Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
2026-08-13 22:16:59 -07:00
parent 9435115ab7
commit 3eb0f4c589
116 changed files with 8589 additions and 126 deletions
@@ -10,8 +10,15 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"github.com/sentry/sentry/api/internal/authz"
 )

+// fakeStore enforces tenant scoping the same way store.go's real
+// pgx-backed Store does (a mismatched tenantID behaves exactly like a
+// missing ID -- ErrNotFound, never a distinguishable "found but wrong
+// tenant" error) so handler_test.go's cross-tenant tests exercise real
+// behavior, not a fake that happens to always agree.
 type fakeStore struct {
 	dashboards map[string]*Dashboard
 	createErr  error
@@ -31,44 +38,48 @@ func (f *fakeStore) CreateDashboard(_ context.Context, d *Dashboard) error {
 	return nil
 }

-func (f *fakeStore) ListDashboards(_ context.Context) ([]Dashboard, error) {
+func (f *fakeStore) ListDashboards(_ context.Context, tenantID string) ([]Dashboard, error) {
 	var out []Dashboard
 	for _, d := range f.dashboards {
-		out = append(out, *d)
+		if d.TenantID == tenantID {
+			out = append(out, *d)
+		}
 	}
 	return out, nil
 }

-func (f *fakeStore) GetDashboard(_ context.Context, id string) (*Dashboard, error) {
+func (f *fakeStore) GetDashboard(_ context.Context, tenantID, id string) (*Dashboard, error) {
 	d, ok := f.dashboards[id]
-	if !ok {
+	if !ok || d.TenantID != tenantID {
 		return nil, ErrNotFound
 	}
 	return d, nil
 }

-func (f *fakeStore) UpdateDashboard(_ context.Context, d *Dashboard) error {
+func (f *fakeStore) UpdateDashboard(_ context.Context, tenantID string, d *Dashboard) error {
 	existing, ok := f.dashboards[d.ID]
-	if !ok {
+	if !ok || existing.TenantID != tenantID {
 		return ErrNotFound
 	}
 	panels := existing.Panels
 	*existing = *d
+	existing.TenantID = tenantID
 	existing.Panels = panels
 	return nil
 }

-func (f *fakeStore) DeleteDashboard(_ context.Context, id string) error {
-	if _, ok := f.dashboards[id]; !ok {
+func (f *fakeStore) DeleteDashboard(_ context.Context, tenantID, id string) error {
+	d, ok := f.dashboards[id]
+	if !ok || d.TenantID != tenantID {
 		return ErrNotFound
 	}
 	delete(f.dashboards, id)
 	return nil
 }

-func (f *fakeStore) AddPanel(_ context.Context, dashboardID string, p *Panel) error {
+func (f *fakeStore) AddPanel(_ context.Context, tenantID, dashboardID string, p *Panel) error {
 	d, ok := f.dashboards[dashboardID]
-	if !ok {
+	if !ok || d.TenantID != tenantID {
 		return ErrNotFound
 	}
 	p.ID = "panel-1"
@@ -77,9 +88,9 @@ func (f *fakeStore) AddPanel(_ context.Context, dashboardID string, p *Panel) er
 	return nil
 }

-func (f *fakeStore) UpdatePanel(_ context.Context, p *Panel) error {
+func (f *fakeStore) UpdatePanel(_ context.Context, tenantID string, p *Panel) error {
 	d, ok := f.dashboards[p.DashboardID]
-	if !ok {
+	if !ok || d.TenantID != tenantID {
 		return ErrNotFound
 	}
 	for i := range d.Panels {
@@ -91,9 +102,9 @@ func (f *fakeStore) UpdatePanel(_ context.Context, p *Panel) error {
 	return ErrNotFound
 }

-func (f *fakeStore) DeletePanel(_ context.Context, dashboardID, panelID string) error {
+func (f *fakeStore) DeletePanel(_ context.Context, tenantID, dashboardID, panelID string) error {
 	d, ok := f.dashboards[dashboardID]
-	if !ok {
+	if !ok || d.TenantID != tenantID {
 		return ErrNotFound
 	}
 	for i := range d.Panels {
@@ -105,18 +116,39 @@ func (f *fakeStore) DeletePanel(_ context.Context, dashboardID, panelID string)
 	return ErrNotFound
 }

