Chore: Refactor quota service (#57586)

* Chore: refactore quota service

* Apply suggestions from code review

pkg/services/quota/quotaimpl/quota.go

@@ -2,38 +2,81 @@ package quotaimpl
 
 import (
 	"context"
+	"fmt"
+	"sync"
 
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/services/quota"
-	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"github.com/grafana/grafana/pkg/setting"
+	"golang.org/x/sync/errgroup"
 )
 
-type Service struct {
-	store            store
-	authTokenService models.ActiveTokenService
-	Cfg              *setting.Cfg
-	SQLStore         sqlstore.Store
-	Logger           log.Logger
+type serviceDisabled struct {
 }
 
-func ProvideService(db db.DB, cfg *setting.Cfg, tokenService models.ActiveTokenService, ss *sqlstore.SQLStore) quota.Service {
-	return &Service{
-		store:            &sqlStore{db: db},
-		Cfg:              cfg,
-		authTokenService: tokenService,
-		SQLStore:         ss,
-		Logger:           log.New("quota_service"),
+func (s *serviceDisabled) QuotaReached(c *models.ReqContext, targetSrv quota.TargetSrv) (bool, error) {
+	return false, nil
+}
+
+func (s *serviceDisabled) GetQuotasByScope(ctx context.Context, scope quota.Scope, id int64) ([]quota.QuotaDTO, error) {
+	return nil, quota.ErrDisabled
+}
+
+func (s *serviceDisabled) Update(ctx context.Context, cmd *quota.UpdateQuotaCmd) error {
+	return quota.ErrDisabled
+}
+
+func (s *serviceDisabled) CheckQuotaReached(ctx context.Context, targetSrv quota.TargetSrv, scopeParams *quota.ScopeParameters) (bool, error) {
+	return false, nil
+}
+
+func (s *serviceDisabled) DeleteQuotaForUser(ctx context.Context, userID int64) error {
+	return quota.ErrDisabled
+}
+
+func (s *serviceDisabled) RegisterQuotaReporter(e *quota.NewUsageReporter) error {
+	return nil
+}
+
+type service struct {
+	store  store
+	Cfg    *setting.Cfg
+	Logger log.Logger
+
+	mutex     sync.RWMutex
+	reporters map[quota.TargetSrv]quota.UsageReporterFunc
+
+	defaultLimits *quota.Map
+
+	targetToSrv *quota.TargetToSrv
+}
+
+func ProvideService(db db.DB, cfg *setting.Cfg) quota.Service {
+	logger := log.New("quota_service")
+	s := service{
+		store:         &sqlStore{db: db, logger: logger},
+		Cfg:           cfg,
+		Logger:        logger,
+		reporters:     make(map[quota.TargetSrv]quota.UsageReporterFunc),
+		defaultLimits: &quota.Map{},
+		targetToSrv:   quota.NewTargetToSrv(),
 	}
+
+	if s.IsDisabled() {
+		return &serviceDisabled{}
+	}
+
+	return &s
+}
+
+func (s *service) IsDisabled() bool {
+	return !s.Cfg.Quota.Enabled
 }
 
 // QuotaReached checks that quota is reached for a target. Runs CheckQuotaReached and take context and scope parameters from the request context
-func (s *Service) QuotaReached(c *models.ReqContext, target string) (bool, error) {
-	if !s.Cfg.Quota.Enabled {
-		return false, nil
-	}
+func (s *service) QuotaReached(c *models.ReqContext, targetSrv quota.TargetSrv) (bool, error) {
 	// No request context means this is a background service, like LDAP Background Sync
 	if c == nil {
 		return false, nil
@@ -46,91 +89,129 @@ func (s *Service) QuotaReached(c *models.ReqContext, target string) (bool, error
 			UserID: c.UserID,
 		}
 	}
-	return s.CheckQuotaReached(c.Req.Context(), target, params)
+	return s.CheckQuotaReached(c.Req.Context(), targetSrv, params)
+}
+
+func (s *service) GetQuotasByScope(ctx context.Context, scope quota.Scope, id int64) ([]quota.QuotaDTO, error) {
+	if err := scope.Validate(); err != nil {
+		return nil, err
+	}
+
+	q := make([]quota.QuotaDTO, 0)
+
+	scopeParams := quota.ScopeParameters{}
+	if scope == quota.OrgScope {
+		scopeParams.OrgID = id
+	} else if scope == quota.UserScope {
+		scopeParams.UserID = id
+	}
+
+	c, err := s.getContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	customLimits, err := s.store.Get(c, &scopeParams)
+	if err != nil {
+		return nil, err
+	}
+
+	u, err := s.getUsage(ctx, &scopeParams)
+	if err != nil {
+		return nil, err
+	}
+
+	for item := range s.defaultLimits.Iter() {
+		limit := item.Value
+
+		scp, err := item.Tag.GetScope()
+		if err != nil {
+			return nil, err
+		}
+
+		if scp != scope {
+			continue
+		}
+
+		if targetCustomLimit, ok := customLimits.Get(item.Tag); ok {
+			limit = targetCustomLimit
+		}
+
+		target, err := item.Tag.GetTarget()
+		if err != nil {
+			return nil, err
+		}
+
+		srv, err := item.Tag.GetSrv()
+		if err != nil {
+			return nil, err
+		}
+
+		used, _ := u.Get(item.Tag)
+		q = append(q, quota.QuotaDTO{
+			Target:  string(target),
+			Limit:   limit,
+			OrgId:   scopeParams.OrgID,
+			UserId:  scopeParams.UserID,
+			Used:    used,
+			Service: string(srv),
+			Scope:   string(scope),
+		})
+	}
+
+	return q, nil
+}
+
+func (s *service) Update(ctx context.Context, cmd *quota.UpdateQuotaCmd) error {
+	targetFound := false
+	knownTargets, err := s.defaultLimits.Targets()
+	if err != nil {
+		return err
+	}
+
+	for t := range knownTargets {
+		if t == quota.Target(cmd.Target) {
+			targetFound = true
+		}
+	}
+	if !targetFound {
+		return quota.ErrInvalidTarget.Errorf("unknown quota target: %s", cmd.Target)
+	}
+
+	c, err := s.getContext(ctx)
+	if err != nil {
+		return err
+	}
+	return s.store.Update(c, cmd)
 }
 
