Close search's active-tenant write-routing gap with a polled allowlist

search/src/consumer.rs's write-routing (built last pass) had no active-
tenant check at all: IndexRegistry.resolve() would open-or-create an
index directory for any syntactically-valid tenant_id, active or not --
unlike ClickHouse's chwriter.Registry (an active-tenants-only snapshot
built at enterprise-ingest startup) or the read side (gated by
searchclient.TenantChecker, a direct rbacstore query). search is AGPL
core with no Postgres access and no enterprise/ import allowed, so it
needed a network boundary instead -- the same shape ingest's
TenantResolver already uses against enterprise-auth, just Rust calling
Go instead of Go calling Go.

New GET /internal/active-tenants endpoint on enterprise-auth
(rbacstore.ListActiveTenantIDs + authhandler.handleActiveTenants),
gated on a RoleService Bearer credential -- server-to-server auth, the
same shape alerting presents to api, minted via the already-generic
enterprise-auth -mint-service-token search. search/src/tenants.rs's
ActiveTenantTracker polls it every 60s, blocking startup on the first
fetch succeeding (fail-closed cold start -- a control-plane outage at
boot must not silently accept every tenant_id) and keeping the last-
known-good set on any later refresh failure (a transient blip shouldn't
stop every tenant's indexing, only prevent the allowlist from growing/
shrinking until connectivity resumes). consumer.rs refuses any tagged
record whose tenant isn't in the polled set, before ever calling
resolve() -- IndexRegistry itself stays policy-free, matching the same
mechanism/policy split clickhousewriter.Writer vs. chwriter.Registry
already draws on the ClickHouse side.

Off unless ENTERPRISE_AUTH_URL/ENTERPRISE_AUTH_SERVICE_TOKEN are both
set (search/src/config.rs rejects exactly one being set) -- every
existing deployment is unaffected.

Verified with real HTTP round trips in this environment: tenants.rs's
tests exercise real reqwest requests (actual Authorization: Bearer
header, actual JSON parsing) against a hand-rolled dependency-free TCP
test server, including both fail-closed paths (rejected first fetch,
unreachable server). authhandler's new tests cover the credential-kind
distinction this endpoint exists to enforce -- a real human session,
even for a genuine Owner, must not satisfy a check meant for a service
identity.

One asymmetry remains, disclosed rather than fixed: chwriter.Registry's
snapshot still never refreshes (stale until enterprise-ingest restarts),
while ActiveTenantTracker's 60s poll gives Tantivy a materially tighter
staleness window. Neither is a live per-write check -- that would mean
a database/HTTP round trip per record, a throughput cost neither
implementation accepts -- so both have some staleness window by design;
the gap between the two windows is what's disclosed, not a claim either
is fully live.

enterprise/internal/authhandler/authhandler.go

@@ -13,6 +13,9 @@
 // api/authz) and a different credential type (an ingest bearer token
 // checked against rbacstore's ingest_credentials table, not a
 // session.Manager JWT) -- see ingestCredentialValidator's doc comment.
+//
+// GET /internal/active-tenants is a third sibling, for `search`
+// (core/AGPL, Rust) -- see tenantLister's doc comment.
 package authhandler
 
 import (
@@ -50,21 +53,36 @@ type ingestCredentialValidator interface {
 	ValidateIngestCredential(ctx context.Context, token string) (tenantID string, err error)
 }
 
+// tenantLister is the narrow interface GET /internal/active-tenants
+// needs -- *rbacstore.Store is the production implementation (the same
+// concrete type ingestCredentials above already wires in, just a
+// second narrow interface it happens to also satisfy). Backs
+// search/src/tenants.rs's ActiveTenantTracker: search is AGPL core with
+// no Postgres access and no enterprise/ import allowed, so its write-
+// routing needed a network boundary to learn which tenants are active,
+// the same shape ingest/internal/grpcserver.TenantResolver already uses
+// against this exact service (see that package's doc comment).
+type tenantLister interface {
+	ListActiveTenantIDs(ctx context.Context) ([]string, error)
+}
+
 type Handler struct {
 	logger            *slog.Logger
 	manager           *session.Manager
 	features          Features
 	ingestCredentials ingestCredentialValidator
+	tenants           tenantLister
 }
 
