feat: add quotas (#4779)

adds possibilities to cap authenticated requests and execution seconds of actions on a defined intervall

internal/api/grpc/errors/caos_errors.go

@@ -55,6 +55,8 @@ func ExtractCaosError(err error) (c codes.Code, msg, id string, ok bool) {
 		return codes.Unavailable, caosErr.GetMessage(), caosErr.GetID(), true
 	case *caos_errs.UnimplementedError:
 		return codes.Unimplemented, caosErr.GetMessage(), caosErr.GetID(), true
+	case *caos_errs.ResourceExhaustedError:
+		return codes.ResourceExhausted, caosErr.GetMessage(), caosErr.GetID(), true
 	default:
 		return codes.Unknown, err.Error(), "", false
 	}

internal/api/grpc/errors/caos_errors_test.go

@@ -136,6 +136,14 @@ func Test_Extract(t *testing.T) {
 			"id",
 			true,
 		},
+		{
+			"exhausted",
+			args{caos_errs.ThrowResourceExhausted(nil, "id", "exhausted")},
+			codes.ResourceExhausted,
+			"exhausted",
+			"id",
+			true,
+		},
 		{
 			"unknown",
 			args{errors.New("unknown")},

internal/api/grpc/server/middleware/access_interceptor.go

@@ -0,0 +1,55 @@
+package middleware
+
+import (
+	"context"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/logstore"
+	"github.com/zitadel/zitadel/internal/logstore/emitters/access"
+	"github.com/zitadel/zitadel/internal/telemetry/tracing"
+)
+
+func AccessStorageInterceptor(svc *logstore.Service) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (_ interface{}, err error) {
+		if !svc.Enabled() {
+			return handler(ctx, req)
+		}
+
+		reqMd, _ := metadata.FromIncomingContext(ctx)
+
+		resp, handlerErr := handler(ctx, req)
+
+		interceptorCtx, span := tracing.NewServerInterceptorSpan(ctx)
+		defer func() { span.EndWithError(err) }()
+
+		var respStatus uint32
+		grpcStatus, ok := status.FromError(handlerErr)
+		if ok {
+			respStatus = uint32(grpcStatus.Code())
+		}
+
+		resMd, _ := metadata.FromOutgoingContext(ctx)
+		instance := authz.GetInstance(ctx)
+
+		record := &access.Record{
+			LogDate:         time.Now(),
+			Protocol:        access.GRPC,
+			RequestURL:      info.FullMethod,
+			ResponseStatus:  respStatus,
+			RequestHeaders:  reqMd,
+			ResponseHeaders: resMd,
+			InstanceID:      instance.InstanceID(),
+			ProjectID:       instance.ProjectID(),
+			RequestedDomain: instance.RequestedDomain(),
+			RequestedHost:   instance.RequestedHost(),
+		}
+
+		svc.Handle(interceptorCtx, record)
+		return resp, handlerErr
+	}
+}

internal/api/grpc/server/middleware/instance_interceptor.go

@@ -2,7 +2,7 @@ package middleware
 
 import (
 	"context"
-	"errors"
+	errs "errors"
 	"fmt"
 	"strings"
 
@@ -14,7 +14,7 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/zitadel/zitadel/internal/api/authz"
-	caos_errors "github.com/zitadel/zitadel/internal/errors"
+	"github.com/zitadel/zitadel/internal/errors"
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 )
@@ -23,27 +23,36 @@ const (
 	HTTP1Host = "x-zitadel-http1-host"
 )
 
-type InstanceVerifier interface {
-	GetInstance(ctx context.Context)
-}
-
-func InstanceInterceptor(verifier authz.InstanceVerifier, headerName string, ignoredServices ...string) grpc.UnaryServerInterceptor {
+func InstanceInterceptor(verifier authz.InstanceVerifier, headerName string, explicitInstanceIdServices ...string) grpc.UnaryServerInterceptor {
 	translator, err := newZitadelTranslator(language.English)
 	logging.OnError(err).Panic("unable to get translator")
 	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
-		return setInstance(ctx, req, info, handler, verifier, headerName, translator, ignoredServices...)
+		return setInstance(ctx, req, info, handler, verifier, headerName, translator, explicitInstanceIdServices...)
 	}
 }
 
