add quota

Author: slashburygin

AGENTS.md

@@ -89,10 +89,10 @@ exordos_core/
 tox -e py310,py312,py314
 
 # Run unit tests only
-tox -e py310
+tox -e py314
 
 # Run functional tests
-tox -e py310-functional
+tox -e py314-functional
 
 # Run linters
 tox -e ruff-check    # Check code style

exordos_core/compute/dm/models.py

@@ -36,6 +36,7 @@
 from exordos_core.common import utils
 from exordos_core.common.dm import models as cm
 from exordos_core.compute import constants as nc
+from exordos_core.quota.dm.models import QuotaModelMixin
 
 if tp.TYPE_CHECKING:
     from exordos_core.compute.pool.drivers.base import AbstractPoolDriver
@@ -261,6 +262,7 @@ class UnscheduledVolume(models.ModelWithUUID, orm.SQLStorableMixin):
 class NodeSet(
     infra_models.NodeSet,
     ua_models.InstanceWithDerivativesMixin,
+    QuotaModelMixin,
     orm.SQLStorableMixin,
 ):
     __tablename__ = "compute_sets"
@@ -300,6 +302,7 @@ def set_active(self):
 
 class Node(
     infra_models.Node,
+    QuotaModelMixin,
     orm.SQLStorableWithJSONFieldsMixin,
 ):
     __tablename__ = "nodes"

exordos_core/quota/__init__.py

@@ -0,0 +1,15 @@
+#    Copyright 2026 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.

exordos_core/quota/dm/__init__.py

@@ -0,0 +1,119 @@
+#    Copyright 2026 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import logging
+import typing as tp
+import uuid as sys_uuid
+
+from restalchemy.common import exceptions as ra_e
+from restalchemy.dm import filters as dm_filters
+from restalchemy.dm import models
+from restalchemy.dm import properties
+from restalchemy.dm import types
+from restalchemy.storage.sql import orm
+
+LOG = logging.getLogger(__name__)
+
+
+class QuotaExceededError(ra_e.ValidationErrorException):
+    message = "Quota exceeded for resource '%(resource_name)s' in project %(project_id)s: %(current)s > %(limit)s"
+
+    def __init__(
+        self, resource_name: str, limit: int, current: int, project_id: sys_uuid.UUID
+    ):
+        super().__init__(
+            resource_name=resource_name,
+            limit=limit,
+            current=current,
+            project_id=project_id,
+        )
+        self.resource_name = resource_name
+        self.limit = limit
+        self.current = current
+        self.project_id = project_id
+
+
+DEFAULT_QUOTA_LIMIT = 1000
+DEFAULT_QUOTA_LIMITS: tp.Dict[str, int] = {
+    "net_lb": DEFAULT_QUOTA_LIMIT,
+    "compute_sets": DEFAULT_QUOTA_LIMIT,
+    "nodes": DEFAULT_QUOTA_LIMIT,
+    "secret_passwords": DEFAULT_QUOTA_LIMIT,
+    "secret_certificates": DEFAULT_QUOTA_LIMIT,
+    "secret_rsa_keys": DEFAULT_QUOTA_LIMIT,
+    "secret_ssh_keys": DEFAULT_QUOTA_LIMIT,
+}
+
+
+class QuotaModelMixin:
+    def _quota_limit(self, session) -> tp.Optional[int]:
+        limit = QuotaLimit.objects.get_one_or_none(
+            session=session,
+            filters={
+                "project_id": dm_filters.EQ(self.project_id),
+                "resource_name": dm_filters.EQ(self.__tablename__),
+            },
+        )
+        if limit is not None:
+            return limit.limit
+        return DEFAULT_QUOTA_LIMITS.get(self.__tablename__)
+
+    def _quota_check(self, session) -> None:
+        # Check limit by counting entities in the table.
+        # If limit exceeded, raises QuotaExceededError.
+        limit = self._quota_limit(session)
+        if limit is None:
+            return
+
+        current = self.objects.count(
+            session=session, filters={"project_id": dm_filters.EQ(self.project_id)}
+        )
+
+        if current + 1 > limit:
+            raise QuotaExceededError(
+                resource_name=self.__tablename__,
+                limit=limit,
+                current=current + 1,
+                project_id=self.project_id,
+            )
+
+    def insert(self, session=None):
+        # Reserve quota slot by checking entity count, then insert entity.
+        if session is None:
+            with self._get_engine().session_manager(session=session) as s:
+                self._quota_check(s)
+                super().insert(session=s)
+        else:
+            self._quota_check(session)
+            super().insert(session=session)
+
+
+class QuotaLimit(
+    models.ModelWithUUID,
+    models.ModelWithTimestamp,
+    models.ModelWithProject,
+    orm.SQLStorableMixin,
+):
+    __tablename__ = "quota_limits"
+
+    resource_name = properties.property(
+        types.String(max_length=255),
+        required=True,
+    )
+    limit = properties.property(
+        types.Integer(min_value=0),
+        required=True,
+    )

