jcoffey-dev
ba2276aa1a
Closes the last named "isolation mechanism" gap: search.proto gains a tenant_id field on SearchRequest; search/src/registry.rs's IndexRegistry resolves it to an on-demand-opened, per-tenant Tantivy index (empty tenant_id keeps today's single default index, so this is purely additive); enterprise/internal/searchclient sets that field from the authenticated request identity in ctx, mirroring chrunner's exact fail-closed "never a parameter" shape. Wired into enterprise-api in place of the shared api/searchclient. Unlike the ClickHouse pieces from the previous two commits, this one is genuinely verified end to end in this environment: Tantivy is an embedded library, not a networked service, so both the Rust index registry (cargo test, cargo clippy --all-targets -- -D warnings, both clean) and the Go client (a real in-process gRPC server) could actually run. registry.rs's tenant_index_is_isolated_from_default_and_other_tenants seeds three real indices with the same term and confirms a tenant-scoped search returns only that tenant's document -- item 3 of the isolation design doc's verification plan, closed for real, not just written. With both ClickHouse and Tantivy isolation now built, the single largest remaining gap is no longer a missing mechanism: it's that nothing forces or flags whether a deployment actually runs enterprise-api instead of plain api, and that ingest itself has no tenant concept for either storage engine (every record still lands in the one shared database/ index no matter what -- undesigned, not just unbuilt). Updated the threat model, architecture doc, CLAUDE.md, and both READMEs accordingly.
59 lines
1.9 KiB
Rust
59 lines
1.9 KiB
Rust
use std::sync::Arc;
|
|
use tonic::{Request, Response, Status};
|
|
|
|
use crate::registry::IndexRegistry;
|
|
use crate::searchv1;
|
|
|
|
const DEFAULT_LIMIT: usize = 100;
|
|
|
|
pub struct SearchServer {
|
|
registry: Arc<IndexRegistry>,
|
|
}
|
|
|
|
impl SearchServer {
|
|
pub fn new(registry: Arc<IndexRegistry>) -> Self {
|
|
Self { registry }
|
|
}
|
|
}
|
|
|
|
#[tonic::async_trait]
|
|
impl searchv1::search_service_server::SearchService for SearchServer {
|
|
async fn search(
|
|
&self,
|
|
request: Request<searchv1::SearchRequest>,
|
|
) -> Result<Response<searchv1::SearchResponse>, Status> {
|
|
let req = request.into_inner();
|
|
if req.query.trim().is_empty() {
|
|
return Err(Status::invalid_argument("query must not be empty"));
|
|
}
|
|
|
|
let limit = if req.limit == 0 {
|
|
DEFAULT_LIMIT
|
|
} else {
|
|
req.limit as usize
|
|
};
|
|
|
|
// Resolves (opening on first use) the caller's tenant index, or
|
|
// the single default index when tenant_id is empty -- see
|
|
// registry.rs's doc comment. Never falls back to a *different*
|
|
// tenant's index on error; an unsafe/unknown tenant_id is a
|
|
// hard failure, not a silent default.
|
|
let index = self
|
|
.registry
|
|
.resolve(&req.tenant_id)
|
|
.await
|
|
.map_err(|e| Status::invalid_argument(format!("resolving tenant index: {e}")))?;
|
|
|
|
let query = req.query.clone();
|
|
// Tantivy's searcher is synchronous; run it on a blocking thread
|
|
// so it doesn't stall the async runtime alongside the consumer
|
|
// tasks.
|
|
let record_ids = tokio::task::spawn_blocking(move || index.search(&query, limit))
|
|
.await
|
|
.map_err(|e| Status::internal(format!("search task panicked: {e}")))?
|
|
.map_err(|e| Status::invalid_argument(format!("search failed: {e}")))?;
|
|
|
|
Ok(Response::new(searchv1::SearchResponse { record_ids }))
|
|
}
|
|
}
|