jcoffey-dev
1d57e697b1
Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.
Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.
Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."
Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.
66 lines
2.2 KiB
Go
66 lines
2.2 KiB
Go
package authz
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
// HTTPAuthorizer is the production Authorizer for a deployment with
|
|
// enterprise-auth configured -- it calls enterprise-auth's
|
|
// POST /internal/authorize endpoint, forwarding the caller's own
|
|
// credentials (session cookie or service-token header), rather than
|
|
// importing any enterprise/ Go package. This is the same "network
|
|
// boundary, not import boundary" shape /alerting's queryclient already
|
|
// uses to call api's /query: the module-boundary guarantee
|
|
// hack/check-tenant-boundary.sh enforces is about Go imports, and this
|
|
// type has none from enterprise/.
|
|
type HTTPAuthorizer struct {
|
|
baseURL string
|
|
http *http.Client
|
|
}
|
|
|
|
func NewHTTPAuthorizer(baseURL string) *HTTPAuthorizer {
|
|
return &HTTPAuthorizer{baseURL: baseURL, http: &http.Client{Timeout: 3 * time.Second}}
|
|
}
|
|
|
|
type authorizeResponse struct {
|
|
TenantID string `json:"tenant_id"`
|
|
UserID string `json:"user_id"`
|
|
Role string `json:"role"`
|
|
}
|
|
|
|
// Authorize forwards exactly two credential-carrying headers -- Cookie
|
|
// (human sessions) and Authorization (service tokens) -- never the rest
|
|
// of the request. enterprise-auth validates whichever is present and
|
|
// returns the resolved identity, or a non-2xx if neither validates.
|
|
func (a *HTTPAuthorizer) Authorize(r *http.Request) (Identity, error) {
|
|
req, err := http.NewRequestWithContext(r.Context(), http.MethodPost, a.baseURL+"/internal/authorize", nil)
|
|
if err != nil {
|
|
return Identity{}, fmt.Errorf("authz: building request: %w", err)
|
|
}
|
|
if cookie := r.Header.Get("Cookie"); cookie != "" {
|
|
req.Header.Set("Cookie", cookie)
|
|
}
|
|
if auth := r.Header.Get("Authorization"); auth != "" {
|
|
req.Header.Set("Authorization", auth)
|
|
}
|
|
|
|
resp, err := a.http.Do(req)
|
|
if err != nil {
|
|
return Identity{}, fmt.Errorf("authz: calling enterprise-auth: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
return Identity{}, fmt.Errorf("authz: enterprise-auth returned status %d", resp.StatusCode)
|
|
}
|
|
|
|
var body authorizeResponse
|
|
if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
|
|
return Identity{}, fmt.Errorf("authz: decoding response: %w", err)
|
|
}
|
|
return Identity{TenantID: body.TenantID, UserID: body.UserID, Role: Role(body.Role)}, nil
|
|
}
|