refactor(server): rate limit and permission (#4198)

Co-authored-by: LongYinan <lynweklm@gmail.com>

packages/workspace/src/blob/cloud-blob-storage.ts

@@ -1,13 +1,13 @@
 import {
+  checkBlobSizesQuery,
   deleteBlobMutation,
   fetchWithTraceReport,
   listBlobsQuery,
   setBlobMutation,
 } from '@affine/graphql';
+import { fetcher } from '@affine/workspace/affine/gql';
 import type { BlobStorage } from '@blocksuite/store';
 
-import { fetcher } from '../affine/gql';
-
 export const createCloudBlobStorage = (workspaceId: string): BlobStorage => {
   return {
     crud: {
@@ -18,6 +18,20 @@ export const createCloudBlobStorage = (workspaceId: string): BlobStorage => {
         ).then(res => res.blob());
       },
       set: async (key, value) => {
+        const {
+          checkBlobSize: { size },
+        } = await fetcher({
+          query: checkBlobSizesQuery,
+          variables: {
+            workspaceId,
+            size: value.size,
+          },
+        });
+
+        if (size <= 0) {
+          throw new Error('Blob size limit exceeded');
+        }
+
         const result = await fetcher({
           query: setBlobMutation,
           variables: {