-func New(logger *slog.Logger, manager *session.Manager, features Features, ingestCredentials ingestCredentialValidator) *Handler {
-	return &Handler{logger: logger, manager: manager, features: features, ingestCredentials: ingestCredentials}
+func New(logger *slog.Logger, manager *session.Manager, features Features, ingestCredentials ingestCredentialValidator, tenants tenantLister) *Handler {
+	return &Handler{logger: logger, manager: manager, features: features, ingestCredentials: ingestCredentials, tenants: tenants}
 }
 
 func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("POST /internal/authorize", h.handleAuthorize)
 	mux.HandleFunc("GET /auth/features", h.handleFeatures)
 	mux.HandleFunc("POST /internal/authorize-ingest", h.handleAuthorizeIngest)
+	mux.HandleFunc("GET /internal/active-tenants", h.handleActiveTenants)
 }
 
 type featuresResponse struct {
@@ -146,6 +164,44 @@ func (h *Handler) handleAuthorizeIngest(w http.ResponseWriter, r *http.Request)
 	_ = json.NewEncoder(w).Encode(authorizeIngestResponse{TenantID: tenantID})
 }
 
+type activeTenantsResponse struct {
+	TenantIDs []string `json:"tenant_ids"`
+}
+
+// handleActiveTenants is search/src/tenants.rs's ActiveTenantTracker's
+// server side -- polled periodically, not per-write, to build a local
+// allowlist for its write-routing gate (see that module's doc comment).
+// Requires a RoleService Bearer credential (session.Manager-issued,
+// Role == "service"), not a human session -- server-to-server, the same
+// authentication shape /alerting presents to /api, minted via
+// `enterprise-auth -mint-service-token search` (the flag is already
+// generic over caller name; no change needed there for a new caller).
+// Deliberately does NOT accept the tenant-scoped credential a human
+// session or an ingest credential would carry: this endpoint answers
+// "which tenants exist," a question no single tenant's identity should
+// be able to ask on its own.
+func (h *Handler) handleActiveTenants(w http.ResponseWriter, r *http.Request) {
+	token := bearerToken(r.Header.Get("Authorization"))
+	if token == "" {
+		http.Error(w, "no credentials presented", http.StatusUnauthorized)
+		return
+	}
+	claims, err := h.manager.Validate(token)
+	if err != nil || claims.Role != "service" {
+		http.Error(w, "invalid or expired credentials", http.StatusUnauthorized)
+		return
+	}
+
+	ids, err := h.tenants.ListActiveTenantIDs(r.Context())
+	if err != nil {
+		h.logger.Error("listing active tenant ids", "error", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(activeTenantsResponse{TenantIDs: ids})
+}
+
 func bearerToken(header string) string {
 	const prefix = "Bearer "
 	if !strings.HasPrefix(header, prefix) {

enterprise/internal/authhandler/authhandler_test.go

@@ -36,13 +36,27 @@ type fakeNotFoundError struct{}
 
 func (*fakeNotFoundError) Error() string { return "not found" }
 
+// fakeTenantLister is an in-memory stand-in for *rbacstore.Store's
+// ListActiveTenantIDs.
+type fakeTenantLister struct {
+	ids []string
+	err error
+}
+
+func (f *fakeTenantLister) ListActiveTenantIDs(_ context.Context) ([]string, error) {
+	if f.err != nil {
+		return nil, f.err
+	}
+	return f.ids, nil
+}
+
 func testHandler(t *testing.T) (*Handler, *session.Manager) {
 	t.Helper()
 	m, err := session.NewManager([]byte("this-is-a-32-byte-test-signing-key!"))
 	if err != nil {
 		t.Fatalf("session.NewManager: %v", err)
 	}
-	return New(slog.New(slog.NewTextHandler(io.Discard, nil)), m, Features{}, newFakeIngestCredentialValidator()), m
+	return New(slog.New(slog.NewTextHandler(io.Discard, nil)), m, Features{}, newFakeIngestCredentialValidator(), &fakeTenantLister{}), m
 }
 
 func doAuthorize(t *testing.T, h *Handler, mutate func(*http.Request)) *httptest.ResponseRecorder {
@@ -146,7 +160,7 @@ func TestFeaturesReflectsConfiguredMechanisms(t *testing.T) {
 	if err != nil {
 		t.Fatalf("session.NewManager: %v", err)
 	}
-	h := New(slog.New(slog.NewTextHandler(io.Discard, nil)), m, Features{OIDCEnabled: true, SAMLEnabled: false}, newFakeIngestCredentialValidator())
+	h := New(slog.New(slog.NewTextHandler(io.Discard, nil)), m, Features{OIDCEnabled: true, SAMLEnabled: false}, newFakeIngestCredentialValidator(), &fakeTenantLister{})
 
 	mux := http.NewServeMux()
 	h.RegisterRoutes(mux)
@@ -219,7 +233,7 @@ func TestAuthorizeIngestResolvesTenant(t *testing.T) {
 	}
 	validator := newFakeIngestCredentialValidator()
 	validator.tenantByToken["real-token"] = "acme"
-	h := New(slog.New(slog.NewTextHandler(io.Discard, nil)), m, Features{}, validator)
+	h := New(slog.New(slog.NewTextHandler(io.Discard, nil)), m, Features{}, validator, &fakeTenantLister{})
 
