Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a
new enterprise/ module (session issuance, audit logging, RBAC storage,
OIDC/SAML protocol wiring) that core never imports -- only calls over
HTTP. Found and fixed a real cross-tenant vulnerability in dashboards
(no tenant_id filtering at all) while writing the threat model doc.

Two things are explicitly NOT done, documented rather than hidden:
tenant isolation for log data itself (/query still shares one ClickHouse
connection and Tantivy index across every tenant -- RBAC controls who
can query, not what a query can see), and human SSO login (protocol
wiring exists, no HTTP handler calls it yet). See
docs/security/threat-model.md and docs/phase-4-runbook.md.

Also adds deploy/ (Go Operator + Helm chart, validated offline only --
no cluster was reachable in this environment).

alerting/cmd/alerting/main.go

@@ -66,7 +66,7 @@ func main() {
 
 	rules := rulestore.NewStore(pgPool)
 	targets := notifystore.NewStore(pgPool)
-	qc := queryclient.New(cfg.APIQueryURL)
+	qc := queryclient.New(cfg.APIQueryURL, cfg.APIServiceToken)
 
 	handler := httpapi.NewHandler(logger, rules, targets, rules)
 	mux := http.NewServeMux()

alerting/internal/config/config.go

@@ -13,6 +13,7 @@ type Config struct {
 	HTTPListenAddr    string
 	Postgres          PostgresConfig
 	APIQueryURL       string // base URL of /api, e.g. http://api:8080 -- alerting never talks to ClickHouse/Tantivy directly
+	APIServiceToken   string // RoleService credential presented to /api's POST /query -- see queryclient.New's doc comment
 	CORSAllowedOrigin string
 	Evaluator         EvaluatorConfig
 }
@@ -52,6 +53,10 @@ func Load() (Config, error) {
 			Password: getenv("POSTGRES_PASSWORD", ""),
 		},
 		APIQueryURL: getenv("API_QUERY_URL", "http://localhost:8080"),
+		// Empty by default -- matches Phase 0-3 behavior for a
+		// single-tenant deployment with no enterprise/ deployed (api's
+		// authorizer is nil there, so an absent token is fine).
+		APIServiceToken: getenv("API_SERVICE_TOKEN", ""),
 		// Same "no auth yet" tradeoff as api's CORSAllowedOrigin default --
 		// see api/internal/config/config.go's comment, same reasoning here.
 		CORSAllowedOrigin: getenv("CORS_ALLOWED_ORIGIN", "*"),

alerting/internal/queryclient/client.go

@@ -23,12 +23,20 @@ type errorResponse struct {
 }
 
 type Client struct {
-	baseURL string
-	http    *http.Client
+	baseURL      string
+	serviceToken string
+	http         *http.Client
 }
 
-func New(baseURL string) *Client {
-	return &Client{baseURL: baseURL, http: &http.Client{}}
+// New builds a client for /api's POST /query. serviceToken, if non-empty,
+// is sent as a Bearer credential on every request -- api's authz
+// middleware resolves it (via enterprise-auth) to the RoleService
+// identity described in /docs/phase-4-isolation-design.md's alerting↔api
+// gap. An empty serviceToken matches Phase 0-3 behavior (no
+// enterprise/ deployed, api's authorizer is nil, every request is
+// allowed).
+func New(baseURL, serviceToken string) *Client {
+	return &Client{baseURL: baseURL, serviceToken: serviceToken, http: &http.Client{}}
 }
 
 // Query runs query (already time-range-injected by the caller, if
@@ -51,6 +59,9 @@ func (c *Client) Query(ctx context.Context, query, language string, timeout time
 		return nil, fmt.Errorf("building query request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
+	if c.serviceToken != "" {
+		req.Header.Set("Authorization", "Bearer "+c.serviceToken)
+	}
 
 	resp, err := c.http.Do(req)
 	if err != nil {

alerting/internal/queryclient/client_test.go

@@ -0,0 +1,46 @@
+package queryclient
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestQuerySendsBearerServiceToken(t *testing.T) {
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"columns":[],"rows":[]}`))
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "service-token-xyz")
+	if _, err := c.Query(t.Context(), "stats count", "spl", time.Second); err != nil {
+		t.Fatalf("Query: %v", err)
+	}
+	if gotAuth != "Bearer service-token-xyz" {
+		t.Fatalf("Authorization header = %q, want Bearer service-token-xyz", gotAuth)
+	}
+}
+
+func TestQueryOmitsAuthorizationWhenNoTokenConfigured(t *testing.T) {
+	var gotAuth string
+	sawHeader := false
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		sawHeader = r.Header.Get("Authorization") != ""
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"columns":[],"rows":[]}`))
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "")
+	if _, err := c.Query(t.Context(), "stats count", "spl", time.Second); err != nil {
+		t.Fatalf("Query: %v", err)
+	}
+	if sawHeader {
+		t.Fatalf("expected no Authorization header when no service token is configured, got %q", gotAuth)
+	}
+}