feat(core): apply system limit for organization related resources (#7942)

Author: xiaoyijun

packages/core/src/routes/organization-role/index.ts

@@ -2,6 +2,7 @@ import {
   OrganizationRoles,
   organizationRoleWithScopesGuard,
   ProductEvent,
+  RoleType,
   type CreateOrganizationRole,
   type OrganizationRole,
   type OrganizationRoleKeys,
@@ -35,6 +36,7 @@ export default function organizationRoleRoutes<T extends ManagementApiRouter>(
           relations: { rolesScopes, rolesResourceScopes },
         },
       },
+      libraries: { quota },
     },
   ]: RouterInitArgs<T>
 ) {
@@ -95,10 +97,17 @@ export default function organizationRoleRoutes<T extends ManagementApiRouter>(
     koaGuard({
       body: createGuard,
       response: OrganizationRoles.guard,
-      status: [201, 422],
+      status: [201, 422, 403],
     }),
     async (ctx, next) => {
       const { organizationScopeIds, resourceScopeIds, ...data } = ctx.guard.body;
+
+      await quota.guardTenantUsageByKey(
+        data.type === RoleType.MachineToMachine
+          ? 'organizationMachineToMachineRolesLimit'
+          : 'organizationUserRolesLimit'
+      );
+
       const role = await roles.insert({ id: generateStandardId(), ...data });
 
       if (organizationScopeIds.length > 0) {

packages/core/src/routes/organization-scope/index.ts

@@ -2,6 +2,7 @@ import { OrganizationScopes } from '@logto/schemas';
 
 import SchemaRouter from '#src/utils/SchemaRouter.js';
 
+import { koaQuotaGuard } from '../../middleware/koa-quota-guard.js';
 import { errorHandler } from '../organization/utils.js';
 import { type ManagementApiRouter, type RouterInitArgs } from '../types.js';
 
@@ -12,11 +13,19 @@ export default function organizationScopeRoutes<T extends ManagementApiRouter>(
       queries: {
         organizations: { scopes },
       },
+      libraries: { quota },
     },
   ]: RouterInitArgs<T>
 ) {
   const router = new SchemaRouter(OrganizationScopes, scopes, {
-    middlewares: [],
+    middlewares: [
+      {
+        middleware: koaQuotaGuard({ key: 'organizationScopesLimit', quota }),
+        scope: 'native',
+        method: ['post'],
+        status: [403],
+      },
+    ],
     errorHandler,
     searchFields: ['name'],
     isPaginationOptional: true,

packages/core/src/routes/organization/index.ts

@@ -107,7 +107,7 @@ export default function organizationRoutes<T extends ManagementApiRouter>(
     }
   );
 
-  userRoutes(router, organizations);
+  userRoutes(router, organizations, quota);
   applicationRoutes(router, organizations);
   jitRoutes(router, organizations);
 

packages/core/src/routes/organization/user/index.ts

@@ -3,9 +3,12 @@ import {
   type CreateOrganization,
   type Organization,
   userWithOrganizationRolesGuard,
+  Users,
 } from '@logto/schemas';
 import { z } from 'zod';
 
+import { buildManagementApiContext } from '#src/libraries/hook/utils.js';
+import { type QuotaLibrary } from '#src/libraries/quota.js';
 import koaGuard from '#src/middleware/koa-guard.js';
 import koaPagination from '#src/middleware/koa-pagination.js';
 import type OrganizationQueries from '#src/queries/organization/index.js';
@@ -18,13 +21,9 @@ import userRoleRelationRoutes from './role-relations.js';
 /** Mounts the user-related routes on the organization router. */
 export default function userRoutes(
   router: SchemaRouter<OrganizationKeys, CreateOrganization, Organization>,
-  organizations: OrganizationQueries
+  organizations: OrganizationQueries,
+  quota: QuotaLibrary
 ) {
-  router.addRelationRoutes(organizations.relations.users, undefined, {
-    disabled: { get: true },
-    hookEvent: 'Organization.Membership.Updated',
-  });
-
   router.get(
     '/:id/users',
     koaPagination(),
@@ -50,6 +49,107 @@ export default function userRoutes(
     }
   );
 
+  router.post(
+    '/:id/users',
+    koaGuard({
+      params: z.object({ id: z.string().min(1) }),
+      body: z.object({ userIds: z.string().min(1).array().nonempty() }),
+      status: [201, 403, 422],
+    }),
+    async (ctx, next) => {
+      const {
+        params: { id },
+        body: { userIds },
+      } = ctx.guard;
+
+      // Check quota limit before adding users
+      await quota.guardTenantUsageByKey('usersPerOrganizationLimit', {
+        entityId: id,
+        consumeUsageCount: userIds.length,
+      });
+
+      await organizations.relations.users.insert(
+        ...userIds.map((userId) => ({ organizationId: id, userId }))
+      );
+
+      ctx.status = 201;
+
+      // Trigger hook event
+      ctx.appendDataHookContext('Organization.Membership.Updated', {
+        ...buildManagementApiContext(ctx),
+        organizationId: id,
+      });
+
+      return next();
+    }
+  );
+
+  router.put(
+    '/:id/users',
+    koaGuard({
+      params: z.object({ id: z.string().min(1) }),
+      body: z.object({ userIds: z.string().min(1).array() }),
+      status: [204, 403, 422],
+    }),
+    async (ctx, next) => {
+      const {
+        params: { id },
+        body: { userIds },
+      } = ctx.guard;
+
+      // For replace operation, calculate the delta (new count - current count)
+      // Only check quota if we're adding more users than currently exist
+      const [currentCount] = await organizations.relations.users.getEntities(Users, {
+        organizationId: id,
+      });
+      const delta = userIds.length - currentCount;
+
+      if (delta > 0) {
+        await quota.guardTenantUsageByKey('usersPerOrganizationLimit', {
+          entityId: id,
+          consumeUsageCount: delta,
+        });
+      }
+
+      await organizations.relations.users.replace(id, userIds);
+
+      ctx.status = 204;
+
+      // Trigger hook event
+      ctx.appendDataHookContext('Organization.Membership.Updated', {
+        ...buildManagementApiContext(ctx),
+        organizationId: id,
+      });
+
+      return next();
+    }
+  );
+
+  router.delete(
+    '/:id/users/:userId',
+    koaGuard({
+      params: z.object({ id: z.string().min(1), userId: z.string().min(1) }),
+      status: [204, 422],
+    }),
+    async (ctx, next) => {
+      const {
+        params: { id, userId },
+      } = ctx.guard;
+
+      await organizations.relations.users.delete({ organizationId: id, userId });
+
+      ctx.status = 204;
+
+      // Trigger hook event
+      ctx.appendDataHookContext('Organization.Membership.Updated', {
+        ...buildManagementApiContext(ctx),
+        organizationId: id,
+      });
+
+      return next();
+    }
+  );
+
   router.post(
     '/:id/users/roles',
     koaGuard({