` will have
+      # taken the Contract with it, so resolving the owner there would fail. The
+      # snapshot is plain scalars, never Active Record objects.
+      def snapshot_storage_quota_accounting
+        @storage_quota_snapshot = nil
+        @storage_quota_snapshot_error = nil
+
+        return unless storage_quota_accountable?
+
+        owner = record.class.storage_quota_owner_source.resolve_safely(record)
+        return if owner.nil?
+
+        account = owner.storage_quota_account
+        return if account.nil?
+
+        @storage_quota_snapshot = {
+          quota_account_id: account.id,
+          blob_id: blob_id.to_s,
+          byte_size: blob&.byte_size
+        }
+      rescue StandardError => e
+        # Malformed historical data must not make a file undeletable.
+        @storage_quota_snapshot_error = e
+        nil
+      end
+
+      def discard_storage_quota_charge
+        if @storage_quota_snapshot_error
+          report_storage_quota_failure(@storage_quota_snapshot_error)
+          return
+        end
+
+        return if @storage_quota_snapshot.nil?
+
+        ActiveStorageQuota::Charge.discard!(
+          quota_account_id: @storage_quota_snapshot[:quota_account_id],
+          blob_id: @storage_quota_snapshot[:blob_id]
+        )
+      rescue StandardError => e
+        # The attachment is already gone. Re-raising here would tell the caller
+        # the deletion failed when it did not.
+        report_storage_quota_failure(e)
+      end
+
+      def report_storage_quota_failure(exception)
+        snapshot = @storage_quota_snapshot || {}
+
+        ActiveStorageQuota.accounting_failed(
+          operation: "attachment_destroy",
+          exception: exception,
+          quota_account_id: snapshot[:quota_account_id],
+          blob_id: snapshot[:blob_id] || blob_id.to_s,
+          record_type: record_type,
+          record_id: record_id
+        )
+      end
+  end
+end

data/lib/active_storage_quota/audit/counter_audit.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module ActiveStorageQuota
+  module Audit
+    # Account#used_bytes against the charges it aggregates.
+    #
+    # The narrower of the two audits, and the one that can always run: both
+    # tables belong to this gem and share a connection by construction, so this
+    # is one adapter-neutral aggregate with no Active Storage involvement at
+    # all. It answers "is the denormalized counter consistent with the ledger",
+    # not "is the ledger right" -- that is the ledger audit's job.
+    class CounterAudit
+      BATCH_SIZE = 1_000
+
+      def initialize(result:)
+        @result = result
+      end
+
+      def run
+        each_account_batch do |accounts|
+          expected = expected_used_bytes(accounts.map(&:first))
+
+          accounts.each do |id, stored|
+            actual = expected.fetch(id, 0)
+            next if stored == actual
+
+            @result.record(
+              :account_counter_mismatch,
+              quota_account_id: id,
+              stored_used_bytes: stored,
+              expected_used_bytes: actual,
+              difference: stored - actual
+            )
+          end
+        end
+      end
+
+      private
+        # Keyset paging on the primary key. No offsets, so the cost per batch
+        # does not grow with how far in we are.
+        def each_account_batch
+          last_id = nil
+
+          loop do
+            scope = Account.order(:id).limit(BATCH_SIZE)
+            scope = scope.where(Account.arel_table[:id].gt(last_id)) if last_id
+            batch = scope.pluck(:id, :used_bytes)
+            break if batch.empty?
+
+            yield batch
+            last_id = batch.last.first
+          end
+        end
+
+        def expected_used_bytes(account_ids)
+          Charge.where(quota_account_id: account_ids)
+                .group(:quota_account_id)
+                .sum(:byte_size)
+        end
+    end
+  end
+end

data/lib/active_storage_quota/audit/finding.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module ActiveStorageQuota
+  module Audit
+    # One thing the audit noticed. A value object of scalars: findings are
+    # reported, logged and serialised, never acted on.
+    Finding = Struct.new(:category, :details, keyword_init: true) do
+      def to_h
+        { category: category }.merge(details)
+      end
+
+      def to_s
+        "#{category}: #{details.map { |k, v| "#{k}=#{v.inspect}" }.join(' ')}"
+      end
+    end
+  end
+end