exordos_core/quota/dm/models.py

@@ -29,6 +29,7 @@
 from exordos_core.common import constants as c
 from exordos_core.common.dm import models as cm
 from exordos_core.common.dm import targets as ct
+from exordos_core.quota.dm.models import QuotaModelMixin
 from exordos_core.secret import constants as sc
 
 
@@ -65,6 +66,7 @@ class Secret(
 
 class Password(
     Secret,
+    QuotaModelMixin,
     orm.SQLStorableMixin,
     ua_models.TargetResourceSQLStorableMixin,
 ):
@@ -136,6 +138,7 @@ class DNSCoreCertificateMethod(AbstractCertificateMethod):
 
 class Certificate(
     Secret,
+    QuotaModelMixin,
     orm.SQLStorableWithJSONFieldsMixin,
     ua_models.TargetResourceSQLStorableMixin,
 ):
@@ -217,6 +220,7 @@ def get_deleted_certificates(
 
 class RSAKey(
     Secret,
+    QuotaModelMixin,
     orm.SQLStorableMixin,
     ua_models.TargetResourceSQLStorableMixin,
 ):
@@ -293,6 +297,7 @@ def get_resource_target_fields(self) -> tp.Set[str]:
 
 class SSHKey(
     Secret,
+    QuotaModelMixin,
     orm.SQLStorableMixin,
     ua_models.TargetResourceSQLStorableMixin,
 ):

exordos_core/secret/dm/models.py

@@ -22,6 +22,7 @@
 from gcl_sdk.agents.universal.dm import models as ua_models
 from restalchemy.common import contexts
 from restalchemy.dm import filters as dm_filters
+from restalchemy.storage import exceptions as ra_exceptions
 
 from exordos_core.common import constants as c
 from exordos_core.compute.dm import models as nm
@@ -358,7 +359,14 @@ def _actualize_new_ssh_key(
                 node=node.uuid,
                 status=sc.SecretStatus.IN_PROGRESS,
             )
-            key_host_resource.insert()
+            try:
+                key_host_resource.insert()
+            except ra_exceptions.ConflictRecords:
+                LOG.debug(
+                    "SSH key resource %s for node %s already exists",
+                    key_resource.uuid,
+                    node.uuid,
+                )
 
         key.status = sc.SecretStatus.IN_PROGRESS.value
         key.save()

exordos_core/secret/service.py

@@ -512,6 +512,39 @@ def factory(
     return factory
 
 
+@pytest.fixture
+def node_factory_with_model():
+    def factory(
+        uuid: tp.Optional[sys_uuid.UUID] = None,
+        name: str = "node",
+        cores: int = 1,
+        ram: int = 1024,
+        image: str = "ubuntu_24.04",
+        project_id: sys_uuid.UUID = c.SERVICE_PROJECT_ID,
+        status: tp.Optional[str] = None,
+        **kwargs,
+    ) -> tp.Tuple[tp.Dict[str, tp.Any], node_models.Node]:
+        uuid = uuid or _make_uuid()
+        status_value = nc.NodeStatus.NEW.value if status is None else status.value
+        node = node_models.Node(
+            uuid=uuid,
+            name=name,
+            cores=cores,
+            ram=ram,
+            project_id=project_id,
+            status=status_value,
+            disk_spec=sdk_infra_models.RootDiskSpec(image=image),
+            **kwargs,
+        )
+        view = node.dump_to_simple_view()
+        if status is None:
+            view.pop("status")
+        view.pop("node_set")
+        return view, node
+
+    return factory
+
+
 @pytest.fixture
 def node_set_factory():
     def factory(

exordos_core/tests/functional/conftest.py

@@ -0,0 +1,15 @@
+#    Copyright 2025 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.