-func setInstance(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler, verifier authz.InstanceVerifier, headerName string, translator *i18n.Translator, ignoredServices ...string) (_ interface{}, err error) {
+func setInstance(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler, verifier authz.InstanceVerifier, headerName string, translator *i18n.Translator, idFromRequestsServices ...string) (_ interface{}, err error) {
 	interceptorCtx, span := tracing.NewServerInterceptorSpan(ctx)
 	defer func() { span.EndWithError(err) }()
-	for _, service := range ignoredServices {
+	for _, service := range idFromRequestsServices {
 		if !strings.HasPrefix(service, "/") {
 			service = "/" + service
 		}
 		if strings.HasPrefix(info.FullMethod, service) {
-			return handler(ctx, req)
+			withInstanceIDProperty, ok := req.(interface{ GetInstanceId() string })
+			if !ok {
+				return handler(ctx, req)
+			}
+			ctx = authz.WithInstanceID(ctx, withInstanceIDProperty.GetInstanceId())
+			instance, err := verifier.InstanceByID(ctx)
+			if err != nil {
+				notFoundErr := new(errors.NotFoundError)
+				if errs.As(err, &notFoundErr) {
+					notFoundErr.Message = translator.LocalizeFromCtx(ctx, notFoundErr.GetMessage(), nil)
+				}
+				return nil, status.Error(codes.NotFound, err.Error())
+			}
+			return handler(authz.WithInstance(ctx, instance), req)
 		}
 	}
 
@@ -53,9 +62,9 @@ func setInstance(ctx context.Context, req interface{}, info *grpc.UnaryServerInf
 	}
 	instance, err := verifier.InstanceByHost(interceptorCtx, host)
 	if err != nil {
-		caosErr := new(caos_errors.NotFoundError)
-		if errors.As(err, &caosErr) {
-			caosErr.Message = translator.LocalizeFromCtx(ctx, caosErr.GetMessage(), nil)
+		notFoundErr := new(errors.NotFoundError)
+		if errs.As(err, &notFoundErr) {
+			notFoundErr.Message = translator.LocalizeFromCtx(ctx, notFoundErr.GetMessage(), nil)
 		}
 		return nil, status.Error(codes.NotFound, err.Error())
 	}

internal/api/grpc/server/middleware/instance_interceptor_test.go

@@ -153,13 +153,15 @@ type mockInstanceVerifier struct {
 	host string
 }
 
-func (m *mockInstanceVerifier) InstanceByHost(ctx context.Context, host string) (authz.Instance, error) {
+func (m *mockInstanceVerifier) InstanceByHost(_ context.Context, host string) (authz.Instance, error) {
 	if host != m.host {
 		return nil, fmt.Errorf("invalid host")
 	}
 	return &mockInstance{}, nil
 }
 
+func (m *mockInstanceVerifier) InstanceByID(context.Context) (authz.Instance, error) { return nil, nil }
+
 type mockInstance struct{}
 
 func (m *mockInstance) InstanceID() string {

internal/api/grpc/server/middleware/quota_interceptor.go

@@ -0,0 +1,46 @@
+package middleware
+
+import (
+	"context"
+	"strings"
+
+	"google.golang.org/grpc"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/errors"
+	"github.com/zitadel/zitadel/internal/logstore"
+	"github.com/zitadel/zitadel/internal/telemetry/tracing"
+)
+
+func QuotaExhaustedInterceptor(svc *logstore.Service, ignoreService ...string) grpc.UnaryServerInterceptor {
+
+	prunedIgnoredServices := make([]string, len(ignoreService))
+	for idx, service := range ignoreService {
+		if !strings.HasPrefix(service, "/") {
+			service = "/" + service
+		}
+		prunedIgnoredServices[idx] = service
+	}
+
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (_ interface{}, err error) {
+		if !svc.Enabled() {
+			return handler(ctx, req)
+		}
+		interceptorCtx, span := tracing.NewServerInterceptorSpan(ctx)
+		defer func() { span.EndWithError(err) }()
+
+		for _, service := range prunedIgnoredServices {
+			if strings.HasPrefix(info.FullMethod, service) {
+				return handler(ctx, req)
+			}
+		}
+
+		instance := authz.GetInstance(ctx)
+		remaining := svc.Limit(interceptorCtx, instance.InstanceID())
+		if remaining != nil && *remaining == 0 {
+			return nil, errors.ThrowResourceExhausted(nil, "QUOTA-vjAy8", "Quota.Access.Exhausted")
+		}
+		span.End()
+		return handler(ctx, req)
+	}
+}

