Phase 4: real per-tenant ClickHouse isolation via a new enterprise-api binary

Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.

Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.

Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."

Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.

enterprise/internal/audit/integration_test.go

@@ -18,8 +18,12 @@ import (
 	"path/filepath"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/sentry/sentry/api/authz"
+	"github.com/sentry/sentry/api/queryapi"
 )
 
 func testPool(t *testing.T, user, password string) *pgxpool.Pool {
@@ -92,6 +96,50 @@ func TestAppendAndVerifyChainRealPostgres(t *testing.T) {
 	}
 }
 
+// TestQueryAPILoggerWritesAttributedToContextIdentity proves the
+// adapter queryapi.Handler actually calls in production (via
+// enterprise-api's wiring) reads tenant/user from context, not from any
+// field on QueryAuditEntry -- matching that type's own doc comment.
+func TestQueryAPILoggerWritesAttributedToContextIdentity(t *testing.T) {
+	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
+	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	cleanupAuditLog(t, adminPool)
+	defer cleanupAuditLog(t, adminPool)
+
+	logger := NewQueryAPILogger(NewStore(writerPool), SourceAPI)
+	ctx := authz.WithIdentity(context.Background(), authz.Identity{TenantID: "acme", UserID: "11111111-1111-1111-1111-111111111111", Role: authz.RoleViewer})
+
+	err := logger.LogQuery(ctx, queryapi.QueryAuditEntry{
+		Query: "stats count", Language: "spl", RowCount: 3, Duration: 42 * time.Millisecond, Success: true,
+	})
+	if err != nil {
+		t.Fatalf("LogQuery: %v", err)
+	}
+
+	var tenantID, userID, queryText string
+	row := adminPool.QueryRow(context.Background(),
+		`SELECT tenant_id, user_id, query_text FROM audit_log ORDER BY id DESC LIMIT 1`)
+	if err := row.Scan(&tenantID, &userID, &queryText); err != nil {
+		t.Fatalf("reading back the written row: %v", err)
+	}
+	if tenantID != "acme" || userID != "11111111-1111-1111-1111-111111111111" || queryText != "stats count" {
+		t.Fatalf("got tenant_id=%q user_id=%q query_text=%q, want acme/11111111-.../\"stats count\"", tenantID, userID, queryText)
+	}
+}
+
+func TestQueryAPILoggerRefusesWithoutIdentity(t *testing.T) {
+	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
+	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	cleanupAuditLog(t, adminPool)
+	defer cleanupAuditLog(t, adminPool)
+
+	logger := NewQueryAPILogger(NewStore(writerPool), SourceAPI)
+	err := logger.LogQuery(context.Background(), queryapi.QueryAuditEntry{Query: "stats count", Success: true})
+	if err == nil {
+		t.Fatal("expected LogQuery to refuse writing an entry with no tenant identity in context")
+	}
+}
+
 // TestVerifyChainDetectsTampering proves the chain actually catches an
 // in-place row modification -- not just that VerifyChain runs without
 // erroring on untampered data, which a bug returning OK unconditionally

enterprise/internal/audit/queryapi_adapter.go

@@ -0,0 +1,76 @@
+// Adapts *Store to api/queryapi.AuditLogger -- the interface core
+// defines and has carried as a nil-by-default field
+// (api/queryapi.Handler.audit) since Phase 4 task 4, waiting on exactly
+// this: a real implementation, wired in by enterprise/cmd/enterprise-api
+// (the one binary allowed to import both packages -- see chrunner's doc
+// comment on the enterprise->api import direction).
+package audit
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/sentry/sentry/api/authz"
+	"github.com/sentry/sentry/api/queryapi"
+)
+
+// QueryAPILogger implements queryapi.AuditLogger by translating its
+// tenant-agnostic QueryAuditEntry into this package's Entry, reading
+// tenant/user identity from ctx -- exactly the shape
+// queryapi.AuditLogger's doc comment describes: "an enterprise-side
+// implementation reads identity from ctx rather than this interface
+// growing tenant-awareness."
+type QueryAPILogger struct {
+	store  *Store
+	source Source
+}
+
+// NewQueryAPILogger wraps store for use as a specific Source -- api's
+// queryapi.Handler and /alerting's evaluations go through different
+// enterprise-api-fronted paths today (SourceAPI is the only one
+// actually wired to a real HTTP handler; SourceAlerting is named for
+// when alerting's queries get audited the same way, not yet built).
+func NewQueryAPILogger(store *Store, source Source) *QueryAPILogger {
+	return &QueryAPILogger{store: store, source: source}
+}
+
+func (l *QueryAPILogger) LogQuery(ctx context.Context, entry queryapi.QueryAuditEntry) error {
+	identity, ok := authz.IdentityFromContext(ctx)
+	if !ok || identity.TenantID == "" {
+		// Fail open at the queryapi.Handler call site already covers
+		// "don't take down the query path" -- this specific error tells
+		// that fail-open path *why* the write didn't happen, distinct
+		// from a real audit-storage failure, since chrunner.RunSQL
+		// would already have refused the query itself in this case (see
+		// that package's RunSQL) -- this branch mostly protects against
+		// a future caller that skips chrunner's own check.
+		return fmt.Errorf("audit: no tenant identity in context, refusing to write an unattributable audit entry")
+	}
+
+	status := StatusSuccess
+	var errMsg *string
+	if !entry.Success {
+		status = StatusError
+		errMsg = &entry.Error
+	}
+	var userID *string
+	if identity.UserID != "" {
+		userID = &identity.UserID
+	}
+	queryText := entry.Query
+	rowCount := entry.RowCount
+	durationMS := int(entry.Duration.Milliseconds())
+
+	_, err := l.store.Append(ctx, Entry{
+		TenantID:     identity.TenantID,
+		UserID:       userID,
+		Source:       l.source,
+		EventType:    EventQuery,
+		QueryText:    &queryText,
+		RowCount:     &rowCount,
+		DurationMS:   &durationMS,
+		Status:       status,
+		ErrorMessage: errMsg,
+	})
+	return err
+}