feat(cloud): enforce workspace resource quotas

src/langbot/pkg/api/http/controller/group.py

@@ -14,6 +14,7 @@ from ....utils import bounded_executor
 from ....workspace.collaboration import MembershipPermissionError, WorkspaceCollaborationError
 from ....workspace.errors import WorkspaceNotFoundError
 from ....cloud.entitlements import EntitlementUnavailableError
+from ....cloud.quotas import WorkspaceQuotaExceededError
 from ....core.errors import TaskCapacityError
 from ..authz import AuthorizationError, Permission, permissions_for_role, require_permission
 from ..context import PrincipalContext, PrincipalType, RequestContext, WorkspaceContext
@@ -219,6 +220,8 @@ class RouterGroup(abc.ABC):
                         return self.http_status(403, e.code, str(e))
                     if isinstance(e, WorkspaceCollaborationError):
                         return self.http_status(400, e.code, str(e))
+                    if isinstance(e, WorkspaceQuotaExceededError):
+                        return self.http_status(409, e.error_code, str(e))
                     if isinstance(e, TaskCapacityError):
                         return self.http_status(429, 'task_capacity_exceeded', str(e))
                     if isinstance(

src/langbot/pkg/api/http/service/bot.py

@@ -4,6 +4,7 @@ import uuid
 import sqlalchemy
 
 from ....core import app
+from ....cloud.quotas import require_resource_capacity, resolve_workspace_quota
 from ....entity.persistence import bot as persistence_bot
 from ....entity.persistence import pipeline as persistence_pipeline
 from ....workspace.errors import WorkspaceNotFoundError
@@ -101,20 +102,21 @@ class BotService:
     async def create_bot(self, context: TenantContext, bot_data: dict) -> str:
         """Create bot"""
         workspace_uuid = require_workspace_uuid(context)
-        # Check limitation
         limitation = self.ap.instance_config.data.get('system', {}).get('limitation', {})
-        max_bots = limitation.get('max_bots', -1)
-        if max_bots >= 0:
-            existing_bots = await self.get_bots(context)
-            if len(existing_bots) >= max_bots:
-                raise ValueError(f'Maximum number of bots ({max_bots}) reached')
+        quota = await resolve_workspace_quota(
+            self.ap,
+            workspace_uuid,
+            'bots.max',
+            fallback=limitation.get('max_bots', -1),
+        )
 
         # TODO: 检查配置信息格式
         bot_data = bot_data.copy()
         bot_data['uuid'] = str(uuid.uuid4())
         bot_data['workspace_uuid'] = workspace_uuid
 
-        # bind the most recently updated pipeline if any exist
+        # Preserve the legacy flat-row result shape for this optional lookup;
+        # quota admission and insertion below still share one transaction.
         result = await self.ap.persistence_mgr.execute_async(
             scope_statement(
                 sqlalchemy.select(persistence_pipeline.LegacyPipeline),
@@ -129,7 +131,25 @@ class BotService:
             bot_data['use_pipeline_uuid'] = pipeline.uuid
             bot_data['use_pipeline_name'] = pipeline.name
 
-        await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_bot.Bot).values(bot_data))
+        async def persist(execute) -> None:
+            await require_resource_capacity(
+                execute,
+                workspace_uuid=workspace_uuid,
+                model=persistence_bot.Bot,
+                quota=quota,
+                resource_name='bots',
+            )
+
+            await execute(sqlalchemy.insert(persistence_bot.Bot).values(bot_data))
+
+        tenant_uow = getattr(self.ap.persistence_mgr, 'tenant_uow', None)
+        if quota.requires_transaction_lock:
+            if not callable(tenant_uow):
+                raise RuntimeError('Cloud bot quota enforcement requires transactional persistence')
+            async with tenant_uow(workspace_uuid) as uow:
+                await persist(uow.execute)
+        else:
+            await persist(self.ap.persistence_mgr.execute_async)
 
         bot = await self.get_bot(context, bot_data['uuid'], include_secret=True)
 

