一个账号服务多个租户：行情数据层的密钥隔离、配额分摊与故障围栏

# tenant_gateway.py — 多租户配额网关（仅标准库）
import json, time, urllib.error, urllib.request
from collections import defaultdict

API = "https://api.tiqex.io/api/v1/market/quote"

TENANT_KEYS = {"acme": "tk_acme_xxx", "globex": "tk_globex_xxx"}

# Daily quota and RPM are orthogonal: split separately.
TENANT_QUOTA = {"acme": {"daily": 200_000, "rpm": 200},
                "globex": {"daily": 60_000, "rpm": 60}}

_used = defaultdict(int)
_window = {}
_cooldown = {}


def gate(tenant):
    """None to pass, else the block reason."""
    now = time.time()
    if now < _cooldown.get(tenant, 0):
        return "cooldown"
    if _used[tenant] >= TENANT_QUOTA[tenant]["daily"]:
        return "DAILY_LIMIT_EXCEEDED"
    start, n = _window.get(tenant, (now, 0))
    if now - start >= 60:
        _window[tenant] = (now, 1)
    elif n + 1 > TENANT_QUOTA[tenant]["rpm"]:
        return "RATE_LIMIT_EXCEEDED"
    else:
        _window[tenant] = (start, n + 1)
    return None


def http_get(codes, api_key):
    req = urllib.request.Request(
        API + "?codes=" + codes,
        headers={"X-API-Key": api_key, "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=10) as r:
            return r.status, dict(r.headers), json.loads(r.read().decode())
    except urllib.error.HTTPError as e:
        return e.code, dict(e.headers), json.loads(e.read().decode() or "{}")


def call_quote(tenant, codes):
    reason = gate(tenant)
    if reason:
        return {"tenant": tenant, "ok": False, "reason": reason}
    status, headers, body = http_get(codes, TENANT_KEYS[tenant])
    rid = headers.get("X-Request-Id")
    if status == 429:  # per-key and per-account backoff differ
        wait = int(headers.get("Retry-After") or 1)
        _cooldown[tenant] = time.time() + wait
        return {"tenant": tenant, "ok": False, "reason": body.get("code"),
                "retryAfter": wait, "requestId": rid}
    if status >= 400 or not body.get("succ"):
        return {"tenant": tenant, "ok": False,
                "reason": body.get("code") or status, "requestId": rid}
    _used[tenant] += 1  # a WS handshake counts once too
    return {"tenant": tenant, "ok": True, "requestId": rid, "data": body.get("data")}


if __name__ == "__main__":
    # Offline self-test: stub the transport.
    http_get = lambda codes, api_key: (200, {"X-Request-Id": "req_demo"},
                                       {"succ": True, "data": [{"code": codes}]})
    for tenant in ("acme", "globex"):
        print(call_quote(tenant, "EURUSD,XAUUSD"), "daily =", _used[tenant])

# ws_budget.py — split the account-level WS caps across tenants up front
PLAN_WS = {"free": (1, 10), "growth": (3, 25), "pro": (10, 50), "enterprise": (50, 200)}


def allocate(plan, weights):
    """Raise on oversell rather than at runtime."""
    max_conn, max_sym = PLAN_WS[plan]
    total = sum(weights.values())
    out, used_conn, used_sym = {}, 0, 0
    for tenant, w in weights.items():
        conn = max(1, round(max_conn * w / total))
        sym = max(1, round(max_sym * w / total))
        out[tenant] = {"connections": conn, "symbols": sym}
        used_conn, used_sym = used_conn + conn, used_sym + sym
    if used_conn > max_conn or used_sym > max_sym:
        raise ValueError("oversold: reduce weights or upgrade the plan")
    return out


if __name__ == "__main__":
    print(allocate("pro", {"acme": 5, "globex": 3, "initech": 2}))