 // CheckQuotaReached check that quota is reached for a target. If ScopeParameters are not defined, only global scope is checked
-func (s *Service) CheckQuotaReached(ctx context.Context, target string, scopeParams *quota.ScopeParameters) (bool, error) {
-	if !s.Cfg.Quota.Enabled {
-		return false, nil
-	}
-	// get the list of scopes that this target is valid for. Org, User, Global
-	scopes, err := s.getQuotaScopes(target)
+func (s *service) CheckQuotaReached(ctx context.Context, targetSrv quota.TargetSrv, scopeParams *quota.ScopeParameters) (bool, error) {
+	targetSrvLimits, err := s.getOverridenLimits(ctx, targetSrv, scopeParams)
 	if err != nil {
 		return false, err
 	}
-	for _, scope := range scopes {
-		s.Logger.Debug("Checking quota", "target", target, "scope", scope)
 
-		switch scope.Name {
-		case "global":
-			if scope.DefaultLimit < 0 {
-				continue
-			}
-			if scope.DefaultLimit == 0 {
-				return true, nil
-			}
-			if target == "session" {
-				usedSessions, err := s.authTokenService.ActiveTokenCount(ctx)
-				if err != nil {
-					return false, err
-				}
+	usageReporterFunc, ok := s.getReporter(targetSrv)
+	if !ok {
+		return false, quota.ErrInvalidTargetSrv
+	}
+	targetUsage, err := usageReporterFunc(ctx, scopeParams)
+	if err != nil {
+		return false, err
+	}
 
-				if usedSessions > scope.DefaultLimit {
-					s.Logger.Debug("Sessions limit reached", "active", usedSessions, "limit", scope.DefaultLimit)
-					return true, nil
-				}
-				continue
+	for t, limit := range targetSrvLimits {
+		switch {
+		case limit < 0:
+			continue
+		case limit == 0:
+			return true, nil
+		default:
+			u, ok := targetUsage.Get(t)
+			if !ok {
+				return false, fmt.Errorf("no usage for target:%s", t)
 			}
-			query := models.GetGlobalQuotaByTargetQuery{Target: scope.Target, UnifiedAlertingEnabled: s.Cfg.UnifiedAlerting.IsEnabled()}
-			// TODO : move GetGlobalQuotaByTarget to a global quota service
-			if err := s.SQLStore.GetGlobalQuotaByTarget(ctx, &query); err != nil {
-				return true, err
-			}
-			if query.Result.Used >= scope.DefaultLimit {
-				return true, nil
-			}
-		case "org":
-			if scopeParams == nil {
-				continue
-			}
-			query := models.GetOrgQuotaByTargetQuery{
-				OrgId:                  scopeParams.OrgID,
-				Target:                 scope.Target,
-				Default:                scope.DefaultLimit,
-				UnifiedAlertingEnabled: s.Cfg.UnifiedAlerting.IsEnabled(),
-			}
-			// TODO: move GetOrgQuotaByTarget from sqlstore to quota store
-			if err := s.SQLStore.GetOrgQuotaByTarget(ctx, &query); err != nil {
-				return true, err
-			}
-			if query.Result.Limit < 0 {
-				continue
-			}
-			if query.Result.Limit == 0 {
-				return true, nil
-			}
-
-			if query.Result.Used >= query.Result.Limit {
-				return true, nil
-			}
-		case "user":
-			if scopeParams == nil || scopeParams.UserID == 0 {
-				continue
-			}
-			query := models.GetUserQuotaByTargetQuery{UserId: scopeParams.UserID, Target: scope.Target, Default: scope.DefaultLimit, UnifiedAlertingEnabled: s.Cfg.UnifiedAlerting.IsEnabled()}
-			// TODO: move GetUserQuotaByTarget from sqlstore to quota store
-			if err := s.SQLStore.GetUserQuotaByTarget(ctx, &query); err != nil {
-				return true, err
-			}
-			if query.Result.Limit < 0 {
-				continue
-			}
-			if query.Result.Limit == 0 {
-				return true, nil
-			}
-
-			if query.Result.Used >= query.Result.Limit {
+			if u >= limit {
 				return true, nil
 			}
 		}
@@ -138,68 +219,127 @@ func (s *Service) CheckQuotaReached(ctx context.Context, target string, scopePar
 	return false, nil
 }
 
