Phase 4: real per-tenant ClickHouse isolation via a new enterprise-api binary

Closes the threat model's headline finding for the SQL query path: enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT against ClickHouse, and enterprise/internal/chrunner is a per-tenant connection registry implementing api's SQLRunner interface, resolving the tenant from the authenticated request identity -- never a caller-suppliable parameter. Both are wired into a new binary, enterprise/cmd/enterprise-api, alongside the unchanged single-tenant api/cmd/api, since AGPL core can never import enterprise/ and Go's own internal/ package visibility rules meant enterprise/ couldn't implement core's SQLRunner interface without importing the package that defines it. That required moving api/internal/{authz,queryapi,dashboards, querylang/executor,searchclient,httpserver} out of internal/ -- the minimal set enterprise-api needs to import; querylang's compiler internals (planner/lexer/parser/ast/ir) and api's own config stay internal, since nothing outside api needs them directly. Also finally wires enterprise/internal/audit into queryapi.AuditLogger (nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse integration tests for two of the four adversarial probes named in docs/phase-4-isolation-design.md's verification plan. Corrected several overclaims in the docs while writing this up: an earlier claim that rbacstore's CRUD was "verified against a live Postgres" was never actually true in this environment (only internal/audit was, earlier in this phase, before Docker access was lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and enterprise/README.md all now distinguish "a real integration test exists" from "this was confirmed against a live database." Still not built: Tantivy/free-text tenant isolation (enterprise/internal/searchclient), and any deployment-topology mechanism that actually routes traffic to enterprise-api instead of plain api -- both binaries exist side by side today with nothing enforcing or flagging which one a deployment runs.
2026-08-13 22:48:38 -07:00
parent 3eb0f4c589
commit 1d57e697b1
49 changed files with 2003 additions and 237 deletions
@@ -14,10 +14,11 @@
 // that handler itself isn't built yet (see cmd/enterprise-auth/main.go's
 // doc comment), so today rbacstore's only production caller is
 // -mint-service-token's future tenant-aware successor and its own tests.
-// dashboard_permissions and data_sources (also part of the schema) don't
-// have CRUD here yet -- no caller needs them until dashboards' handler
-// wiring reads per-resource grants, named as deferred in task 5's
-// summary.
+// dashboard_permissions doesn't have CRUD here yet -- no caller reads
+// per-resource grants (see api/dashboards/handler.go's doc
+// comment). data_sources CRUD was added once enterprise/internal/
+// chrunner needed a real place to read per-tenant ClickHouse credentials
+// from at startup (see that package's doc comment).
 package rbacstore

 import (
@@ -44,17 +45,17 @@ type User struct {
 }

 type Tenant struct {
-	ID              string
-	DisplayName     string
-	Status          string
-	OwnerUserID     string // empty until a first Owner is assigned
-	CreatedAt       time.Time
-	UpdatedAt       time.Time
+	ID          string
+	DisplayName string
+	Status      string
+	OwnerUserID string // empty until a first Owner is assigned
+	CreatedAt   time.Time
+	UpdatedAt   time.Time
 }

-// Role mirrors api/internal/authz.Role's string values, kept as a plain
+// Role mirrors api/authz.Role's string values, kept as a plain
 // string here rather than importing authz -- rbacstore is enterprise
-// code and api/internal/authz is core; enterprise may depend on
+// code and api/authz is core; enterprise may depend on
 // nothing-shaped-like-an-import-from-core per the module boundary
 // (see /docs/phase-4-isolation-design.md), even though the reverse
 // (core importing enterprise) is the one hack/check-tenant-boundary.sh
@@ -252,3 +253,114 @@ func (s *Store) ListMembershipsForUser(ctx context.Context, userID string) ([]Me
 	}
 	return out, rows.Err()
 }
+
+// DataSource is one tenant's data-plane location -- today, exactly one
+// ClickHouse database + one Tantivy index per tenant (see
+// /docs/phase-4-rbac-design.md's "data_sources" extension-point
+// section). ClickHouseUsername/Password are nil until
+// enterprise/internal/tenantprovision actually provisions the
+// ClickHouse-side user/database and calls SetDataSourceClickHouseCredentials.
+type DataSource struct {
+	ID                     string
+	TenantID               string
+	Name                   string
+	ClickHouseDatabaseName string
+	TantivyIndexPath       string
+	ClickHouseUsername     *string
+	ClickHousePassword     *string
+}
+
+// CreateDataSource inserts the row tenantprovision will later attach
+// credentials to (SetDataSourceClickHouseCredentials) -- split into two
+// steps because the row (database name, index path) is decided before
+// provisioning runs, but the ClickHouse-side username/password only
+// exist after CREATE USER actually succeeds.
