jcoffey-dev
1d57e697b1
Closes the threat model's headline finding for the SQL query path:
enterprise/internal/tenantprovision does real CREATE DATABASE/USER/GRANT
against ClickHouse, and enterprise/internal/chrunner is a per-tenant
connection registry implementing api's SQLRunner interface, resolving
the tenant from the authenticated request identity -- never a
caller-suppliable parameter. Both are wired into a new binary,
enterprise/cmd/enterprise-api, alongside the unchanged single-tenant
api/cmd/api, since AGPL core can never import enterprise/ and Go's own
internal/ package visibility rules meant enterprise/ couldn't implement
core's SQLRunner interface without importing the package that defines
it. That required moving api/internal/{authz,queryapi,dashboards,
querylang/executor,searchclient,httpserver} out of internal/ -- the
minimal set enterprise-api needs to import; querylang's compiler
internals (planner/lexer/parser/ast/ir) and api's own config stay
internal, since nothing outside api needs them directly.
Also finally wires enterprise/internal/audit into queryapi.AuditLogger
(nil since Phase 4 task 4) via a new adapter, and adds live-ClickHouse
integration tests for two of the four adversarial probes named in
docs/phase-4-isolation-design.md's verification plan.
Corrected several overclaims in the docs while writing this up: an
earlier claim that rbacstore's CRUD was "verified against a live
Postgres" was never actually true in this environment (only
internal/audit was, earlier in this phase, before Docker access was
lost) -- threat-model.md, phase-4-runbook.md, CLAUDE.md, and
enterprise/README.md all now distinguish "a real integration test
exists" from "this was confirmed against a live database."
Still not built: Tantivy/free-text tenant isolation
(enterprise/internal/searchclient), and any deployment-topology
mechanism that actually routes traffic to enterprise-api instead of
plain api -- both binaries exist side by side today with nothing
enforcing or flagging which one a deployment runs.
73 lines
2.2 KiB
Go
73 lines
2.2 KiB
Go
package authz
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
)
|
|
|
|
type errorResponse struct {
|
|
Error string `json:"error"`
|
|
}
|
|
|
|
func writeUnauthorized(w http.ResponseWriter) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
_ = json.NewEncoder(w).Encode(errorResponse{Error: "unauthorized"})
|
|
}
|
|
|
|
func writeForbidden(w http.ResponseWriter) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
_ = json.NewEncoder(w).Encode(errorResponse{Error: "forbidden"})
|
|
}
|
|
|
|
// RequireRole wraps next so it only runs for a caller whose resolved
|
|
// Identity.Role satisfies minRole. A nil authorizer is a deliberate,
|
|
// documented no-op -- a single-tenant deployment with no enterprise/
|
|
// configured behaves exactly as Phases 0-3 did, unauthenticated, not
|
|
// locked out. This is the same nil-safety shape as
|
|
// queryapi.AuditLogger and dashboards' optional dependencies.
|
|
func RequireRole(authorizer Authorizer, minRole Role, next http.HandlerFunc) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
if authorizer == nil {
|
|
next(w, r)
|
|
return
|
|
}
|
|
identity, err := authorizer.Authorize(r)
|
|
if err != nil {
|
|
writeUnauthorized(w)
|
|
return
|
|
}
|
|
if !identity.Role.Satisfies(minRole) {
|
|
writeForbidden(w)
|
|
return
|
|
}
|
|
next(w, r.WithContext(WithIdentity(r.Context(), identity)))
|
|
}
|
|
}
|
|
|
|
// RequireRoleOrService is RequireRole plus an explicit allowance for
|
|
// RoleService -- used only by endpoints /alerting's evaluator legitimately
|
|
// calls (POST /query today). Every other endpoint uses plain RequireRole,
|
|
// so a service credential can never reach dashboard/rule administration
|
|
// even though it's a valid, authenticated identity -- narrow by default,
|
|
// widened only where a real machine caller exists.
|
|
func RequireRoleOrService(authorizer Authorizer, minRole Role, next http.HandlerFunc) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
if authorizer == nil {
|
|
next(w, r)
|
|
return
|
|
}
|
|
identity, err := authorizer.Authorize(r)
|
|
if err != nil {
|
|
writeUnauthorized(w)
|
|
return
|
|
}
|
|
if identity.Role != RoleService && !identity.Role.Satisfies(minRole) {
|
|
writeForbidden(w)
|
|
return
|
|
}
|
|
next(w, r.WithContext(WithIdentity(r.Context(), identity)))
|
|
}
|
|
}
|