jcoffey-dev
1d57e697b1
Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.
Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.
Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."
Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.
92 lines
2.4 KiB
Go
92 lines
2.4 KiB
Go
// Package ast defines the parsed pipe-syntax tree. Internal to
|
|
// querylang -- not exposed outside it. See
|
|
// /docs/query-language-design.md for the grammar this mirrors.
|
|
package ast
|
|
|
|
// Query is `base_search ("|" pipe_stage)*`.
|
|
type Query struct {
|
|
Base BoolExpr
|
|
Pipes []PipeStage
|
|
}
|
|
|
|
// PipeStage is one of WhereStage, StatsStage, SortStage, FieldsStage,
|
|
// HeadStage, TailStage.
|
|
type PipeStage interface{ isPipeStage() }
|
|
|
|
type WhereStage struct{ Expr BoolExpr }
|
|
type StatsStage struct {
|
|
Aggs []AggCall
|
|
By []string
|
|
}
|
|
type SortStage struct{ Fields []SortField }
|
|
type FieldsStage struct{ Fields []string }
|
|
type HeadStage struct {
|
|
N int
|
|
HasN bool // false => default limit, decided by the planner
|
|
}
|
|
type TailStage struct {
|
|
N int
|
|
HasN bool
|
|
}
|
|
|
|
func (WhereStage) isPipeStage() {}
|
|
func (StatsStage) isPipeStage() {}
|
|
func (SortStage) isPipeStage() {}
|
|
func (FieldsStage) isPipeStage() {}
|
|
func (HeadStage) isPipeStage() {}
|
|
func (TailStage) isPipeStage() {}
|
|
|
|
// BoolExpr is a sequence of terms joined by "and"/"or". An empty Conjs
|
|
// entry between two terms (i.e. no explicit keyword in the source) means
|
|
// implicit AND -- SPL's convention for adjacent bare search terms, e.g.
|
|
// `error timeout` means `error AND timeout`. Conjs has len(Terms)-1
|
|
// elements once Terms has more than one.
|
|
type BoolExpr struct {
|
|
Terms []Term
|
|
Conjs []string // "and" | "or", one per gap between consecutive Terms
|
|
}
|
|
|
|
// Term is one of Comparison, TimeBound, FreeText.
|
|
type Term interface{ isTerm() }
|
|
|
|
type Comparison struct {
|
|
Field string
|
|
Op string // "=", "!=", ">", ">=", "<", "<="
|
|
Value string
|
|
}
|
|
|
|
type TimeBound struct {
|
|
Kind string // "earliest" | "latest"
|
|
Expr TimeExpr
|
|
}
|
|
|
|
type FreeText struct {
|
|
Query string
|
|
}
|
|
|
|
func (Comparison) isTerm() {}
|
|
func (TimeBound) isTerm() {}
|
|
func (FreeText) isTerm() {}
|
|
|
|
// TimeExpr is either an absolute RFC3339 timestamp or a relative offset
|
|
// like -1h/-7d, resolved to an absolute time by the planner (relative to
|
|
// compile time), not the parser -- the parser has no notion of "now".
|
|
type TimeExpr struct {
|
|
Absolute string
|
|
IsRelative bool
|
|
RelativeSign int // -1 or +1
|
|
RelativeN int
|
|
RelativeUnit string // "s" | "m" | "h" | "d" | "w"
|
|
}
|
|
|
|
type AggCall struct {
|
|
Func string // count, sum, avg, min, max
|
|
Field string // empty for count()/count(*)
|
|
Alias string // empty => planner assigns a default alias
|
|
}
|
|
|
|
type SortField struct {
|
|
Field string
|
|
Desc bool
|
|
}
|