-func (f *fakeStore) ImportDashboard(_ context.Context, d *Dashboard) (*Dashboard, error) {
+func (f *fakeStore) ImportDashboard(_ context.Context, tenantID string, d *Dashboard) (*Dashboard, error) {
 	if f.importErr != nil {
 		return nil, f.importErr
 	}
 	imported := *d
 	imported.ID = "dash-imported"
+	imported.TenantID = tenantID
 	f.dashboards[imported.ID] = &imported
 	return &imported, nil
 }

 func newTestMux(fs *fakeStore) *http.ServeMux {
-	h := NewHandler(slog.New(slog.NewTextHandler(io.Discard, nil)), fs)
+	h := NewHandler(slog.New(slog.NewTextHandler(io.Discard, nil)), fs, nil)
+	mux := http.NewServeMux()
+	h.RegisterRoutes(mux)
+	return mux
+}
+
+// fakeAuthorizer resolves every request to a fixed identity -- used by
+// the cross-tenant tests below, which need a real (non-nil) authorizer
+// so tenantID(r) reads from the resolved identity instead of falling
+// back to "default" for every request.
+type fakeAuthorizer struct {
+	identity authz.Identity
+}
+
+func (f *fakeAuthorizer) Authorize(*http.Request) (authz.Identity, error) {
+	return f.identity, nil
+}
+
+func newTestMuxWithTenant(fs *fakeStore, tenantID string) *http.ServeMux {
+	h := NewHandler(slog.New(slog.NewTextHandler(io.Discard, nil)), fs,
+		&fakeAuthorizer{identity: authz.Identity{TenantID: tenantID, Role: authz.RoleOwner}})
 	mux := http.NewServeMux()
 	h.RegisterRoutes(mux)
 	return mux
@@ -149,6 +181,25 @@ func TestCreateDashboard(t *testing.T) {
 	}
 }

+// TestCreateDashboardIgnoresClientSuppliedTenantID is the regression
+// test for the tenant-spoofing gap found during Phase 4 task 7 (see
+// /docs/security/threat-model.md's "application-layer tenant scoping"
+// section): Dashboard.TenantID has a `json:"tenant_id"` tag, so a
+// request body can set it to anything. The handler must always
+// overwrite it from the authenticated identity, never trust the body.
+func TestCreateDashboardIgnoresClientSuppliedTenantID(t *testing.T) {
+	fs := newFakeStore()
+	mux := newTestMuxWithTenant(fs, "acme")
+
+	rec := doRequest(t, mux, http.MethodPost, "/dashboards", `{"name": "Overview", "tenant_id": "globex"}`)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201; body=%s", rec.Code, rec.Body.String())
+	}
+	if fs.dashboards["dash-1"].TenantID != "acme" {
+		t.Fatalf("stored TenantID = %q, want %q (the authenticated identity's tenant, not the client-supplied value)", fs.dashboards["dash-1"].TenantID, "acme")
+	}
+}
+
 func TestCreateDashboardRejectsEmptyName(t *testing.T) {
 	mux := newTestMux(newFakeStore())
 	rec := doRequest(t, mux, http.MethodPost, "/dashboards", `{"name": ""}`)
@@ -165,9 +216,87 @@ func TestGetDashboardNotFound(t *testing.T) {
 	}
 }