-func (s *Service) getQuotaScopes(target string) ([]models.QuotaScope, error) {
-	scopes := make([]models.QuotaScope, 0)
-	switch target {
-	case "user":
-		scopes = append(scopes,
-			models.QuotaScope{Name: "global", Target: target, DefaultLimit: s.Cfg.Quota.Global.User},
-			models.QuotaScope{Name: "org", Target: "org_user", DefaultLimit: s.Cfg.Quota.Org.User},
-		)
-		return scopes, nil
-	case "org":
-		scopes = append(scopes,
-			models.QuotaScope{Name: "global", Target: target, DefaultLimit: s.Cfg.Quota.Global.Org},
-			models.QuotaScope{Name: "user", Target: "org_user", DefaultLimit: s.Cfg.Quota.User.Org},
-		)
-		return scopes, nil
-	case "dashboard":
-		scopes = append(scopes,
-			models.QuotaScope{
-				Name:         "global",
-				Target:       target,
-				DefaultLimit: s.Cfg.Quota.Global.Dashboard,
-			},
-			models.QuotaScope{
-				Name:         "org",
-				Target:       target,
-				DefaultLimit: s.Cfg.Quota.Org.Dashboard,
-			},
-		)
-		return scopes, nil
-	case "data_source":
-		scopes = append(scopes,
-			models.QuotaScope{Name: "global", Target: target, DefaultLimit: s.Cfg.Quota.Global.DataSource},
-			models.QuotaScope{Name: "org", Target: target, DefaultLimit: s.Cfg.Quota.Org.DataSource},
-		)
-		return scopes, nil
-	case "api_key":
-		scopes = append(scopes,
-			models.QuotaScope{Name: "global", Target: target, DefaultLimit: s.Cfg.Quota.Global.ApiKey},
-			models.QuotaScope{Name: "org", Target: target, DefaultLimit: s.Cfg.Quota.Org.ApiKey},
-		)
-		return scopes, nil
-	case "session":
-		scopes = append(scopes,
-			models.QuotaScope{Name: "global", Target: target, DefaultLimit: s.Cfg.Quota.Global.Session},
-		)
-		return scopes, nil
-	case "alert_rule": // target need to match the respective database name
-		scopes = append(scopes,
-			models.QuotaScope{Name: "global", Target: target, DefaultLimit: s.Cfg.Quota.Global.AlertRule},
-			models.QuotaScope{Name: "org", Target: target, DefaultLimit: s.Cfg.Quota.Org.AlertRule},
-		)
-		return scopes, nil
-	case "file":
-		scopes = append(scopes,
-			models.QuotaScope{Name: "global", Target: target, DefaultLimit: s.Cfg.Quota.Global.File},
-		)
-		return scopes, nil
-	default:
-		return scopes, quota.ErrInvalidQuotaTarget
+func (s *service) DeleteQuotaForUser(ctx context.Context, userID int64) error {
+	c, err := s.getContext(ctx)
+	if err != nil {
+		return err
 	}
+	return s.store.DeleteByUser(c, userID)
 }
 
-func (s *Service) DeleteByUser(ctx context.Context, userID int64) error {
-	return s.store.DeleteByUser(ctx, userID)
+func (s *service) RegisterQuotaReporter(e *quota.NewUsageReporter) error {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	_, ok := s.reporters[e.TargetSrv]
+	if ok {
+		return quota.ErrTargetSrvConflict.Errorf("target service: %s already exists", e.TargetSrv)
+	}
+
+	s.reporters[e.TargetSrv] = e.Reporter
+
+	for item := range e.DefaultLimits.Iter() {
+		target, err := item.Tag.GetTarget()
+		if err != nil {
+			return err
+		}
+		srv, err := item.Tag.GetSrv()
+		if err != nil {
+			return err
+		}
+		s.targetToSrv.Set(target, srv)
+		s.defaultLimits.Set(item.Tag, item.Value)
+	}
+
+	return nil
+}
+
+func (s *service) getReporter(target quota.TargetSrv) (quota.UsageReporterFunc, bool) {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	r, ok := s.reporters[target]
+	return r, ok
+}
+
+type reporter struct {
+	target       quota.TargetSrv
+	reporterFunc quota.UsageReporterFunc
+}
+
+func (s *service) getReporters() <-chan reporter {
+	ch := make(chan reporter)
+	go func() {
+		s.mutex.RLock()
+		defer func() {
+			s.mutex.RUnlock()
+			close(ch)
+		}()
+		for t, r := range s.reporters {
+			ch <- reporter{target: t, reporterFunc: r}
+		}
+	}()
+
+	return ch
+}
+
+func (s *service) getOverridenLimits(ctx context.Context, targetSrv quota.TargetSrv, scopeParams *quota.ScopeParameters) (map[quota.Tag]int64, error) {
+	targetSrvLimits := make(map[quota.Tag]int64)
+
+	c, err := s.getContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	customLimits, err := s.store.Get(c, scopeParams)
+	if err != nil {
+		return targetSrvLimits, err
+	}
+
+	for item := range s.defaultLimits.Iter() {
+		srv, err := item.Tag.GetSrv()
+		if err != nil {
+			return nil, err
+		}
+
+		if srv != targetSrv {
+			continue
+		}
+
+		defaultLimit := item.Value
+
+		if customLimit, ok := customLimits.Get(item.Tag); ok {
+			targetSrvLimits[item.Tag] = customLimit
+		} else {
+			targetSrvLimits[item.Tag] = defaultLimit
+		}
+	}
+
+	return targetSrvLimits, nil
+}
+
+func (s *service) getUsage(ctx context.Context, scopeParams *quota.ScopeParameters) (*quota.Map, error) {
+	usage := &quota.Map{}
+	g, ctx := errgroup.WithContext(ctx)
+
+	for r := range s.getReporters() {
+		r := r
+		g.Go(func() error {
+			u, err := r.reporterFunc(ctx, scopeParams)
+			if err != nil {
+				return err
+			}
+			usage.Merge(u)
+			return nil
+		})
+	}
+
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	return usage, nil
+}
+
+func (s *service) getContext(ctx context.Context) (quota.Context, error) {
+	return quota.FromContext(ctx, s.targetToSrv), nil
 }

pkg/services/quota/quotaimpl/quota_test.go

@@ -3,26 +3,481 @@ package quotaimpl
 import (
 	"context"
 	"testing"
+	"time"
 
