jcoffey-dev
3eb0f4c589
RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
95 lines
2.8 KiB
Go
95 lines
2.8 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
var httpClient = &http.Client{Timeout: 30 * time.Second}
|
|
|
|
// setAuth attaches SENTRYCTL_TOKEN (see resolveToken) as a Bearer
|
|
// credential, a no-op when token is empty -- matches every backend's
|
|
// nil-authorizer no-op default (see api/internal/authz.RequireRole*).
|
|
func setAuth(req *http.Request, token string) {
|
|
if token != "" {
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
}
|
|
}
|
|
|
|
// httpGetJSON GETs path and prints the pretty-printed JSON response to
|
|
// stdout, or the error body/status to stderr. Shared by dashboards/alerts
|
|
// list and get, which otherwise differ only in path and resource name.
|
|
func httpGetJSON(baseURL, path, token string, stdout, stderr io.Writer) int {
|
|
req, err := http.NewRequest(http.MethodGet, baseURL+path, nil)
|
|
if err != nil {
|
|
fmt.Fprintf(stderr, "building request: %v\n", err)
|
|
return 1
|
|
}
|
|
setAuth(req, token)
|
|
resp, err := httpClient.Do(req)
|
|
if err != nil {
|
|
fmt.Fprintf(stderr, "request failed: %v\n", err)
|
|
return 1
|
|
}
|
|
defer resp.Body.Close()
|
|
return printJSONResponse(resp, stdout, stderr)
|
|
}
|
|
|
|
// httpPostFileJSON reads file (a JSON document, e.g. an exported
|
|
// dashboard or a rule definition) and POSTs it to path as-is -- no
|
|
// reshaping, since the file's shape already matches what the endpoint
|
|
// expects (the same JSON the web UI's export button and POST /rules
|
|
// produce/accept respectively). This is what makes "apply" the seed of a
|
|
// future Terraform provider: one JSON contract, multiple callers.
|
|
func httpPostFileJSON(baseURL, path, token, file string, stdout, stderr io.Writer) int {
|
|
body, err := os.ReadFile(file)
|
|
if err != nil {
|
|
fmt.Fprintf(stderr, "reading %s: %v\n", file, err)
|
|
return 1
|
|
}
|
|
req, err := http.NewRequest(http.MethodPost, baseURL+path, bytes.NewReader(body))
|
|
if err != nil {
|
|
fmt.Fprintf(stderr, "building request: %v\n", err)
|
|
return 1
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
setAuth(req, token)
|
|
resp, err := httpClient.Do(req)
|
|
if err != nil {
|
|
fmt.Fprintf(stderr, "request failed: %v\n", err)
|
|
return 1
|
|
}
|
|
defer resp.Body.Close()
|
|
return printJSONResponse(resp, stdout, stderr)
|
|
}
|
|
|
|
func printJSONResponse(resp *http.Response, stdout, stderr io.Writer) int {
|
|
body, err := io.ReadAll(resp.Body)
|
|
if err != nil {
|
|
fmt.Fprintf(stderr, "reading response: %v\n", err)
|
|
return 1
|
|
}
|
|
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
|
|
var errResp errorResponseBody
|
|
if json.Unmarshal(body, &errResp) == nil && errResp.Error != "" {
|
|
fmt.Fprintf(stderr, "request failed: %s\n", errResp.Error)
|
|
} else {
|
|
fmt.Fprintf(stderr, "request failed: status %d\n", resp.StatusCode)
|
|
}
|
|
return 1
|
|
}
|
|
var pretty bytes.Buffer
|
|
if json.Indent(&pretty, body, "", " ") == nil {
|
|
stdout.Write(pretty.Bytes())
|
|
} else {
|
|
stdout.Write(body)
|
|
}
|
|
fmt.Fprintln(stdout)
|
|
return 0
|
|
}
|