jcoffey-dev
cd8aa290ca
Extends the agent, ingest, storage, api, and web with Windows Event Log/ETW sourcing and Tantivy-backed free-text search, per the approved Phase 1 plan. - CLAUDE.md: materialized on disk (never existed as a file before) with a new Phase 1 "done looks like" section. - agent: Windows Event Log (EvtSubscribe) and ETW sources, Windows service wrapper (install/uninstall/run-service), both feature- and target_os-gated so Linux builds/tests/clippy stay unaffected. Also fixed two pre-existing Phase 0 clippy gaps (dead-code on default-features-only builds, a type-inference edge case) found while testing every feature combination properly for the first time. UNVERIFIED on real Windows -- no Windows toolchain existed anywhere in the build environment; flagged prominently in three places. - proto/ingest: new record_id field, assigned once server-side in ingest's gRPC front end so ClickHouse and Tantivy agree on the same ID for the same record. - storage: record_id column + bloom filter index, verified against a live ClickHouse. - search: new service, Tantivy index, rskafka consumer as an independent second consumer group on the same Redpanda topic ingest already reads. - api/web: new /search endpoint and page, sharing the query page's result-table shape and component. - hack/windows-fixture: sends realistic Windows-shaped data straight to ingest, so the pipeline's handling of it is verifiable without a Windows host. Verified end-to-end on the live docker-compose stack: the same record_id comes back from both /query and /search for the same log line, including for windows-fixture's synthetic Windows Event Log data. Real bugs found and fixed along the way: api/Dockerfile missing proto/ in its build context, search's logs being completely silent (RUST_LOG gap), and search/target/ missing from .gitignore/.dockerignore.
112 lines
3.6 KiB
Go
112 lines
3.6 KiB
Go
// Package queryapi is Sentry's query API: POST /query (Phase 0, a crude
|
|
// raw-SQL passthrough allowlisted to SELECT) and POST /search (Phase 1,
|
|
// free-text search via the search service, joined back against
|
|
// ClickHouse). This is a deliberate simplification of the pinned "gRPC +
|
|
// REST gateway" control-plane pattern (see CLAUDE.md's tech stack table):
|
|
// plain net/http REST handlers, not a gRPC service transcoded through
|
|
// grpc-gateway. That machinery (proto definitions, googleapis
|
|
// annotations, gateway codegen) doesn't buy much for two crude endpoints
|
|
// that Phase 2's real SPL-like query layer replaces outright. Revisit
|
|
// gRPC+gateway once /api's endpoint count and lifespan justify it.
|
|
package queryapi
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"log/slog"
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
// queryExecutor is the narrow interface handleQuery depends on, so tests
|
|
// can substitute a fake without a real ClickHouse connection. *Executor
|
|
// satisfies it.
|
|
type queryExecutor interface {
|
|
Execute(ctx context.Context, sql string) (*QueryResult, error)
|
|
}
|
|
|
|
type Handler struct {
|
|
logger *slog.Logger
|
|
exec queryExecutor
|
|
search searchClient
|
|
queryTimeout time.Duration
|
|
allowedOrigin string
|
|
}
|
|
|
|
func NewHandler(logger *slog.Logger, exec queryExecutor, search searchClient, queryTimeout time.Duration, allowedOrigin string) *Handler {
|
|
return &Handler{logger: logger, exec: exec, search: search, queryTimeout: queryTimeout, allowedOrigin: allowedOrigin}
|
|
}
|
|
|
|
func (h *Handler) Routes() http.Handler {
|
|
mux := http.NewServeMux()
|
|
mux.HandleFunc("POST /query", h.handleQuery)
|
|
mux.HandleFunc("POST /search", h.handleSearch)
|
|
mux.HandleFunc("GET /healthz", h.handleHealthz)
|
|
return h.withCORS(mux)
|
|
}
|
|
|
|
// withCORS is deliberately permissive by default (see CORSAllowedOrigin in
|
|
// internal/config) since Phase 0 has no auth and the SvelteKit dev server
|
|
// runs on a different origin. Tighten alongside adding real auth.
|
|
func (h *Handler) withCORS(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Access-Control-Allow-Origin", h.allowedOrigin)
|
|
w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
|
|
w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
|
|
if r.Method == http.MethodOptions {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func (h *Handler) handleHealthz(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
|
|
type queryRequest struct {
|
|
SQL string `json:"sql"`
|
|
}
|
|
|
|
type errorResponse struct {
|
|
Error string `json:"error"`
|
|
}
|
|
|
|
// maxBodyBytes caps the request body: a raw SQL string has no legitimate
|
|
// reason to be larger than this.
|
|
const maxBodyBytes = 1 << 20 // 1 MiB
|
|
|
|
func (h *Handler) handleQuery(w http.ResponseWriter, r *http.Request) {
|
|
r.Body = http.MaxBytesReader(w, r.Body, maxBodyBytes)
|
|
|
|
var req queryRequest
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
writeError(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
|
|
return
|
|
}
|
|
|
|
if err := validateSelectOnly(req.SQL); err != nil {
|
|
writeError(w, http.StatusBadRequest, err.Error())
|
|
return
|
|
}
|
|
|
|
ctx, cancel := context.WithTimeout(r.Context(), h.queryTimeout)
|
|
defer cancel()
|
|
|
|
result, err := h.exec.Execute(ctx, req.SQL)
|
|
if err != nil {
|
|
h.logger.Error("query execution failed", "error", err)
|
|
writeError(w, http.StatusBadGateway, "query failed: "+err.Error())
|
|
return
|
|
}
|
|
|
|
writeJSON(w, result)
|
|
}
|
|
|
|
func writeError(w http.ResponseWriter, status int, msg string) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(status)
|
|
_ = json.NewEncoder(w).Encode(errorResponse{Error: msg})
|
|
}
|