+// TestCrossTenantGetIsNotFound is the core adversarial case: a request
+// authenticated as tenant "globex" must not be able to read a dashboard
+// that belongs to tenant "acme" -- and the response must be a plain 404
+// (not a 403, which would confirm the ID exists under a different
+// tenant).
+func TestCrossTenantGetIsNotFound(t *testing.T) {
+	fs := newFakeStore()
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "acme", Name: "Acme's dashboard"}
+	mux := newTestMuxWithTenant(fs, "globex")
+
+	rec := doRequest(t, mux, http.MethodGet, "/dashboards/dash-1", "")
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404 (cross-tenant read must not succeed or leak existence via a different status)", rec.Code)
+	}
+}
+
+func TestCrossTenantListDoesNotLeakOtherTenants(t *testing.T) {
+	fs := newFakeStore()
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "acme", Name: "Acme's dashboard"}
+	fs.dashboards["dash-2"] = &Dashboard{ID: "dash-2", TenantID: "globex", Name: "Globex's dashboard"}
+	mux := newTestMuxWithTenant(fs, "globex")
+
+	rec := doRequest(t, mux, http.MethodGet, "/dashboards", "")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	var got []Dashboard
+	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decoding response: %v", err)
+	}
+	if len(got) != 1 || got[0].ID != "dash-2" {
+		t.Fatalf("expected only globex's own dashboard, got %+v", got)
+	}
+}
+
+func TestCrossTenantUpdateIsNotFound(t *testing.T) {
+	fs := newFakeStore()
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "acme", Name: "Acme's dashboard"}
+	mux := newTestMuxWithTenant(fs, "globex")
+
+	rec := doRequest(t, mux, http.MethodPut, "/dashboards/dash-1", `{"name": "Hijacked"}`)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404", rec.Code)
+	}
+	if fs.dashboards["dash-1"].Name != "Acme's dashboard" {
+		t.Fatalf("cross-tenant update must not modify the row, got Name = %q", fs.dashboards["dash-1"].Name)
+	}
+}
+
+func TestCrossTenantDeleteIsNotFound(t *testing.T) {
+	fs := newFakeStore()
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "acme", Name: "Acme's dashboard"}
+	mux := newTestMuxWithTenant(fs, "globex")
+
+	rec := doRequest(t, mux, http.MethodDelete, "/dashboards/dash-1", "")
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404", rec.Code)
+	}
+	if _, ok := fs.dashboards["dash-1"]; !ok {
+		t.Fatalf("cross-tenant delete must not remove the row")
+	}
+}
+
+func TestCrossTenantAddPanelIsNotFound(t *testing.T) {
+	fs := newFakeStore()
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "acme", Name: "Acme's dashboard"}
+	mux := newTestMuxWithTenant(fs, "globex")
+
+	rec := doRequest(t, mux, http.MethodPost, "/dashboards/dash-1/panels",
+		`{"query": "service=api", "viz_type": "table"}`)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404; body=%s", rec.Code, rec.Body.String())
+	}
+	if len(fs.dashboards["dash-1"].Panels) != 0 {
+		t.Fatalf("cross-tenant AddPanel must not attach a panel to the other tenant's dashboard")
+	}
+}
+
 func TestAddPanelRejectsRawSQL(t *testing.T) {
 	fs := newFakeStore()
-	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", Name: "Overview"}
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "default", Name: "Overview"}
 	mux := newTestMux(fs)

 	rec := doRequest(t, mux, http.MethodPost, "/dashboards/dash-1/panels",
@@ -179,7 +308,7 @@ func TestAddPanelRejectsRawSQL(t *testing.T) {

 func TestAddPanelRejectsInvalidVizType(t *testing.T) {
 	fs := newFakeStore()
-	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", Name: "Overview"}
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "default", Name: "Overview"}
 	mux := newTestMux(fs)

 	rec := doRequest(t, mux, http.MethodPost, "/dashboards/dash-1/panels",
@@ -191,7 +320,7 @@ func TestAddPanelRejectsInvalidVizType(t *testing.T) {

 func TestAddPanelSuccess(t *testing.T) {
 	fs := newFakeStore()
-	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", Name: "Overview"}
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "default", Name: "Overview"}
 	mux := newTestMux(fs)

 	rec := doRequest(t, mux, http.MethodPost, "/dashboards/dash-1/panels",
@@ -206,7 +335,7 @@ func TestAddPanelSuccess(t *testing.T) {

 func TestUpdateDashboardChangesTimeRange(t *testing.T) {
 	fs := newFakeStore()
-	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", Name: "Overview", DefaultEarliest: "-1h", DefaultLatest: "now"}
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "default", Name: "Overview", DefaultEarliest: "-1h", DefaultLatest: "now"}
 	mux := newTestMux(fs)

 	rec := doRequest(t, mux, http.MethodPut, "/dashboards/dash-1",
@@ -229,7 +358,7 @@ func TestUpdateDashboardNotFound(t *testing.T) {

