jcoffey-dev
1d57e697b1
Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.
Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.
Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."
Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.
56 lines
3.0 KiB
Go
56 lines
3.0 KiB
Go
// This file is a checklist, not a fully passing test suite -- it exists
|
|
// so the four adversarial probes /docs/phase-4-isolation-design.md's
|
|
// "Verification plan for this design specifically" section names for
|
|
// Phase 4 task 8 have a permanent, grep-able home in the test tree.
|
|
//
|
|
// Item 1 (fully-qualified cross-tenant raw SQL) is no longer blocked:
|
|
// enterprise/internal/tenantprovision and enterprise/internal/chrunner
|
|
// now exist, and both have real, passing (when run against a live
|
|
// ClickHouse) tests for exactly this probe --
|
|
// enterprise/internal/tenantprovision/tenantprovision_test.go's
|
|
// TestProvisionedUserCannotReadOtherTenantDatabase (at the raw
|
|
// ClickHouse-user layer) and enterprise/internal/chrunner/
|
|
// chrunner_test.go's TestRegistryTenantCannotReadOtherTenantEvenViaRawSQL
|
|
// (through the actual query-execution code path api/queryapi.Handler
|
|
// calls in production, when fronted by enterprise/cmd/enterprise-api
|
|
// instead of plain api/cmd/api). Nothing to assert here anymore for
|
|
// item 1 -- see those two tests instead.
|
|
//
|
|
// Items 2-4 remain blocked, for the reasons each Skip below states.
|
|
// Note the scope boundary this leaves: even with chrunner wired in,
|
|
// there is still exactly one shared Tantivy index for every tenant
|
|
// (enterprise/internal/searchclient, the Tantivy-side equivalent of
|
|
// chrunner, is unbuilt) -- see /docs/security/threat-model.md.
|
|
package queryapi
|
|
|
|
import "testing"
|
|
|
|
func TestAdversarial_ClickHouseUserCannotReadSystemTables(t *testing.T) {
|
|
t.Skip("BLOCKED on enterprise/internal/tenantprovision: needs a real per-tenant " +
|
|
"ClickHouse user to attempt `SELECT * FROM system.query_log`, " +
|
|
"`system.tables`, `SHOW DATABASES` against, and confirm system.* " +
|
|
"access was actually revoked (not just assumed from ClickHouse's " +
|
|
"default template -- task 2's finding was that this is " +
|
|
"version-dependent and must be checked live, not read from docs). " +
|
|
"See /docs/phase-4-isolation-design.md's verification plan, item 2.")
|
|
}
|
|
|
|
func TestAdversarial_TantivySearchExcludesOtherTenantsMatchingResults(t *testing.T) {
|
|
t.Skip("BLOCKED on enterprise/internal/searchclient: needs two real " +
|
|
"per-tenant Tantivy indices, one seeded with a term, to confirm a " +
|
|
"search scoped to the other tenant returns zero hits for that term " +
|
|
"even though the term exists in the other index. See " +
|
|
"/docs/phase-4-isolation-design.md's verification plan, item 3.")
|
|
}
|
|
|
|
func TestAdversarial_EvaluatorTickMidProvisioningIsRefusedNotServed(t *testing.T) {
|
|
t.Skip("BLOCKED on enterprise/internal/tenantprovision's ordered " +
|
|
"provisioning state machine (CREATE USER -> GRANT -> mark active): " +
|
|
"needs a tenant row that exists but hasn't reached the active gate " +
|
|
"yet, and a simulated /alerting evaluator tick against it, to " +
|
|
"confirm every tenant-resolution path actually checks tenant " +
|
|
"status server-side rather than inferring readiness from ambient " +
|
|
"connection success. See /docs/phase-4-isolation-design.md's " +
|
|
"verification plan, item 4, and its provisioning-gate requirement.")
|
|
}
|