+	"github.com/grafana/grafana/pkg/api/routing"
+	"github.com/grafana/grafana/pkg/bus"
+	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/infra/tracing"
+	acmock "github.com/grafana/grafana/pkg/services/accesscontrol/mock"
+	"github.com/grafana/grafana/pkg/services/annotations/annotationstest"
+	"github.com/grafana/grafana/pkg/services/apikey"
+	"github.com/grafana/grafana/pkg/services/apikey/apikeyimpl"
+	"github.com/grafana/grafana/pkg/services/auth"
+	"github.com/grafana/grafana/pkg/services/dashboards"
+	dashboardStore "github.com/grafana/grafana/pkg/services/dashboards/database"
+	"github.com/grafana/grafana/pkg/services/datasources"
+	dsservice "github.com/grafana/grafana/pkg/services/datasources/service"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/folder/foldertest"
+	"github.com/grafana/grafana/pkg/services/ngalert"
+	"github.com/grafana/grafana/pkg/services/ngalert/metrics"
+	ngalertmodels "github.com/grafana/grafana/pkg/services/ngalert/models"
+	ngalerttests "github.com/grafana/grafana/pkg/services/ngalert/tests"
+	"github.com/grafana/grafana/pkg/services/org"
+	"github.com/grafana/grafana/pkg/services/org/orgimpl"
+	"github.com/grafana/grafana/pkg/services/quota"
+	"github.com/grafana/grafana/pkg/services/quota/quotatest"
+	"github.com/grafana/grafana/pkg/services/secrets/fakes"
+	secretskvs "github.com/grafana/grafana/pkg/services/secrets/kvstore"
+	secretsmng "github.com/grafana/grafana/pkg/services/secrets/manager"
+	"github.com/grafana/grafana/pkg/services/sqlstore"
+	storesrv "github.com/grafana/grafana/pkg/services/store"
+	"github.com/grafana/grafana/pkg/services/tag/tagimpl"
+	"github.com/grafana/grafana/pkg/services/user"
+	"github.com/grafana/grafana/pkg/services/user/userimpl"
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/require"
+	"github.com/xorcare/pointer"
 )
 
 func TestQuotaService(t *testing.T) {
-	quotaStore := &FakeQuotaStore{}
-	quotaService := Service{
+	quotaStore := &quotatest.FakeQuotaStore{}
+	quotaService := service{
 		store: quotaStore,
 	}
 
 	t.Run("delete quota", func(t *testing.T) {
-		err := quotaService.DeleteByUser(context.Background(), 1)
+		err := quotaService.DeleteQuotaForUser(context.Background(), 1)
 		require.NoError(t, err)
 	})
 }
 
