jcoffey-dev
1d57e697b1
Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.
Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.
Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."
Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.
77 lines
2.7 KiB
Go
77 lines
2.7 KiB
Go
// Adapts *Store to api/queryapi.AuditLogger -- the interface core
|
|
// defines and has carried as a nil-by-default field
|
|
// (api/queryapi.Handler.audit) since Phase 4 task 4, waiting on exactly
|
|
// this: a real implementation, wired in by enterprise/cmd/enterprise-api
|
|
// (the one binary allowed to import both packages -- see chrunner's doc
|
|
// comment on the enterprise->api import direction).
|
|
package audit
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/sentry/sentry/api/authz"
|
|
"github.com/sentry/sentry/api/queryapi"
|
|
)
|
|
|
|
// QueryAPILogger implements queryapi.AuditLogger by translating its
|
|
// tenant-agnostic QueryAuditEntry into this package's Entry, reading
|
|
// tenant/user identity from ctx -- exactly the shape
|
|
// queryapi.AuditLogger's doc comment describes: "an enterprise-side
|
|
// implementation reads identity from ctx rather than this interface
|
|
// growing tenant-awareness."
|
|
type QueryAPILogger struct {
|
|
store *Store
|
|
source Source
|
|
}
|
|
|
|
// NewQueryAPILogger wraps store for use as a specific Source -- api's
|
|
// queryapi.Handler and /alerting's evaluations go through different
|
|
// enterprise-api-fronted paths today (SourceAPI is the only one
|
|
// actually wired to a real HTTP handler; SourceAlerting is named for
|
|
// when alerting's queries get audited the same way, not yet built).
|
|
func NewQueryAPILogger(store *Store, source Source) *QueryAPILogger {
|
|
return &QueryAPILogger{store: store, source: source}
|
|
}
|
|
|
|
func (l *QueryAPILogger) LogQuery(ctx context.Context, entry queryapi.QueryAuditEntry) error {
|
|
identity, ok := authz.IdentityFromContext(ctx)
|
|
if !ok || identity.TenantID == "" {
|
|
// Fail open at the queryapi.Handler call site already covers
|
|
// "don't take down the query path" -- this specific error tells
|
|
// that fail-open path *why* the write didn't happen, distinct
|
|
// from a real audit-storage failure, since chrunner.RunSQL
|
|
// would already have refused the query itself in this case (see
|
|
// that package's RunSQL) -- this branch mostly protects against
|
|
// a future caller that skips chrunner's own check.
|
|
return fmt.Errorf("audit: no tenant identity in context, refusing to write an unattributable audit entry")
|
|
}
|
|
|
|
status := StatusSuccess
|
|
var errMsg *string
|
|
if !entry.Success {
|
|
status = StatusError
|
|
errMsg = &entry.Error
|
|
}
|
|
var userID *string
|
|
if identity.UserID != "" {
|
|
userID = &identity.UserID
|
|
}
|
|
queryText := entry.Query
|
|
rowCount := entry.RowCount
|
|
durationMS := int(entry.Duration.Milliseconds())
|
|
|
|
_, err := l.store.Append(ctx, Entry{
|
|
TenantID: identity.TenantID,
|
|
UserID: userID,
|
|
Source: l.source,
|
|
EventType: EventQuery,
|
|
QueryText: &queryText,
|
|
RowCount: &rowCount,
|
|
DurationMS: &durationMS,
|
|
Status: status,
|
|
ErrorMessage: errMsg,
|
|
})
|
|
return err
|
|
}
|