src/langbot/pkg/cloud/quotas.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Awaitable, Callable
+
+import sqlalchemy
+
+from ..entity.persistence import workspace as persistence_workspace
+from .entitlements import EntitlementResolver
+
+
+Execute = Callable[[Any], Awaitable[Any]]
+
+
+class WorkspaceQuotaExceededError(ValueError):
+    """A stable business error raised when a workspace has no free slots."""
+
+    error_code = 'workspace_quota_exceeded'
+
+    def __init__(self, resource_name: str, limit: int) -> None:
+        self.resource_name = resource_name
+        self.limit = limit
+        super().__init__(f'Maximum number of {resource_name} ({limit}) reached')
+
+
+@dataclass(frozen=True, slots=True)
+class WorkspaceQuota:
+    limit: int
+    requires_transaction_lock: bool
+
+
+async def resolve_workspace_quota(
+    ap: Any,
+    workspace_uuid: str,
+    limit_name: str,
+    *,
+    fallback: int = -1,
+) -> WorkspaceQuota:
+    """Resolve a plan-agnostic Cloud limit while preserving OSS configuration."""
+
+    resolver = getattr(ap, 'entitlement_resolver', None)
+    if isinstance(resolver, EntitlementResolver):
+        snapshot = await resolver.resolve(workspace_uuid)
+        return WorkspaceQuota(
+            limit=snapshot.limit(limit_name),
+            requires_transaction_lock=True,
+        )
+    return WorkspaceQuota(limit=fallback, requires_transaction_lock=False)
+
+
+async def lock_workspace_for_quota(execute: Execute, workspace_uuid: str) -> None:
+    """Serialize quota checks on the durable Workspace row within one transaction."""
+
+    result = await execute(
+        sqlalchemy.select(persistence_workspace.Workspace.uuid)
+        .where(persistence_workspace.Workspace.uuid == workspace_uuid)
+        .with_for_update()
+    )
+    if result.first() is None:
+        raise ValueError('Workspace does not exist')
+
+
+async def require_resource_capacity(
+    execute: Execute,
+    *,
+    workspace_uuid: str,
+    model: type,
+    quota: WorkspaceQuota,
+    resource_name: str,
+    workspace_locked: bool = False,
+) -> None:
+    if quota.limit < 0:
+        return
+    if quota.requires_transaction_lock and not workspace_locked:
+        await lock_workspace_for_quota(execute, workspace_uuid)
+    result = await execute(
+        sqlalchemy.select(sqlalchemy.func.count())
+        .select_from(model)
+        .where(model.workspace_uuid == workspace_uuid)
+    )
+    if int(result.scalar_one()) >= quota.limit:
+        raise WorkspaceQuotaExceededError(resource_name, quota.limit)

src/langbot/pkg/plugin/connector.py

@@ -19,6 +19,11 @@ from urllib.parse import urljoin, urlparse
 from langbot_plugin.api.entities.builtin.pipeline.query import provider_session
 
 from ..core import app
+from ..cloud.quotas import (
+    lock_workspace_for_quota,
+    require_resource_capacity,
+    resolve_workspace_quota,
+)
 from . import handler
 from .archive import inspect_plugin_archive_metadata
 from .github import (
@@ -1295,6 +1300,11 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
         install_info: dict[str, Any],
         artifact_digest: str,
     ) -> tuple[InstallationBinding, str | None, bool]:
+        quota = await resolve_workspace_quota(
+            self.ap,
+            execution_context.workspace_uuid,
+            'plugins.max',
+        )
         safe_install_info = {
             key: value
             for key, value in install_info.items()
@@ -1316,9 +1326,19 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
         )
 
         async def persist(execute):
+            if quota.requires_transaction_lock:
+                await lock_workspace_for_quota(execute, execution_context.workspace_uuid)
             result = await execute(statement)
             setting = result.first()
             if setting is None:
+                await require_resource_capacity(
+                    execute,
+                    workspace_uuid=execution_context.workspace_uuid,
+                    model=persistence_plugin.PluginSetting,
+                    quota=quota,
+                    resource_name='plugins',
+                    workspace_locked=quota.requires_transaction_lock,
+                )
                 installation_uuid = str(uuid.uuid4())
                 runtime_revision = 1
                 previous_digest = None
@@ -1373,6 +1393,8 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
             )
 
         tenant_uow = getattr(self.ap.persistence_mgr, 'tenant_uow', None)
+        if quota.requires_transaction_lock and not callable(tenant_uow):
+            raise RuntimeError('Cloud plugin quota enforcement requires transactional persistence')
         if callable(tenant_uow):
             async with tenant_uow(execution_context.workspace_uuid) as uow:
                 return await persist(uow.execute)