feat: add quotas (#4779)

adds possibilities to cap authenticated requests and execution seconds of actions on a defined intervall

internal/api/grpc/system/instance.go

@@ -31,7 +31,6 @@ func (s *Server) ListInstances(ctx context.Context, req *system_pb.ListInstances
 }
 
 func (s *Server) GetInstance(ctx context.Context, req *system_pb.GetInstanceRequest) (*system_pb.GetInstanceResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	instance, err := s.query.Instance(ctx, true)
 	if err != nil {
 		return nil, err
@@ -53,7 +52,6 @@ func (s *Server) AddInstance(ctx context.Context, req *system_pb.AddInstanceRequ
 }
 
 func (s *Server) UpdateInstance(ctx context.Context, req *system_pb.UpdateInstanceRequest) (*system_pb.UpdateInstanceResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	details, err := s.command.UpdateInstance(ctx, req.InstanceName)
 	if err != nil {
 		return nil, err
@@ -86,7 +84,6 @@ func (s *Server) CreateInstance(ctx context.Context, req *system_pb.CreateInstan
 }
 
 func (s *Server) RemoveInstance(ctx context.Context, req *system_pb.RemoveInstanceRequest) (*system_pb.RemoveInstanceResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	details, err := s.command.RemoveInstance(ctx, req.InstanceId)
 	if err != nil {
 		return nil, err
@@ -97,7 +94,6 @@ func (s *Server) RemoveInstance(ctx context.Context, req *system_pb.RemoveInstan
 }
 
 func (s *Server) ListIAMMembers(ctx context.Context, req *system_pb.ListIAMMembersRequest) (*system_pb.ListIAMMembersResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	queries, err := ListIAMMembersRequestToQuery(req)
 	if err != nil {
 		return nil, err
@@ -139,7 +135,6 @@ func (s *Server) ExistsDomain(ctx context.Context, req *system_pb.ExistsDomainRe
 }
 
 func (s *Server) ListDomains(ctx context.Context, req *system_pb.ListDomainsRequest) (*system_pb.ListDomainsResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	queries, err := ListInstanceDomainsRequestToModel(req)
 	if err != nil {
 		return nil, err
@@ -156,8 +151,6 @@ func (s *Server) ListDomains(ctx context.Context, req *system_pb.ListDomainsRequ
 }
 
 func (s *Server) AddDomain(ctx context.Context, req *system_pb.AddDomainRequest) (*system_pb.AddDomainResponse, error) {
-	//TODO: should be solved in interceptor
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	instance, err := s.query.Instance(ctx, true)
 	if err != nil {
 		return nil, err
@@ -174,7 +167,6 @@ func (s *Server) AddDomain(ctx context.Context, req *system_pb.AddDomainRequest)
 }
 
 func (s *Server) RemoveDomain(ctx context.Context, req *system_pb.RemoveDomainRequest) (*system_pb.RemoveDomainResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	details, err := s.command.RemoveInstanceDomain(ctx, req.Domain)
 	if err != nil {
 		return nil, err
@@ -185,7 +177,6 @@ func (s *Server) RemoveDomain(ctx context.Context, req *system_pb.RemoveDomainRe
 }
 
 func (s *Server) SetPrimaryDomain(ctx context.Context, req *system_pb.SetPrimaryDomainRequest) (*system_pb.SetPrimaryDomainResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	details, err := s.command.SetPrimaryInstanceDomain(ctx, req.Domain)
 	if err != nil {
 		return nil, err

internal/api/grpc/system/quota.go

@@ -0,0 +1,32 @@
+package system
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/api/grpc/object"
+	"github.com/zitadel/zitadel/pkg/grpc/system"
+	system_pb "github.com/zitadel/zitadel/pkg/grpc/system"
+)
+
+func (s *Server) AddQuota(ctx context.Context, req *system.AddQuotaRequest) (*system.AddQuotaResponse, error) {
+	details, err := s.command.AddQuota(
+		ctx,
+		instanceQuotaPbToCommand(req),
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &system_pb.AddQuotaResponse{
+		Details: object.AddToDetailsPb(details.Sequence, details.EventDate, details.ResourceOwner),
+	}, nil
+}
+
+func (s *Server) RemoveQuota(ctx context.Context, req *system.RemoveQuotaRequest) (*system.RemoveQuotaResponse, error) {
+	details, err := s.command.RemoveQuota(ctx, instanceQuotaUnitPbToCommand(req.Unit))
+	if err != nil {
+		return nil, err
+	}
+	return &system_pb.RemoveQuotaResponse{
+		Details: object.ChangeToDetailsPb(details.Sequence, details.EventDate, details.ResourceOwner),
+	}, nil
+}

internal/api/grpc/system/quota_converter.go

@@ -0,0 +1,43 @@
+package system
+
+import (
+	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/pkg/grpc/quota"
+	"github.com/zitadel/zitadel/pkg/grpc/system"
+)
+
+func instanceQuotaPbToCommand(req *system.AddQuotaRequest) *command.AddQuota {
+	return &command.AddQuota{
+		Unit:          instanceQuotaUnitPbToCommand(req.Unit),
+		From:          req.From.AsTime(),
+		ResetInterval: req.ResetInterval.AsDuration(),
+		Amount:        req.Amount,
+		Limit:         req.Limit,
+		Notifications: instanceQuotaNotificationsPbToCommand(req.Notifications),
+	}
+}
+
+func instanceQuotaUnitPbToCommand(unit quota.Unit) command.QuotaUnit {
+	switch unit {
+	case quota.Unit_UNIT_REQUESTS_ALL_AUTHENTICATED:
+		return command.QuotaRequestsAllAuthenticated
+	case quota.Unit_UNIT_ACTIONS_ALL_RUN_SECONDS:
+		return command.QuotaActionsAllRunsSeconds
+	case quota.Unit_UNIT_UNIMPLEMENTED:
+		fallthrough
+	default:
+		return command.QuotaUnit(unit.String())
+	}
+}
+
+func instanceQuotaNotificationsPbToCommand(req []*quota.Notification) command.QuotaNotifications {
+	notifications := make([]*command.QuotaNotification, len(req))
+	for idx, item := range req {
+		notifications[idx] = &command.QuotaNotification{
+			Percent: uint16(item.Percent),
+			Repeat:  item.Repeat,
+			CallURL: item.CallUrl,
+		}
+	}
+	return notifications
+}