jcoffey-dev
1d57e697b1
Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.
Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.
Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."
Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.
37 lines
1.1 KiB
Go
37 lines
1.1 KiB
Go
package authz
|
|
|
|
import "testing"
|
|
|
|
func TestRoleSatisfies(t *testing.T) {
|
|
tests := []struct {
|
|
have, want Role
|
|
satisfies bool
|
|
}{
|
|
{RoleViewer, RoleViewer, true},
|
|
{RoleEditor, RoleViewer, true},
|
|
{RoleAdmin, RoleViewer, true},
|
|
{RoleOwner, RoleViewer, true},
|
|
{RoleViewer, RoleEditor, false},
|
|
{RoleViewer, RoleAdmin, false},
|
|
{RoleEditor, RoleAdmin, false},
|
|
{RoleAdmin, RoleOwner, false},
|
|
{RoleOwner, RoleOwner, true},
|
|
// RoleService is a separate lane, not on the human rank scale --
|
|
// per /docs/phase-4-isolation-design.md's alerting service
|
|
// identity, it must never satisfy a human role requirement no
|
|
// matter how "high" that might look on paper, and a human role
|
|
// (even Owner) must never satisfy a RoleService requirement.
|
|
{RoleService, RoleViewer, false},
|
|
{RoleService, RoleOwner, false},
|
|
{RoleOwner, RoleService, false},
|
|
{RoleViewer, RoleService, false},
|
|
{RoleService, RoleService, true},
|
|
}
|
|
for _, tt := range tests {
|
|
got := tt.have.Satisfies(tt.want)
|
|
if got != tt.satisfies {
|
|
t.Errorf("Role(%q).Satisfies(%q) = %v, want %v", tt.have, tt.want, got, tt.satisfies)
|
|
}
|
|
}
|
|
}
|