Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
2026-08-13 22:16:59 -07:00
parent 9435115ab7
commit 3eb0f4c589
116 changed files with 8589 additions and 126 deletions
@@ -0,0 +1,96 @@
+package authz
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+type fakeAuthorizer struct {
+	identity Identity
+	err      error
+}
+
+func (f *fakeAuthorizer) Authorize(_ *http.Request) (Identity, error) {
+	return f.identity, f.err
+}
+
+func okHandler(w http.ResponseWriter, r *http.Request) {
+	id, ok := IdentityFromContext(r.Context())
+	if ok {
+		w.Header().Set("X-Test-Tenant", id.TenantID)
+	}
+	w.WriteHeader(http.StatusOK)
+}
+
+func TestRequireRoleNilAuthorizerIsNoOp(t *testing.T) {
+	h := RequireRole(nil, RoleAdmin, okHandler)
+	rec := httptest.NewRecorder()
+	h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 (nil authorizer must be a no-op, matching single-tenant Phase 0-3 behavior)", rec.Code)
+	}
+}
+
+func TestRequireRoleRejectsUnauthenticated(t *testing.T) {
+	h := RequireRole(&fakeAuthorizer{err: errors.New("no session")}, RoleViewer, okHandler)
+	rec := httptest.NewRecorder()
+	h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rec.Code)
+	}
+}
+
+func TestRequireRoleRejectsInsufficientRole(t *testing.T) {
+	h := RequireRole(&fakeAuthorizer{identity: Identity{Role: RoleViewer}}, RoleAdmin, okHandler)
+	rec := httptest.NewRecorder()
+	h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rec.Code)
+	}
+}
+
+func TestRequireRoleAllowsSufficientRoleAndAttachesIdentity(t *testing.T) {
+	h := RequireRole(&fakeAuthorizer{identity: Identity{TenantID: "acme", Role: RoleAdmin}}, RoleEditor, okHandler)
+	rec := httptest.NewRecorder()
+	h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if got := rec.Header().Get("X-Test-Tenant"); got != "acme" {
+		t.Fatalf("expected the resolved identity to be attached to the request context, got tenant=%q", got)
+	}
+}
+
+func TestRequireRoleOrServiceAllowsServiceIdentity(t *testing.T) {
+	h := RequireRoleOrService(&fakeAuthorizer{identity: Identity{Role: RoleService}}, RoleAdmin, okHandler)
+	rec := httptest.NewRecorder()
+	h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 -- RoleService must satisfy RequireRoleOrService regardless of minRole", rec.Code)
+	}
+}
+
+func TestRequireRoleOrServiceStillRejectsInsufficientHumanRole(t *testing.T) {
+	h := RequireRoleOrService(&fakeAuthorizer{identity: Identity{Role: RoleViewer}}, RoleAdmin, okHandler)
+	rec := httptest.NewRecorder()
+	h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403 -- allowing RoleService must not loosen the human-role check", rec.Code)
+	}
+}
+
+// TestRequireRolePlainDoesNotAllowService pins down the narrow-by-default
+// property middleware.go's doc comment claims: an endpoint using plain
+// RequireRole (not RequireRoleOrService) must reject a RoleService
+// identity even if the minRole would technically be satisfiable on the
+// human scale -- RoleService never satisfies anything but itself.
+func TestRequireRolePlainDoesNotAllowService(t *testing.T) {
+	h := RequireRole(&fakeAuthorizer{identity: Identity{Role: RoleService}}, RoleViewer, okHandler)
+	rec := httptest.NewRecorder()
+	h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403 -- plain RequireRole must never admit a service identity", rec.Code)
+	}
+}