internal/api/grpc/server/server.go

@@ -2,7 +2,6 @@ package server
 
 import (
 	"crypto/tls"
-
 	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
@@ -10,6 +9,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	grpc_api "github.com/zitadel/zitadel/internal/api/grpc"
 	"github.com/zitadel/zitadel/internal/api/grpc/server/middleware"
+	"github.com/zitadel/zitadel/internal/logstore"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/internal/telemetry/metrics"
 	system_pb "github.com/zitadel/zitadel/pkg/grpc/system"
@@ -23,7 +23,14 @@ type Server interface {
 	AuthMethods() authz.MethodMapping
 }
 
-func CreateServer(verifier *authz.TokenVerifier, authConfig authz.Config, queries *query.Queries, hostHeaderName string, tlsConfig *tls.Config) *grpc.Server {
+func CreateServer(
+	verifier *authz.TokenVerifier,
+	authConfig authz.Config,
+	queries *query.Queries,
+	hostHeaderName string,
+	tlsConfig *tls.Config,
+	accessSvc *logstore.Service,
+) *grpc.Server {
 	metricTypes := []metrics.MetricType{metrics.MetricTypeTotalCount, metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode}
 	serverOptions := []grpc.ServerOption{
 		grpc.UnaryInterceptor(
@@ -33,10 +40,12 @@ func CreateServer(verifier *authz.TokenVerifier, authConfig authz.Config, querie
 				middleware.NoCacheInterceptor(),
 				middleware.ErrorHandler(),
 				middleware.InstanceInterceptor(queries, hostHeaderName, system_pb.SystemService_MethodPrefix),
+				middleware.AccessStorageInterceptor(accessSvc),
 				middleware.AuthorizationInterceptor(verifier, authConfig),
 				middleware.TranslationHandler(),
 				middleware.ValidationHandler(),
 				middleware.ServiceHandler(),
+				middleware.QuotaExhaustedInterceptor(accessSvc, system_pb.SystemService_MethodPrefix),
 			),
 		),
 	}

internal/api/grpc/system/instance.go

@@ -31,7 +31,6 @@ func (s *Server) ListInstances(ctx context.Context, req *system_pb.ListInstances
 }
 
 func (s *Server) GetInstance(ctx context.Context, req *system_pb.GetInstanceRequest) (*system_pb.GetInstanceResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	instance, err := s.query.Instance(ctx, true)
 	if err != nil {
 		return nil, err
@@ -53,7 +52,6 @@ func (s *Server) AddInstance(ctx context.Context, req *system_pb.AddInstanceRequ
 }
 
 func (s *Server) UpdateInstance(ctx context.Context, req *system_pb.UpdateInstanceRequest) (*system_pb.UpdateInstanceResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	details, err := s.command.UpdateInstance(ctx, req.InstanceName)
 	if err != nil {
 		return nil, err
@@ -86,7 +84,6 @@ func (s *Server) CreateInstance(ctx context.Context, req *system_pb.CreateInstan
 }
 
 func (s *Server) RemoveInstance(ctx context.Context, req *system_pb.RemoveInstanceRequest) (*system_pb.RemoveInstanceResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	details, err := s.command.RemoveInstance(ctx, req.InstanceId)
 	if err != nil {
 		return nil, err
@@ -97,7 +94,6 @@ func (s *Server) RemoveInstance(ctx context.Context, req *system_pb.RemoveInstan
 }
 
 func (s *Server) ListIAMMembers(ctx context.Context, req *system_pb.ListIAMMembersRequest) (*system_pb.ListIAMMembersResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	queries, err := ListIAMMembersRequestToQuery(req)
 	if err != nil {
 		return nil, err
@@ -139,7 +135,6 @@ func (s *Server) ExistsDomain(ctx context.Context, req *system_pb.ExistsDomainRe
 }
 
 func (s *Server) ListDomains(ctx context.Context, req *system_pb.ListDomainsRequest) (*system_pb.ListDomainsResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	queries, err := ListInstanceDomainsRequestToModel(req)
 	if err != nil {
 		return nil, err
@@ -156,8 +151,6 @@ func (s *Server) ListDomains(ctx context.Context, req *system_pb.ListDomainsRequ
 }
 
