Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
2026-08-13 22:16:59 -07:00
parent 9435115ab7
commit 3eb0f4c589
116 changed files with 8589 additions and 126 deletions
@@ -0,0 +1,123 @@
+package main
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+)
+
+func TestResolveTokenFromEnv(t *testing.T) {
+	env := func(k string) string {
+		if k == "SENTRYCTL_TOKEN" {
+			return "secret-token"
+		}
+		return ""
+	}
+	if got := resolveToken(env); got != "secret-token" {
+		t.Errorf("got %q, want %q", got, "secret-token")
+	}
+}
+
+func TestHTTPGetJSONForwardsBearerToken(t *testing.T) {
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.Write([]byte(`{"ok":true}`))
+	}))
+	defer srv.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := httpGetJSON(srv.URL, "/thing", "my-token", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit code = %d, stderr = %s", code, stderr.String())
+	}
+	if gotAuth != "Bearer my-token" {
+		t.Fatalf("Authorization header = %q, want %q", gotAuth, "Bearer my-token")
+	}
+}
+
+func TestHTTPGetJSONOmitsAuthorizationWhenNoToken(t *testing.T) {
+	sawHeader := false
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		sawHeader = r.Header.Get("Authorization") != ""
+		w.Write([]byte(`{"ok":true}`))
+	}))
+	defer srv.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := httpGetJSON(srv.URL, "/thing", "", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit code = %d, stderr = %s", code, stderr.String())
+	}
+	if sawHeader {
+		t.Fatalf("expected no Authorization header when no token is configured")
+	}
+}
+
+func TestHTTPPostFileJSONForwardsBearerToken(t *testing.T) {
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.Write([]byte(`{"ok":true}`))
+	}))
+	defer srv.Close()
+
+	f, err := os.CreateTemp(t.TempDir(), "payload-*.json")
+	if err != nil {
+		t.Fatalf("creating temp file: %v", err)
+	}
+	if _, err := f.WriteString(`{"name":"test"}`); err != nil {
+		t.Fatalf("writing temp file: %v", err)
+	}
+	f.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := httpPostFileJSON(srv.URL, "/thing", "my-token", f.Name(), &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit code = %d, stderr = %s", code, stderr.String())
+	}
+	if gotAuth != "Bearer my-token" {
+		t.Fatalf("Authorization header = %q, want %q", gotAuth, "Bearer my-token")
+	}
+}
+
+func TestCmdPingForwardsBearerToken(t *testing.T) {
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	t.Setenv("SENTRYCTL_TOKEN", "ping-token")
+	var stdout, stderr bytes.Buffer
+	code := cmdPing([]string{"--api", srv.URL}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit code = %d, stderr = %s", code, stderr.String())
+	}
+	if gotAuth != "Bearer ping-token" {
+		t.Fatalf("Authorization header = %q, want %q", gotAuth, "Bearer ping-token")
+	}
+}
+
+func TestCmdQueryForwardsBearerToken(t *testing.T) {
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"columns":[],"rows":[]}`))
+	}))
+	defer srv.Close()
+
+	t.Setenv("SENTRYCTL_TOKEN", "query-token")
+	var stdout, stderr bytes.Buffer
+	code := cmdQuery([]string{"--api", srv.URL, "service=api"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit code = %d, stderr = %s", code, stderr.String())
+	}
+	if gotAuth != "Bearer query-token" {
+		t.Fatalf("Authorization header = %q, want %q", gotAuth, "Bearer query-token")
+	}
+}