data/lib/active_storage_quota/audit/ledger_audit.rb

@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+
+module ActiveStorageQuota
+  module Audit
+    # Charges against the Active Storage attachments and blobs they claim to
+    # describe.
+    #
+    # Two passes, because neither alone sees everything:
+    #
+    #   attachment-driven  finds charges that should exist but do not, and
+    #                      reference counts that have drifted
+    #   charge-driven      finds charges whose attachment or blob is gone
+    #
+    # Both enumerate by blob id rather than by primary key order or a
+    # high-water mark. Grouping by blob keeps every (account, blob) group inside
+    # one batch, so counts are exact, and it makes no assumption that ids are
+    # sequential -- Active Storage primary keys may be UUIDs.
+    class LedgerAudit
+      BATCH_SIZE = 500
+
+      def initialize(result:, same_connection:)
+        @result = result
+        @same_connection = same_connection
+        @resolver = ActiveStorageQuota::OwnerResolver.new(result: result)
+        @quiet_resolver = ActiveStorageQuota::OwnerResolver.new(result: result, record_findings: false)
+      end
+
+      def run
+        audit_attachments
+        audit_charges
+      end
+
+      private
+        attr_reader :result
+
+        # Pass one: walk the attachments, ask what the ledger should say.
+        def audit_attachments
+          each_blob_id_batch do |blob_ids|
+            pairs = @resolver.pairs_for_blobs(blob_ids)
+            next if pairs.empty?
+
+            charges = charges_for(blob_ids)
+            sizes = blob_sizes(blob_ids)
+
+            pairs.each do |(account_id, blob_id), attachment_count|
+              charge = charges[[ account_id, blob_id ]]
+
+              if charge.nil?
+                result.record(
+                  :missing_charge,
+                  quota_account_id: account_id, blob_id: blob_id,
+                  expected_attachment_count: attachment_count,
+                  byte_size: sizes[blob_id]
+                )
+              elsif charge[:attachment_count] != attachment_count
+                result.record(
+                  :attachment_count_mismatch,
+                  quota_account_id: account_id, blob_id: blob_id,
+                  charge_id: charge[:id],
+                  stored_attachment_count: charge[:attachment_count],
+                  expected_attachment_count: attachment_count
+                )
+              end
+            end
+          end
+        end
+
+        # Pass two: walk the ledger, ask whether anything still backs it.
+        def audit_charges
+          each_charge_batch do |charges|
+            blob_ids = charges.map { |charge| charge[:blob_id] }.uniq
+            sizes = blob_sizes(blob_ids)
+            pairs = @quiet_resolver.pairs_for_blobs(blob_ids)
+
+            charges.each do |charge|
+              audit_charge_blob(charge, sizes)
+
+              next if pairs.key?([ charge[:quota_account_id], charge[:blob_id] ])
+
+              result.record(
+                :unexpected_charge,
+                quota_account_id: charge[:quota_account_id], charge_id: charge[:id],
+                blob_id: charge[:blob_id], byte_size: charge[:byte_size],
+                attachment_count: charge[:attachment_count]
+              )
+            end
+          end
+        end
+
+        def audit_charge_blob(charge, sizes)
+          unless sizes.key?(charge[:blob_id])
+            result.record(
+              :charge_missing_blob,
+              quota_account_id: charge[:quota_account_id], charge_id: charge[:id],
+              blob_id: charge[:blob_id], byte_size: charge[:byte_size]
+            )
+            return
+          end
+
+          actual = sizes[charge[:blob_id]]
+          return if actual == charge[:byte_size]
+
+          # Which figure is right is a repair decision, not an audit one.
+          result.record(
+            :charge_byte_size_mismatch,
+            quota_account_id: charge[:quota_account_id], charge_id: charge[:id],
+            blob_id: charge[:blob_id],
+            charge_byte_size: charge[:byte_size], blob_byte_size: actual
+          )
+        end
+
+        # Keyset paging over distinct blob ids. String comparison works for
+        # bigint, uuid and ULID keys alike, and blob_id is indexed on
+        # attachments (Active Storage's t.references :blob creates it).
+        def each_blob_id_batch
+          last = nil
+
+          loop do
+            scope = ActiveStorage::Attachment.order(:blob_id).limit(BATCH_SIZE)
+            scope = scope.where(ActiveStorage::Attachment.arel_table[:blob_id].gt(last)) if last
+            blob_ids = scope.distinct.pluck(:blob_id)
+            break if blob_ids.empty?
+
+            yield blob_ids
+            last = blob_ids.last
+          end
+        end
+
+        def each_charge_batch
+          last_id = nil
+
+          loop do
+            scope = Charge.order(:id).limit(BATCH_SIZE)
+            scope = scope.where(Charge.arel_table[:id].gt(last_id)) if last_id
+            rows = scope.pluck(:id, :quota_account_id, :blob_id, :byte_size, :attachment_count)
+            break if rows.empty?
+
+            yield rows.map { |id, account_id, blob_id, byte_size, count|
+              { id: id, quota_account_id: account_id, blob_id: blob_id.to_s,
+                byte_size: byte_size, attachment_count: count }
+            }
+            last_id = rows.last.first
+          end
+        end
+
+        def charges_for(blob_ids)
+          Charge.where(blob_id: blob_ids.map(&:to_s))
+                .pluck(:id, :quota_account_id, :blob_id, :attachment_count)
+                .each_with_object({}) do |(id, account_id, blob_id, count), map|
+                  map[[ account_id, blob_id.to_s ]] = { id: id, attachment_count: count }
+                end
+        end
+
+        # Reading blobs is the one step that may cross connections. It is an
+        # ordinary batched query either way; only the consistency label differs,
+        # because values read on another connection can shift between reads.
+        def blob_sizes(blob_ids)
+          ActiveStorage::Blob.where(id: blob_ids)
+                             .pluck(:id, :byte_size)
+                             .each_with_object({}) { |(id, size), map| map[id.to_s] = size }
+        end
+    end
+  end
+end