-type FakeQuotaStore struct {
-	ExpectedError error
+func TestIntegrationQuotaCommandsAndQueries(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+	sqlStore := sqlstore.InitTestDB(t)
+	sqlStore.Cfg.Quota = setting.QuotaSettings{
+		Enabled: true,
+
+		Org: setting.OrgQuota{
+			User:       2,
+			Dashboard:  3,
+			DataSource: 4,
+			ApiKey:     5,
+			AlertRule:  6,
+		},
+		User: setting.UserQuota{
+			Org: 7,
+		},
+		Global: setting.GlobalQuota{
+			Org:        8,
+			User:       9,
+			Dashboard:  10,
+			DataSource: 11,
+			ApiKey:     12,
+			Session:    13,
+			AlertRule:  14,
+			File:       15,
+		},
+	}
+
+	b := bus.ProvideBus(tracing.InitializeTracerForTest())
+	quotaService := ProvideService(sqlStore, sqlStore.Cfg)
+	orgService, err := orgimpl.ProvideService(sqlStore, sqlStore.Cfg, quotaService)
+	require.NoError(t, err)
+	userService, err := userimpl.ProvideService(sqlStore, orgService, sqlStore.Cfg, nil, nil, quotaService)
+	require.NoError(t, err)
+	setupEnv(t, sqlStore, b, quotaService)
+
+	u, err := userService.Create(context.Background(), &user.CreateUserCommand{
+		Name:         "TestUser",
+		SkipOrgSetup: true,
+	})
+	require.NoError(t, err)
+
+	o, err := orgService.CreateWithMember(context.Background(), &org.CreateOrgCommand{
+		Name:   "TestOrg",
+		UserID: u.ID,
+	})
+	require.NoError(t, err)
+
+	// fetch global default limit/usage
+	defaultGlobalLimits := make(map[quota.Tag]int64)
+	existingGlobalUsage := make(map[quota.Tag]int64)
+	scope := quota.GlobalScope
+	result, err := quotaService.GetQuotasByScope(context.Background(), scope, 0)
+	require.NoError(t, err)
+	for _, r := range result {
+		tag, err := r.Tag()
+		require.NoError(t, err)
+		defaultGlobalLimits[tag] = r.Limit
+		existingGlobalUsage[tag] = r.Used
+	}
+	tag, err := quota.NewTag(quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgQuotaTarget), scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Global.Org, defaultGlobalLimits[tag])
+	tag, err = quota.NewTag(quota.TargetSrv(user.QuotaTargetSrv), quota.Target(user.QuotaTarget), scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Global.User, defaultGlobalLimits[tag])
+	tag, err = quota.NewTag(dashboards.QuotaTargetSrv, dashboards.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Global.Dashboard, defaultGlobalLimits[tag])
+	tag, err = quota.NewTag(datasources.QuotaTargetSrv, datasources.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Global.DataSource, defaultGlobalLimits[tag])
+	tag, err = quota.NewTag(apikey.QuotaTargetSrv, apikey.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Global.ApiKey, defaultGlobalLimits[tag])
+	tag, err = quota.NewTag(auth.QuotaTargetSrv, auth.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Global.Session, defaultGlobalLimits[tag])
+	tag, err = quota.NewTag(ngalertmodels.QuotaTargetSrv, ngalertmodels.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Global.AlertRule, defaultGlobalLimits[tag])
+	tag, err = quota.NewTag(storesrv.QuotaTargetSrv, storesrv.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Global.File, defaultGlobalLimits[tag])
+
+	// fetch default limit/usage for org
+	defaultOrgLimits := make(map[quota.Tag]int64)
+	existingOrgUsage := make(map[quota.Tag]int64)
+	scope = quota.OrgScope
+	result, err = quotaService.GetQuotasByScope(context.Background(), scope, o.ID)
+	require.NoError(t, err)
+	for _, r := range result {
+		tag, err := r.Tag()
+		require.NoError(t, err)
+		defaultOrgLimits[tag] = r.Limit
+		existingOrgUsage[tag] = r.Used
+	}
+	tag, err = quota.NewTag(quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Org.User, defaultOrgLimits[tag])
+	tag, err = quota.NewTag(dashboards.QuotaTargetSrv, dashboards.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Org.Dashboard, defaultOrgLimits[tag])
+	tag, err = quota.NewTag(datasources.QuotaTargetSrv, datasources.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Org.DataSource, defaultOrgLimits[tag])
+	tag, err = quota.NewTag(apikey.QuotaTargetSrv, apikey.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Org.ApiKey, defaultOrgLimits[tag])
+	tag, err = quota.NewTag(ngalertmodels.QuotaTargetSrv, ngalertmodels.QuotaTarget, scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.Org.AlertRule, defaultOrgLimits[tag])
+
+	// fetch default limit/usage for user
+	defaultUserLimits := make(map[quota.Tag]int64)
+	existingUserUsage := make(map[quota.Tag]int64)
+	scope = quota.UserScope
+	result, err = quotaService.GetQuotasByScope(context.Background(), scope, u.ID)
+	require.NoError(t, err)
+	for _, r := range result {
+		tag, err := r.Tag()
+		require.NoError(t, err)
+		defaultUserLimits[tag] = r.Limit
+		existingUserUsage[tag] = r.Used
+	}
+	tag, err = quota.NewTag(quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), scope)
+	require.NoError(t, err)
+	require.Equal(t, sqlStore.Cfg.Quota.User.Org, defaultUserLimits[tag])
+
+	t.Run("Given saved org quota for users", func(t *testing.T) {
+		// update quota for the created org and limit users to 1
+		var customOrgUserLimit int64 = 1
+		orgCmd := quota.UpdateQuotaCmd{
+			OrgID:  o.ID,
+			Target: org.OrgUserQuotaTarget,
+			Limit:  customOrgUserLimit,
+		}
+		err := quotaService.Update(context.Background(), &orgCmd)
+		require.NoError(t, err)
+
+		t.Run("Should be able to get saved limit/usage for org users", func(t *testing.T) {
+			q, err := getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), quota.OrgScope, &quota.ScopeParameters{OrgID: o.ID})
+			require.NoError(t, err)
+
+			require.Equal(t, customOrgUserLimit, q.Limit)
+			require.Equal(t, int64(1), q.Used)
+		})
+
+		t.Run("Should be able to get default org users limit/usage for unknown org", func(t *testing.T) {
+			unknownOrgID := -1
+			q, err := getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), quota.OrgScope, &quota.ScopeParameters{OrgID: int64(unknownOrgID)})
+			require.NoError(t, err)
+
+			tag, err := q.Tag()
+			require.NoError(t, err)
+			require.Equal(t, defaultOrgLimits[tag], q.Limit)
+			require.Equal(t, int64(0), q.Used)
+		})
+
+		t.Run("Should be able to get zero used org alert quota when table does not exist (ngalert is not enabled - default case)", func(t *testing.T) {
+			// disable Grafana Alerting
+			cfg := *sqlStore.Cfg
+			cfg.UnifiedAlerting = setting.UnifiedAlertingSettings{Enabled: pointer.Bool(false)}
+
+			quotaSrv := ProvideService(sqlStore, &cfg)
+			q, err := getQuotaBySrvTargetScope(t, quotaSrv, ngalertmodels.QuotaTargetSrv, ngalertmodels.QuotaTarget, quota.OrgScope, &quota.ScopeParameters{OrgID: o.ID})
+
+			require.NoError(t, err)
+			require.Equal(t, int64(0), q.Limit)
+		})
+
+		t.Run("Should be able to quota list for org", func(t *testing.T) {
+			result, err := quotaService.GetQuotasByScope(context.Background(), quota.OrgScope, o.ID)
+			require.NoError(t, err)
+			require.Len(t, result, 5)
+
+			require.NoError(t, err)
+			for _, res := range result {
+				tag, err := res.Tag()
+				require.NoError(t, err)
+				limit := defaultOrgLimits[tag]
+				used := existingOrgUsage[tag]
+				if res.Target == org.OrgUserQuotaTarget {
+					limit = customOrgUserLimit
