Phase 4: real Tantivy per-tenant isolation (search/src/registry.rs, enterprise/internal/searchclient)
Closes the last named "isolation mechanism" gap: search.proto gains a tenant_id field on SearchRequest; search/src/registry.rs's IndexRegistry resolves it to an on-demand-opened, per-tenant Tantivy index (empty tenant_id keeps today's single default index, so this is purely additive); enterprise/internal/searchclient sets that field from the authenticated request identity in ctx, mirroring chrunner's exact fail-closed "never a parameter" shape. Wired into enterprise-api in place of the shared api/searchclient. Unlike the ClickHouse pieces from the previous two commits, this one is genuinely verified end to end in this environment: Tantivy is an embedded library, not a networked service, so both the Rust index registry (cargo test, cargo clippy --all-targets -- -D warnings, both clean) and the Go client (a real in-process gRPC server) could actually run. registry.rs's tenant_index_is_isolated_from_default_and_other_tenants seeds three real indices with the same term and confirms a tenant-scoped search returns only that tenant's document -- item 3 of the isolation design doc's verification plan, closed for real, not just written. With both ClickHouse and Tantivy isolation now built, the single largest remaining gap is no longer a missing mechanism: it's that nothing forces or flags whether a deployment actually runs enterprise-api instead of plain api, and that ingest itself has no tenant concept for either storage engine (every record still lands in the one shared database/ index no matter what -- undesigned, not just unbuilt). Updated the threat model, architecture doc, CLAUDE.md, and both READMEs accordingly.
This commit is contained in:
@@ -0,0 +1,70 @@
|
||||
// Package searchclient is the tenant-scoped implementation of api's
|
||||
// querylang/executor.SearchClient interface -- the Tantivy-side sibling
|
||||
// of enterprise/internal/chrunner (see that package's doc comment for
|
||||
// the shared reasoning: implementing a core interface structurally
|
||||
// requires importing the package that defines it, which is why this
|
||||
// lives in enterprise/ and imports api/, the allowed direction).
|
||||
//
|
||||
// Unlike chrunner, there is no separate "one connection per tenant"
|
||||
// object here -- `search`'s gRPC service now holds the per-tenant
|
||||
// registry itself (search/src/registry.rs), keyed by the
|
||||
// SearchRequest.tenant_id field added in proto/sentry/search/v1/
|
||||
// search.proto. This package's only job is resolving that field from
|
||||
// the authenticated request identity before every call -- exactly the
|
||||
// same "read from ctx, never a parameter, fail closed if absent" shape
|
||||
// chrunner.Registry.RunSQL uses for ClickHouse.
|
||||
package searchclient
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"google.golang.org/grpc"
|
||||
"google.golang.org/grpc/credentials/insecure"
|
||||
|
||||
"github.com/sentry/sentry/api/authz"
|
||||
searchv1 "github.com/sentry/sentry/proto/sentry/search/v1"
|
||||
)
|
||||
|
||||
type Client struct {
|
||||
grpc searchv1.SearchServiceClient
|
||||
conn *grpc.ClientConn
|
||||
}
|
||||
|
||||
// Dial mirrors api/searchclient.Dial exactly (same plain-TCP, no-TLS
|
||||
// internal-service-to-service trust boundary) -- the only difference
|
||||
// from that package is what Search does with the resolved tenant.
|
||||
func Dial(addr string) (*Client, error) {
|
||||
conn, err := grpc.NewClient(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("dialing search service at %s: %w", addr, err)
|
||||
}
|
||||
return &Client{grpc: searchv1.NewSearchServiceClient(conn), conn: conn}, nil
|
||||
}
|
||||
|
||||
func (c *Client) Close() error {
|
||||
return c.conn.Close()
|
||||
}
|
||||
|
||||
// Search implements executor.SearchClient. Resolves the caller's tenant
|
||||
// from ctx (never a parameter) and fails closed -- no authenticated
|
||||
// identity, or an identity with no tenant (RoleService, or a
|
||||
// misconfigured authorizer), refuses the call rather than falling back
|
||||
// to the single default index, which would silently defeat the whole
|
||||
// point of this package existing. This mirrors chrunner.Registry.RunSQL's
|
||||
// exact fail-closed shape.
|
||||
func (c *Client) Search(ctx context.Context, query string, limit uint32) ([]string, error) {
|
||||
identity, ok := authz.IdentityFromContext(ctx)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("searchclient: no authenticated identity in context, refusing to search")
|
||||
}
|
||||
if identity.TenantID == "" {
|
||||
return nil, fmt.Errorf("searchclient: authenticated identity %q has no tenant, refusing to search", identity.Role)
|
||||
}
|
||||
|
||||
resp, err := c.grpc.Search(ctx, &searchv1.SearchRequest{Query: query, Limit: limit, TenantId: identity.TenantID})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return resp.GetRecordIds(), nil
|
||||
}
|
||||
@@ -0,0 +1,114 @@
|
||||
// Tests run a real gRPC server in-process (net.Listen on an ephemeral
|
||||
// port, a real grpc.Server) implementing SearchServiceServer, so these
|
||||
// exercise the actual wire protocol Client.Search sends, not a mocked
|
||||
// interface -- proving TenantId is set on the real SearchRequest that
|
||||
// would reach `search`, and that Client fails closed exactly the way
|
||||
// enterprise/internal/chrunner.Registry.RunSQL does for ClickHouse.
