jcoffey-dev
ba2276aa1a
Closes the last named "isolation mechanism" gap: search.proto gains a tenant_id field on SearchRequest; search/src/registry.rs's IndexRegistry resolves it to an on-demand-opened, per-tenant Tantivy index (empty tenant_id keeps today's single default index, so this is purely additive); enterprise/internal/searchclient sets that field from the authenticated request identity in ctx, mirroring chrunner's exact fail-closed "never a parameter" shape. Wired into enterprise-api in place of the shared api/searchclient. Unlike the ClickHouse pieces from the previous two commits, this one is genuinely verified end to end in this environment: Tantivy is an embedded library, not a networked service, so both the Rust index registry (cargo test, cargo clippy --all-targets -- -D warnings, both clean) and the Go client (a real in-process gRPC server) could actually run. registry.rs's tenant_index_is_isolated_from_default_and_other_tenants seeds three real indices with the same term and confirms a tenant-scoped search returns only that tenant's document -- item 3 of the isolation design doc's verification plan, closed for real, not just written. With both ClickHouse and Tantivy isolation now built, the single largest remaining gap is no longer a missing mechanism: it's that nothing forces or flags whether a deployment actually runs enterprise-api instead of plain api, and that ingest itself has no tenant concept for either storage engine (every record still lands in the one shared database/ index no matter what -- undesigned, not just unbuilt). Updated the threat model, architecture doc, CLAUDE.md, and both READMEs accordingly.
45 lines
1.8 KiB
Protocol Buffer
45 lines
1.8 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package sentry.search.v1;
|
|
|
|
option go_package = "github.com/sentry/sentry/proto/sentry/search/v1;searchv1";
|
|
|
|
// SearchService is the full-text search index (Tantivy-backed) that
|
|
// `api` calls to resolve a free-text query into matching record_ids,
|
|
// which `api` then joins back against ClickHouse. Internal service-to-
|
|
// service call, same gRPC-first convention as agent<->ingest — see
|
|
// /docs/architecture.md and /search/README.md.
|
|
service SearchService {
|
|
rpc Search(SearchRequest) returns (SearchResponse);
|
|
}
|
|
|
|
message SearchRequest {
|
|
// Free-text query passed to Tantivy's query parser as-is. Supports
|
|
// phrase queries ("exact phrase") and wildcards (foo*) per Tantivy's
|
|
// own query syntax — see /search/README.md for exactly what that does
|
|
// and doesn't support in Phase 1.
|
|
string query = 1;
|
|
|
|
// Max results to return. 0 (unset) uses the service's own default.
|
|
uint32 limit = 2;
|
|
|
|
// tenant_id (Phase 4) selects which per-tenant Tantivy index to search
|
|
// -- resolved server-side by the caller (enterprise/internal/
|
|
// searchclient, from the authenticated identity in request context),
|
|
// never a value a browser/client supplies directly. Empty selects the
|
|
// single default index every Phase 0-3 deployment (and every
|
|
// ingest-written record today, regardless of tenant -- see
|
|
// /docs/security/threat-model.md's ingest-tenancy caveat) already
|
|
// uses, so this field is purely additive: an old caller that never
|
|
// sets it keeps today's behavior exactly.
|
|
string tenant_id = 3;
|
|
}
|
|
|
|
message SearchResponse {
|
|
// record_ids of matching logs, most-relevant first. Callers join these
|
|
// back against ClickHouse's `logs.record_id` column to get full rows —
|
|
// this service only ever returns IDs, never row data, so it stays a
|
|
// pure text index rather than a second copy of the row.
|
|
repeated string record_ids = 1;
|
|
}
|