+					used = 1 // one user in the created org
+				}
+				require.Equal(t, limit, res.Limit)
+				require.Equal(t, used, res.Used)
+			}
+		})
+	})
+
+	t.Run("Given saved org quota for dashboards", func(t *testing.T) {
+		// update quota for the created org and limit dashboards to 1
+		var customOrgDashboardLimit int64 = 1
+		orgCmd := quota.UpdateQuotaCmd{
+			OrgID:  o.ID,
+			Target: string(dashboards.QuotaTarget),
+			Limit:  customOrgDashboardLimit,
+		}
+		err := quotaService.Update(context.Background(), &orgCmd)
+		require.NoError(t, err)
+
+		t.Run("Should be able to get saved quota by org id and target", func(t *testing.T) {
+			q, err := getQuotaBySrvTargetScope(t, quotaService, dashboards.QuotaTargetSrv, dashboards.QuotaTarget, quota.OrgScope, &quota.ScopeParameters{OrgID: o.ID})
+			require.NoError(t, err)
+
+			tag, err := q.Tag()
+			require.NoError(t, err)
+			require.Equal(t, customOrgDashboardLimit, q.Limit)
+			require.Equal(t, existingOrgUsage[tag], q.Used)
+		})
+	})
+
+	t.Run("Given saved user quota for org", func(t *testing.T) {
+		// update quota for the created user and limit orgs to 1
+		var customUserOrgsLimit int64 = 1
+		userQuotaCmd := quota.UpdateQuotaCmd{
+			UserID: u.ID,
+			Target: org.OrgUserQuotaTarget,
+			Limit:  customUserOrgsLimit,
+		}
+		err := quotaService.Update(context.Background(), &userQuotaCmd)
+		require.NoError(t, err)
+
+		t.Run("Should be able to get saved limit/usage for user orgs", func(t *testing.T) {
+			q, err := getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), quota.UserScope, &quota.ScopeParameters{UserID: u.ID})
+			require.NoError(t, err)
+
+			require.Equal(t, customUserOrgsLimit, q.Limit)
+			require.Equal(t, int64(1), q.Used)
+		})
+
+		t.Run("Should be able to get default user orgs limit/usage for unknown user", func(t *testing.T) {
+			var unknownUserID int64 = -1
+			q, err := getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), quota.UserScope, &quota.ScopeParameters{UserID: unknownUserID})
+			require.NoError(t, err)
+
+			tag, err := q.Tag()
+			require.NoError(t, err)
+			require.Equal(t, defaultUserLimits[tag], q.Limit)
+			require.Equal(t, int64(0), q.Used)
+		})
+
+		t.Run("Should be able to quota list for user", func(t *testing.T) {
+			result, err = quotaService.GetQuotasByScope(context.Background(), quota.UserScope, u.ID)
+			require.NoError(t, err)
+			require.Len(t, result, 1)
+			for _, res := range result {
+				tag, err := res.Tag()
+				require.NoError(t, err)
+				limit := defaultUserLimits[tag]
+				used := existingUserUsage[tag]
+				if res.Target == org.OrgUserQuotaTarget {
+					limit = customUserOrgsLimit // customized quota limit.
+					used = 1                    // one user in the created org
+				}
+				require.Equal(t, limit, res.Limit)
+				require.Equal(t, used, res.Used)
+			}
+		})
+	})
+
+	t.Run("Should be able to global user quota", func(t *testing.T) {
+		q, err := getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(user.QuotaTargetSrv), quota.Target(user.QuotaTarget), quota.GlobalScope, &quota.ScopeParameters{})
+		require.NoError(t, err)
+
+		tag, err := q.Tag()
+		require.NoError(t, err)
+		require.Equal(t, defaultGlobalLimits[tag], q.Limit)
+		require.Equal(t, int64(1), q.Used)
+	})
+
+	t.Run("Should be able to global org quota", func(t *testing.T) {
+		q, err := getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgQuotaTarget), quota.GlobalScope, &quota.ScopeParameters{})
+		require.NoError(t, err)
+
+		tag, err := q.Tag()
+		require.NoError(t, err)
+		require.Equal(t, defaultGlobalLimits[tag], q.Limit)
+		require.Equal(t, int64(1), q.Used)
+	})
+
+	t.Run("Should be able to get zero used global alert quota when table does not exist (ngalert is not enabled - default case)", func(t *testing.T) {
+		q, err := getQuotaBySrvTargetScope(t, quotaService, ngalertmodels.QuotaTargetSrv, ngalertmodels.QuotaTarget, quota.GlobalScope, &quota.ScopeParameters{})
+		require.NoError(t, err)
+
+		tag, err := q.Tag()
+		require.NoError(t, err)
+		require.Equal(t, defaultGlobalLimits[tag], q.Limit)
+		require.Equal(t, int64(0), q.Used)
+	})
+
+	t.Run("Should be able to global dashboard quota", func(t *testing.T) {
+		q, err := getQuotaBySrvTargetScope(t, quotaService, dashboards.QuotaTargetSrv, dashboards.QuotaTarget, quota.GlobalScope, &quota.ScopeParameters{})
+		require.NoError(t, err)
+
+		tag, err := q.Tag()
+		require.NoError(t, err)
+		require.Equal(t, defaultGlobalLimits[tag], q.Limit)
+		require.Equal(t, int64(0), q.Used)
+	})
+
+	// related: https://github.com/grafana/grafana/issues/14342
+	t.Run("Should org quota updating is successful even if it called multiple time", func(t *testing.T) {
+		// update quota for the created org and limit users to 1
+		var customOrgUserLimit int64 = 1
+		orgCmd := quota.UpdateQuotaCmd{
+			OrgID:  o.ID,
+			Target: org.OrgUserQuotaTarget,
+			Limit:  customOrgUserLimit,
+		}
+		err := quotaService.Update(context.Background(), &orgCmd)
+		require.NoError(t, err)
+
+		query, err := getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), quota.OrgScope, &quota.ScopeParameters{OrgID: o.ID})
+		require.NoError(t, err)
+		require.Equal(t, customOrgUserLimit, query.Limit)
+
+		// XXX: resolution of `Updated` column is 1sec, so this makes delay
+		time.Sleep(1 * time.Second)
+
+		customOrgUserLimit = 2
+		orgCmd = quota.UpdateQuotaCmd{
+			OrgID:  o.ID,
+			Target: org.OrgUserQuotaTarget,
+			Limit:  customOrgUserLimit,
+		}
+		err = quotaService.Update(context.Background(), &orgCmd)
+		require.NoError(t, err)
+
+		query, err = getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), quota.OrgScope, &quota.ScopeParameters{OrgID: o.ID})
+		require.NoError(t, err)
+		require.Equal(t, customOrgUserLimit, query.Limit)
+	})
+
+	// related: https://github.com/grafana/grafana/issues/14342
+	t.Run("Should user quota updating is successful even if it called multiple time", func(t *testing.T) {
+		// update quota for the created org and limit users to 1
+		var customUserOrgLimit int64 = 1
+		userQuotaCmd := quota.UpdateQuotaCmd{
+			UserID: u.ID,
+			Target: org.OrgUserQuotaTarget,
+			Limit:  customUserOrgLimit,
+		}
+		err := quotaService.Update(context.Background(), &userQuotaCmd)
+		require.NoError(t, err)
+
+		query, err := getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), quota.UserScope, &quota.ScopeParameters{UserID: u.ID})
+		require.NoError(t, err)
+		require.Equal(t, customUserOrgLimit, query.Limit)
+
+		// XXX: resolution of `Updated` column is 1sec, so this makes delay
+		time.Sleep(1 * time.Second)
+
+		customUserOrgLimit = 10
+		userQuotaCmd = quota.UpdateQuotaCmd{
+			UserID: u.ID,
+			Target: org.OrgUserQuotaTarget,
+			Limit:  customUserOrgLimit,
+		}
+		err = quotaService.Update(context.Background(), &userQuotaCmd)
+		require.NoError(t, err)
+
+		query, err = getQuotaBySrvTargetScope(t, quotaService, quota.TargetSrv(org.QuotaTargetSrv), quota.Target(org.OrgUserQuotaTarget), quota.UserScope, &quota.ScopeParameters{UserID: u.ID})
+		require.NoError(t, err)
+		require.Equal(t, customUserOrgLimit, query.Limit)
+	})
+
+	// TODO data_source, file
 }
 