|
||||
package searchclient
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net"
|
||||
"testing"
|
||||
|
||||
"google.golang.org/grpc"
|
||||
|
||||
"github.com/sentry/sentry/api/authz"
|
||||
searchv1 "github.com/sentry/sentry/proto/sentry/search/v1"
|
||||
)
|
||||
|
||||
type fakeSearchServer struct {
|
||||
searchv1.UnimplementedSearchServiceServer
|
||||
lastRequest *searchv1.SearchRequest
|
||||
recordIDs []string
|
||||
}
|
||||
|
||||
func (f *fakeSearchServer) Search(_ context.Context, req *searchv1.SearchRequest) (*searchv1.SearchResponse, error) {
|
||||
f.lastRequest = req
|
||||
return &searchv1.SearchResponse{RecordIds: f.recordIDs}, nil
|
||||
}
|
||||
|
||||
func newTestServer(t *testing.T) (*Client, *fakeSearchServer) {
|
||||
t.Helper()
|
||||
lis, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listening: %v", err)
|
||||
}
|
||||
fake := &fakeSearchServer{recordIDs: []string{"id-1", "id-2"}}
|
||||
srv := grpc.NewServer()
|
||||
searchv1.RegisterSearchServiceServer(srv, fake)
|
||||
go func() { _ = srv.Serve(lis) }()
|
||||
t.Cleanup(srv.Stop)
|
||||
|
||||
client, err := Dial(lis.Addr().String())
|
||||
if err != nil {
|
||||
t.Fatalf("Dial: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { _ = client.Close() })
|
||||
return client, fake
|
||||
}
|
||||
|
||||
func TestSearchForwardsTenantIDFromContext(t *testing.T) {
|
||||
client, fake := newTestServer(t)
|
||||
ctx := authz.WithIdentity(context.Background(), authz.Identity{TenantID: "acme", Role: authz.RoleViewer})
|
||||
|
||||
ids, err := client.Search(ctx, "error", 10)
|
||||
if err != nil {
|
||||
t.Fatalf("Search: %v", err)
|
||||
}
|
||||
if len(ids) != 2 {
|
||||
t.Fatalf("got %d record ids, want 2", len(ids))
|
||||
}
|
||||
if fake.lastRequest.TenantId != "acme" {
|
||||
t.Fatalf("TenantId sent to search = %q, want acme", fake.lastRequest.TenantId)
|
||||
}
|
||||
if fake.lastRequest.Query != "error" || fake.lastRequest.Limit != 10 {
|
||||
t.Fatalf("unexpected request: %+v", fake.lastRequest)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchRefusesWithNoIdentity(t *testing.T) {
|
||||
client, fake := newTestServer(t)
|
||||
|
||||
if _, err := client.Search(context.Background(), "error", 10); err == nil {
|
||||
t.Fatal("expected Search to refuse a request with no authenticated identity in context")
|
||||
}
|
||||
if fake.lastRequest != nil {
|
||||
t.Fatal("expected the gRPC call to never reach the server when there's no identity")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchRefusesIdentityWithNoTenant(t *testing.T) {
|
||||
client, fake := newTestServer(t)
|
||||
// RoleService identities carry no TenantID -- see api/authz.Identity's
|
||||
// doc comment. /alerting never calls search directly today, but the
|
||||
// fail-closed behavior must hold regardless of how this arises.
|
||||
ctx := authz.WithIdentity(context.Background(), authz.Identity{Role: authz.RoleService})
|
||||
|
||||
if _, err := client.Search(ctx, "error", 10); err == nil {
|
||||
t.Fatal("expected Search to refuse an identity with no tenant")
|
||||
}
|
||||
if fake.lastRequest != nil {
|
||||
t.Fatal("expected the gRPC call to never reach the server when the identity has no tenant")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSearchDifferentTenantsSendDifferentTenantIDs(t *testing.T) {
|
||||
client, fake := newTestServer(t)
|
||||
|
||||
ctxA := authz.WithIdentity(context.Background(), authz.Identity{TenantID: "acme", Role: authz.RoleViewer})
|
||||
if _, err := client.Search(ctxA, "q", 5); err != nil {
|
||||
t.Fatalf("Search (acme): %v", err)
|
||||
}
|
||||
if fake.lastRequest.TenantId != "acme" {
|
||||
t.Fatalf("TenantId = %q, want acme", fake.lastRequest.TenantId)
|
||||
}
|
||||
|
||||
ctxB := authz.WithIdentity(context.Background(), authz.Identity{TenantID: "globex", Role: authz.RoleViewer})
|
||||
if _, err := client.Search(ctxB, "q", 5); err != nil {
|
||||
t.Fatalf("Search (globex): %v", err)
|
||||
}
|
||||
if fake.lastRequest.TenantId != "globex" {
|
||||
t.Fatalf("TenantId = %q, want globex", fake.lastRequest.TenantId)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user