 func TestDeleteDashboard(t *testing.T) {
 	fs := newFakeStore()
-	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", Name: "Overview"}
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "default", Name: "Overview"}
 	mux := newTestMux(fs)

 	rec := doRequest(t, mux, http.MethodDelete, "/dashboards/dash-1", "")
@@ -244,7 +373,7 @@ func TestDeleteDashboard(t *testing.T) {
 func TestExportThenImportRoundTrips(t *testing.T) {
 	fs := newFakeStore()
 	fs.dashboards["dash-1"] = &Dashboard{
-		ID: "dash-1", Name: "Overview",
+		ID: "dash-1", TenantID: "default", Name: "Overview",
 		Panels: []Panel{{ID: "panel-1", DashboardID: "dash-1", Query: "service=api", VizType: VizTable}},
 	}
 	mux := newTestMux(fs)
@@ -267,6 +396,28 @@ func TestExportThenImportRoundTrips(t *testing.T) {
 	}
 }

+// TestImportIgnoresExportedTenantID: an exported dashboard JSON file
+// carries whatever tenant_id it was exported from -- importing it into
+// a different tenant's session must assign it to the *importing*
+// tenant, never silently move it to the tenant named in the file.
+func TestImportIgnoresExportedTenantID(t *testing.T) {
+	fs := newFakeStore()
+	mux := newTestMuxWithTenant(fs, "globex")
+
+	rec := doRequest(t, mux, http.MethodPost, "/dashboards/import",
+		`{"name": "Imported", "tenant_id": "acme"}`)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201; body=%s", rec.Code, rec.Body.String())
+	}
+	var imported Dashboard
+	if err := json.Unmarshal(rec.Body.Bytes(), &imported); err != nil {
+		t.Fatalf("decoding response: %v", err)
+	}
+	if imported.TenantID != "globex" {
+		t.Fatalf("imported TenantID = %q, want %q (the importing identity's tenant)", imported.TenantID, "globex")
+	}
+}
+
 func TestCreateDashboardStoreErrorReturns500(t *testing.T) {
 	fs := newFakeStore()
 	fs.createErr = errors.New("boom")
@@ -277,3 +428,37 @@ func TestCreateDashboardStoreErrorReturns500(t *testing.T) {
 		t.Fatalf("status = %d, want 500", rec.Code)
 	}
 }
+
+// TestServiceIdentityCannotAccessDashboards is the other half of the
+// service-identity boundary (the /query half is
+// api/internal/queryapi's own tests) -- api/internal/authz's own tests
+// already prove RequireRole rejects RoleService in isolation
+// (TestRequireRolePlainDoesNotAllowService); this proves it holds
+// through the real dashboards handler, wired the way it's actually
+// deployed, not just the middleware function in isolation. A defect
+// here would mean /alerting's service token -- meant only for POST
+// /query -- could also read/write dashboards, which was never the
+// intent (dashboards uses plain RequireRole, not RequireRoleOrService,
+// specifically to keep this door shut).
+func TestServiceIdentityCannotAccessDashboards(t *testing.T) {
+	fs := newFakeStore()
+	fs.dashboards["dash-1"] = &Dashboard{ID: "dash-1", TenantID: "default", Name: "Overview"}
+	h := NewHandler(slog.New(slog.NewTextHandler(io.Discard, nil)), fs,
+		&fakeAuthorizer{identity: authz.Identity{Role: authz.RoleService}})
+	mux := http.NewServeMux()
+	h.RegisterRoutes(mux)
+
+	for _, tt := range []struct {
+		method, path, body string
+	}{
+		{http.MethodGet, "/dashboards", ""},
+		{http.MethodGet, "/dashboards/dash-1", ""},
+		{http.MethodPost, "/dashboards", `{"name": "New"}`},
+		{http.MethodDelete, "/dashboards/dash-1", ""},
+	} {
+		rec := doRequest(t, mux, tt.method, tt.path, tt.body)
+		if rec.Code != http.StatusForbidden {
+			t.Errorf("%s %s: status = %d, want 403 (RoleService must never access dashboards)", tt.method, tt.path, rec.Code)
+		}
+	}
+}