-func (f *FakeQuotaStore) DeleteByUser(ctx context.Context, userID int64) error {
-	return f.ExpectedError
+func getQuotaBySrvTargetScope(t *testing.T, quotaService quota.Service, srv quota.TargetSrv, target quota.Target, scope quota.Scope, scopeParams *quota.ScopeParameters) (quota.QuotaDTO, error) {
+	t.Helper()
+
+	var id int64 = 0
+	switch {
+	case scope == quota.OrgScope:
+		id = scopeParams.OrgID
+	case scope == quota.UserScope:
+		id = scopeParams.UserID
+	}
+
+	result, err := quotaService.GetQuotasByScope(context.Background(), scope, id)
+	require.NoError(t, err)
+	for _, r := range result {
+		if r.Target != string(target) {
+			continue
+		}
+
+		if r.Service != string(srv) {
+			continue
+		}
+
+		if r.Scope != string(scope) {
+			continue
+		}
+
+		require.Equal(t, r.OrgId, scopeParams.OrgID)
+		require.Equal(t, r.UserId, scopeParams.UserID)
+		return r, nil
+	}
+	return quota.QuotaDTO{}, err
+}
+
+func setupEnv(t *testing.T, sqlStore *sqlstore.SQLStore, b bus.Bus, quotaService quota.Service) {
+	_, err := apikeyimpl.ProvideService(sqlStore, sqlStore.Cfg, quotaService)
+	require.NoError(t, err)
+	_, err = auth.ProvideActiveAuthTokenService(sqlStore.Cfg, sqlStore, quotaService)
+	require.NoError(t, err)
+	_, err = dashboardStore.ProvideDashboardStore(sqlStore, sqlStore.Cfg, featuremgmt.WithFeatures(), tagimpl.ProvideService(sqlStore, sqlStore.Cfg), quotaService)
+	require.NoError(t, err)
+	secretsService := secretsmng.SetupTestService(t, fakes.NewFakeSecretsStore())
+	secretsStore := secretskvs.NewSQLSecretsKVStore(sqlStore, secretsService, log.New("test.logger"))
+	_, err = dsservice.ProvideService(sqlStore, secretsService, secretsStore, sqlStore.Cfg, featuremgmt.WithFeatures(), acmock.New().WithDisabled(), acmock.NewMockedPermissionsService(), quotaService)
+	require.NoError(t, err)
+	m := metrics.NewNGAlert(prometheus.NewRegistry())
+	_, err = ngalert.ProvideService(
+		sqlStore.Cfg, &ngalerttests.FakeFeatures{}, nil, nil, routing.NewRouteRegister(), sqlStore, nil, nil, nil, quotaService,
+		secretsService, nil, m, &foldertest.FakeService{}, &acmock.Mock{}, &dashboards.FakeDashboardService{}, nil, b, &acmock.Mock{}, annotationstest.NewFakeAnnotationsRepo(),
+	)
+	require.NoError(t, err)
+	_, err = storesrv.ProvideService(sqlStore, featuremgmt.WithFeatures(), sqlStore.Cfg, quotaService)
+	require.NoError(t, err)
 }