 func (s *Server) AddDomain(ctx context.Context, req *system_pb.AddDomainRequest) (*system_pb.AddDomainResponse, error) {
-	//TODO: should be solved in interceptor
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	instance, err := s.query.Instance(ctx, true)
 	if err != nil {
 		return nil, err
@@ -174,7 +167,6 @@ func (s *Server) AddDomain(ctx context.Context, req *system_pb.AddDomainRequest)
 }
 
 func (s *Server) RemoveDomain(ctx context.Context, req *system_pb.RemoveDomainRequest) (*system_pb.RemoveDomainResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	details, err := s.command.RemoveInstanceDomain(ctx, req.Domain)
 	if err != nil {
 		return nil, err
@@ -185,7 +177,6 @@ func (s *Server) RemoveDomain(ctx context.Context, req *system_pb.RemoveDomainRe
 }
 
 func (s *Server) SetPrimaryDomain(ctx context.Context, req *system_pb.SetPrimaryDomainRequest) (*system_pb.SetPrimaryDomainResponse, error) {
-	ctx = authz.WithInstanceID(ctx, req.InstanceId)
 	details, err := s.command.SetPrimaryInstanceDomain(ctx, req.Domain)
 	if err != nil {
 		return nil, err

internal/api/grpc/system/quota.go

@@ -0,0 +1,32 @@
+package system
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/api/grpc/object"
+	"github.com/zitadel/zitadel/pkg/grpc/system"
+	system_pb "github.com/zitadel/zitadel/pkg/grpc/system"
+)
+
+func (s *Server) AddQuota(ctx context.Context, req *system.AddQuotaRequest) (*system.AddQuotaResponse, error) {
+	details, err := s.command.AddQuota(
+		ctx,
+		instanceQuotaPbToCommand(req),
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &system_pb.AddQuotaResponse{
+		Details: object.AddToDetailsPb(details.Sequence, details.EventDate, details.ResourceOwner),
+	}, nil
+}
+
+func (s *Server) RemoveQuota(ctx context.Context, req *system.RemoveQuotaRequest) (*system.RemoveQuotaResponse, error) {
+	details, err := s.command.RemoveQuota(ctx, instanceQuotaUnitPbToCommand(req.Unit))
+	if err != nil {
+		return nil, err
+	}
+	return &system_pb.RemoveQuotaResponse{
+		Details: object.ChangeToDetailsPb(details.Sequence, details.EventDate, details.ResourceOwner),
+	}, nil
+}

internal/api/grpc/system/quota_converter.go

@@ -0,0 +1,43 @@
+package system
+
+import (
+	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/pkg/grpc/quota"
+	"github.com/zitadel/zitadel/pkg/grpc/system"
+)
+
+func instanceQuotaPbToCommand(req *system.AddQuotaRequest) *command.AddQuota {
+	return &command.AddQuota{
+		Unit:          instanceQuotaUnitPbToCommand(req.Unit),
+		From:          req.From.AsTime(),
+		ResetInterval: req.ResetInterval.AsDuration(),
+		Amount:        req.Amount,
+		Limit:         req.Limit,
+		Notifications: instanceQuotaNotificationsPbToCommand(req.Notifications),
+	}
+}
+
+func instanceQuotaUnitPbToCommand(unit quota.Unit) command.QuotaUnit {
+	switch unit {
+	case quota.Unit_UNIT_REQUESTS_ALL_AUTHENTICATED:
+		return command.QuotaRequestsAllAuthenticated
+	case quota.Unit_UNIT_ACTIONS_ALL_RUN_SECONDS:
+		return command.QuotaActionsAllRunsSeconds
+	case quota.Unit_UNIT_UNIMPLEMENTED:
+		fallthrough
+	default:
+		return command.QuotaUnit(unit.String())
+	}
+}
+
+func instanceQuotaNotificationsPbToCommand(req []*quota.Notification) command.QuotaNotifications {
+	notifications := make([]*command.QuotaNotification, len(req))
+	for idx, item := range req {
+		notifications[idx] = &command.QuotaNotification{
+			Percent: uint16(item.Percent),
+			Repeat:  item.Repeat,
+			CallURL: item.CallUrl,
+		}
+	}
+	return notifications
+}