+func (s *Store) CreateDataSource(ctx context.Context, tenantID, name, clickHouseDatabaseName, tantivyIndexPath string) (*DataSource, error) {
+	ds := DataSource{
+		ID: uuid.NewString(), TenantID: tenantID, Name: name,
+		ClickHouseDatabaseName: clickHouseDatabaseName, TantivyIndexPath: tantivyIndexPath,
+	}
+	_, err := s.pool.Exec(ctx, `
+		INSERT INTO data_sources (id, tenant_id, name, clickhouse_database_name, tantivy_index_path)
+		VALUES ($1, $2, $3, $4, $5)`,
+		ds.ID, ds.TenantID, ds.Name, ds.ClickHouseDatabaseName, ds.TantivyIndexPath)
+	if err != nil {
+		return nil, fmt.Errorf("rbacstore: creating data source: %w", err)
+	}
+	return &ds, nil
+}
+
+// SetDataSourceClickHouseCredentials is the only way
+// clickhouse_username/password change -- called once, right after
+// enterprise/internal/tenantprovision.ProvisionClickHouse succeeds.
+// Never called again for the same data source: rotating a live tenant's
+// credential without first updating it on the ClickHouse side would
+// just break every open connection, same reasoning as
+// deploy/operator/internal/controller/tenant_controller.go's
+// reconcileSecret.
+func (s *Store) SetDataSourceClickHouseCredentials(ctx context.Context, id, username, password string) error {
+	tag, err := s.pool.Exec(ctx,
+		`UPDATE data_sources SET clickhouse_username = $2, clickhouse_password = $3 WHERE id = $1`,
+		id, username, password)
+	if err != nil {
+		return fmt.Errorf("rbacstore: setting data source credentials: %w", err)
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func scanDataSource(row pgx.Row) (*DataSource, error) {
+	var ds DataSource
+	if err := row.Scan(&ds.ID, &ds.TenantID, &ds.Name, &ds.ClickHouseDatabaseName, &ds.TantivyIndexPath,
+		&ds.ClickHouseUsername, &ds.ClickHousePassword); err != nil {
+		return nil, err
+	}
+	return &ds, nil
+}
+
+func (s *Store) GetDataSourceForTenant(ctx context.Context, tenantID string) (*DataSource, error) {
+	row := s.pool.QueryRow(ctx, `
+		SELECT id, tenant_id, name, clickhouse_database_name, tantivy_index_path, clickhouse_username, clickhouse_password
+		FROM data_sources WHERE tenant_id = $1 ORDER BY created_at LIMIT 1`, tenantID)
+	ds, err := scanDataSource(row)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, fmt.Errorf("rbacstore: getting data source: %w", err)
+	}
+	return ds, nil
+}
+
+// ListProvisionedDataSources returns every data source for an active
+// tenant that has already been provisioned (ClickHouse credentials set)
+// -- exactly the set enterprise/internal/chrunner.NewRegistry needs at
+// startup. A data source with no credentials yet (tenantprovision hasn't
+// run for it) is deliberately excluded rather than returned with empty
+// credentials -- chrunner has nothing safe to connect with for it, and
+// silently including it would turn into a confusing empty-string
+// connection attempt instead of a clear "not provisioned yet" absence.
+func (s *Store) ListProvisionedDataSources(ctx context.Context) ([]DataSource, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT ds.id, ds.tenant_id, ds.name, ds.clickhouse_database_name, ds.tantivy_index_path,
+		       ds.clickhouse_username, ds.clickhouse_password
+		FROM data_sources ds
+		JOIN tenants t ON t.id = ds.tenant_id
+		WHERE t.status = 'active' AND ds.clickhouse_username IS NOT NULL AND ds.clickhouse_password IS NOT NULL`)
+	if err != nil {
+		return nil, fmt.Errorf("rbacstore: listing provisioned data sources: %w", err)
+	}
+	defer rows.Close()
+
+	var out []DataSource
+	for rows.Next() {
+		ds, err := scanDataSource(rows)
+		if err != nil {
+			return nil, fmt.Errorf("rbacstore: scanning data source: %w", err)
+		}
+		out = append(out, *ds)
+	}
+	return out, rows.Err()
+}
@@ -225,3 +225,124 @@ func TestListMembershipsForUserAcrossTenants(t *testing.T) {
 		t.Fatalf("got %d memberships, want 2: %+v", len(memberships), memberships)
 	}
 }
+
+func TestCreateDataSourceThenSetCredentials(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	tenantID := "test-tenant-" + uniqueSuffix()
+	if _, err := s.CreateTenant(ctx, tenantID, "Test Tenant"); err != nil {
+		t.Fatalf("CreateTenant: %v", err)
+	}
+
+	ds, err := s.CreateDataSource(ctx, tenantID, "default", tenantID, "/var/lib/sentry-search/tenants/"+tenantID)
+	if err != nil {
+		t.Fatalf("CreateDataSource: %v", err)
+	}