pkg/services/quota/quotaimpl/store.go

@@ -1,23 +1,130 @@
 package quotaimpl
 
 import (
-	"context"
+	"time"
 
 	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/services/quota"
+	"github.com/grafana/grafana/pkg/services/sqlstore"
 )
 
 type store interface {
-	DeleteByUser(context.Context, int64) error
+	Get(ctx quota.Context, scopeParams *quota.ScopeParameters) (*quota.Map, error)
+	Update(ctx quota.Context, cmd *quota.UpdateQuotaCmd) error
+	DeleteByUser(quota.Context, int64) error
 }
 
 type sqlStore struct {
-	db db.DB
+	db     db.DB
+	logger log.Logger
 }
 
-func (ss *sqlStore) DeleteByUser(ctx context.Context, userID int64) error {
+func (ss *sqlStore) DeleteByUser(ctx quota.Context, userID int64) error {
 	return ss.db.WithDbSession(ctx, func(sess *db.Session) error {
 		var rawSQL = "DELETE FROM quota WHERE user_id = ?"
 		_, err := sess.Exec(rawSQL, userID)
 		return err
 	})
 }
+
+func (ss *sqlStore) Get(ctx quota.Context, scopeParams *quota.ScopeParameters) (*quota.Map, error) {
+	limits := quota.Map{}
+	if scopeParams.OrgID != 0 {
+		orgLimits, err := ss.getOrgScopeQuota(ctx, scopeParams.OrgID)
+		if err != nil {
+			return nil, err
+		}
+		limits.Merge(orgLimits)
+	}
+
+	if scopeParams.UserID != 0 {
+		userLimits, err := ss.getUserScopeQuota(ctx, scopeParams.UserID)
+		if err != nil {
+			return nil, err
+		}
+		limits.Merge(userLimits)
+	}
+
+	return &limits, nil
+}
+
+func (ss *sqlStore) Update(ctx quota.Context, cmd *quota.UpdateQuotaCmd) error {
+	return ss.db.WithTransactionalDbSession(ctx, func(sess *sqlstore.DBSession) error {
+		// Check if quota is already defined in the DB
+		quota := quota.Quota{
+			Target: cmd.Target,
+			UserId: cmd.UserID,
+			OrgId:  cmd.OrgID,
+		}
+		has, err := sess.Get(&quota)
+		if err != nil {
+			return err
+		}
+		quota.Updated = time.Now()
+		quota.Limit = cmd.Limit
+		if !has {
+			quota.Created = time.Now()
+			// No quota in the DB for this target, so create a new one.
+			if _, err := sess.Insert(&quota); err != nil {
+				return err
+			}
+		} else {
+			// update existing quota entry in the DB.
+			_, err := sess.ID(quota.Id).Update(&quota)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
+func (ss *sqlStore) getUserScopeQuota(ctx quota.Context, userID int64) (*quota.Map, error) {
+	r := quota.Map{}
+	err := ss.db.WithDbSession(ctx, func(sess *sqlstore.DBSession) error {
+		quotas := make([]*quota.Quota, 0)
+		if err := sess.Table("quota").Where("user_id=? AND org_id=0", userID).Find(&quotas); err != nil {
+			return err
+		}
+
+		for _, q := range quotas {
+			srv, ok := ctx.TargetToSrv.Get(quota.Target(q.Target))
+			if !ok {
+				ss.logger.Info("failed to get service for target", "target", q.Target)
+			}
+			tag, err := quota.NewTag(srv, quota.Target(q.Target), quota.UserScope)
+			if err != nil {
+				return err
+			}
+			r.Set(tag, q.Limit)
+		}
+		return nil
+	})
+	return &r, err
+}
+
+func (ss *sqlStore) getOrgScopeQuota(ctx quota.Context, OrgID int64) (*quota.Map, error) {
+	r := quota.Map{}
+	err := ss.db.WithDbSession(ctx, func(sess *sqlstore.DBSession) error {
+		quotas := make([]*quota.Quota, 0)
+		if err := sess.Table("quota").Where("user_id=0 AND org_id=?", OrgID).Find(&quotas); err != nil {
+			return err
+		}
+
+		for _, q := range quotas {
+			srv, ok := ctx.TargetToSrv.Get(quota.Target(q.Target))
+			if !ok {
+				ss.logger.Info("failed to get service for target", "target", q.Target)
+			}
+			tag, err := quota.NewTag(srv, quota.Target(q.Target), quota.OrgScope)
+			if err != nil {
+				return err
+			}
+			r.Set(tag, q.Limit)
+		}
+		return nil
+	})
+	return &r, err
+}

pkg/services/quota/quotaimpl/store_test.go

@@ -7,6 +7,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/services/quota"
 )
 
 func TestIntegrationQuotaDataAccess(t *testing.T) {
@@ -20,7 +21,8 @@ func TestIntegrationQuotaDataAccess(t *testing.T) {
 	}
 
 	t.Run("quota deleted", func(t *testing.T) {
-		err := quotaStore.DeleteByUser(context.Background(), 1)
+		ctx := quota.FromContext(context.Background(), &quota.TargetToSrv{})
+		err := quotaStore.DeleteByUser(ctx, 1)
 		require.NoError(t, err)
 	})
 }