+	if ds.ClickHouseUsername != nil || ds.ClickHousePassword != nil {
+		t.Fatalf("new data source must have no credentials yet, got %+v", ds)
+	}
+
+	got, err := s.GetDataSourceForTenant(ctx, tenantID)
+	if err != nil {
+		t.Fatalf("GetDataSourceForTenant: %v", err)
+	}
+	if got.ID != ds.ID || got.ClickHouseUsername != nil {
+		t.Fatalf("unexpected data source: %+v", got)
+	}
+
+	if err := s.SetDataSourceClickHouseCredentials(ctx, ds.ID, "tenant_"+tenantID, "secret-password"); err != nil {
+		t.Fatalf("SetDataSourceClickHouseCredentials: %v", err)
+	}
+	got, err = s.GetDataSourceForTenant(ctx, tenantID)
+	if err != nil {
+		t.Fatalf("GetDataSourceForTenant after credentials set: %v", err)
+	}
+	if got.ClickHouseUsername == nil || *got.ClickHouseUsername != "tenant_"+tenantID {
+		t.Fatalf("ClickHouseUsername = %v, want tenant_%s", got.ClickHouseUsername, tenantID)
+	}
+	if got.ClickHousePassword == nil || *got.ClickHousePassword != "secret-password" {
+		t.Fatalf("ClickHousePassword = %v, want secret-password", got.ClickHousePassword)
+	}
+}
+
+func TestSetDataSourceClickHouseCredentialsNotFound(t *testing.T) {
+	s := testStore(t)
+	if err := s.SetDataSourceClickHouseCredentials(context.Background(), "does-not-exist-"+uniqueSuffix(), "u", "p"); err != ErrNotFound {
+		t.Fatalf("SetDataSourceClickHouseCredentials error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestGetDataSourceForTenantNotFound(t *testing.T) {
+	s := testStore(t)
+	if _, err := s.GetDataSourceForTenant(context.Background(), "does-not-exist-"+uniqueSuffix()); err != ErrNotFound {
+		t.Fatalf("GetDataSourceForTenant error = %v, want ErrNotFound", err)
+	}
+}
+
+// TestListProvisionedDataSourcesExcludesUnprovisionedAndInactive proves
+// the two filters ListProvisionedDataSources documents: a data source
+// with no ClickHouse credentials yet is excluded (nothing safe to
+// connect with), and a data source belonging to a non-active tenant is
+// excluded too (a suspended/provisioning tenant must not show up in
+// chrunner's connection registry).
+func TestListProvisionedDataSourcesExcludesUnprovisionedAndInactive(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+
+	activeProvisioned := "test-tenant-" + uniqueSuffix()
+	activeUnprovisioned := "test-tenant-" + uniqueSuffix()
+	suspended := "test-tenant-" + uniqueSuffix()
+
+	for _, id := range []string{activeProvisioned, activeUnprovisioned, suspended} {
+		if _, err := s.CreateTenant(ctx, id, id); err != nil {
+			t.Fatalf("CreateTenant %s: %v", id, err)
+		}
+	}
+	if err := s.SetTenantStatus(ctx, activeProvisioned, "active"); err != nil {
+		t.Fatalf("SetTenantStatus activeProvisioned: %v", err)
+	}
+	if err := s.SetTenantStatus(ctx, activeUnprovisioned, "active"); err != nil {
+		t.Fatalf("SetTenantStatus activeUnprovisioned: %v", err)
+	}
+	// suspended stays in 'provisioning' (CreateTenant's default) -- not active.
+
+	dsProvisioned, err := s.CreateDataSource(ctx, activeProvisioned, "default", activeProvisioned, "/idx")
+	if err != nil {
+		t.Fatalf("CreateDataSource activeProvisioned: %v", err)
+	}
+	if err := s.SetDataSourceClickHouseCredentials(ctx, dsProvisioned.ID, "u", "p"); err != nil {
+		t.Fatalf("SetDataSourceClickHouseCredentials: %v", err)
+	}
+
+	if _, err := s.CreateDataSource(ctx, activeUnprovisioned, "default", activeUnprovisioned, "/idx"); err != nil {
+		t.Fatalf("CreateDataSource activeUnprovisioned: %v", err)
+	}
+
+	dsSuspended, err := s.CreateDataSource(ctx, suspended, "default", suspended, "/idx")
+	if err != nil {
+		t.Fatalf("CreateDataSource suspended: %v", err)
+	}
+	if err := s.SetDataSourceClickHouseCredentials(ctx, dsSuspended.ID, "u", "p"); err != nil {
+		t.Fatalf("SetDataSourceClickHouseCredentials suspended: %v", err)
+	}
+
+	list, err := s.ListProvisionedDataSources(ctx)
+	if err != nil {
+		t.Fatalf("ListProvisionedDataSources: %v", err)
+	}
+	foundOurs := false
+	for _, ds := range list {
+		if ds.TenantID == activeUnprovisioned {
+			t.Fatalf("unprovisioned data source leaked into the list: %+v", ds)
+		}
+		if ds.TenantID == suspended {
+			t.Fatalf("non-active tenant's data source leaked into the list: %+v", ds)
+		}
+		if ds.TenantID == activeProvisioned {
+			foundOurs = true
+		}
+	}
+	if !foundOurs {
+		t.Fatal("expected the active, provisioned data source to be in the list")
+	}
+}