 	rec := doAuthorizeIngest(t, h, func(r *http.Request) {
 		r.Header.Set("Authorization", "Bearer real-token")
@@ -273,3 +287,96 @@ func TestAuthorizeIngestRejectsSessionToken(t *testing.T) {
 		t.Fatalf("status = %d, want 401 (a session token must not validate as an ingest credential)", rec.Code)
 	}
 }
+
+func doActiveTenants(t *testing.T, h *Handler, mutate func(*http.Request)) *httptest.ResponseRecorder {
+	t.Helper()
+	mux := http.NewServeMux()
+	h.RegisterRoutes(mux)
+	req := httptest.NewRequest(http.MethodGet, "/internal/active-tenants", nil)
+	if mutate != nil {
+		mutate(req)
+	}
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+	return rec
+}
+
+func TestActiveTenantsViaServiceToken(t *testing.T) {
+	m, err := session.NewManager([]byte("this-is-a-32-byte-test-signing-key!"))
+	if err != nil {
+		t.Fatalf("session.NewManager: %v", err)
+	}
+	h := New(slog.New(slog.NewTextHandler(io.Discard, nil)), m, Features{}, newFakeIngestCredentialValidator(), &fakeTenantLister{ids: []string{"acme", "globex"}})
+	token, err := m.IssueServiceToken("search")
+	if err != nil {
+		t.Fatalf("IssueServiceToken: %v", err)
+	}
+
+	rec := doActiveTenants(t, h, func(r *http.Request) {
+		r.Header.Set("Authorization", "Bearer "+token)
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+	var body activeTenantsResponse
+	if err := json.NewDecoder(rec.Body).Decode(&body); err != nil {
+		t.Fatalf("decoding response: %v", err)
+	}
+	if len(body.TenantIDs) != 2 || body.TenantIDs[0] != "acme" || body.TenantIDs[1] != "globex" {
+		t.Fatalf("unexpected response: %+v", body)
+	}
+}
+
+func TestActiveTenantsNoCredentialsIsUnauthorized(t *testing.T) {
+	h, _ := testHandler(t)
+	rec := doActiveTenants(t, h, nil)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rec.Code)
+	}
+}
+
+// TestActiveTenantsRejectsHumanSession is the regression test for this
+// endpoint's whole reason to distinguish token kinds: a human session
+// (even a real, validly-signed one) must not be able to list every
+// active tenant in the deployment -- only a RoleService credential can.
+func TestActiveTenantsRejectsHumanSession(t *testing.T) {
+	h, m := testHandler(t)
+	sessionToken, err := m.IssueUserSession("acme", "u1", "owner")
+	if err != nil {
+		t.Fatalf("IssueUserSession: %v", err)
+	}
+	rec := doActiveTenants(t, h, func(r *http.Request) {
+		r.Header.Set("Authorization", "Bearer "+sessionToken)
+	})
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401 (a human session must not satisfy the service-only active-tenants endpoint)", rec.Code)
+	}
+}
+
+func TestActiveTenantsInvalidTokenIsUnauthorized(t *testing.T) {
+	h, _ := testHandler(t)
+	rec := doActiveTenants(t, h, func(r *http.Request) {
+		r.Header.Set("Authorization", "Bearer not-a-real-token")
+	})
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rec.Code)
+	}
+}
+
+func TestActiveTenantsStoreErrorIsInternalError(t *testing.T) {
+	m, err := session.NewManager([]byte("this-is-a-32-byte-test-signing-key!"))
+	if err != nil {
+		t.Fatalf("session.NewManager: %v", err)
+	}
+	h := New(slog.New(slog.NewTextHandler(io.Discard, nil)), m, Features{}, newFakeIngestCredentialValidator(), &fakeTenantLister{err: errNotFound})
+	token, err := m.IssueServiceToken("search")
+	if err != nil {
+		t.Fatalf("IssueServiceToken: %v", err)
+	}
+	rec := doActiveTenants(t, h, func(r *http.Request) {
+		r.Header.Set("Authorization", "Bearer "+token)
+	})
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("status = %d, want 500", rec.Code)
+	}
+}

enterprise/internal/rbacstore/rbacstore.go

@@ -198,6 +198,34 @@ func (s *Store) TenantIsActive(ctx context.Context, tenantID string) (bool, erro
 	return t.Status == "active", nil
 }
 
+// ListActiveTenantIDs backs enterprise-auth's GET /internal/active-tenants
+// -- search (AGPL core) polls this to learn which tenant_ids it may
+// safely write-route into their own Tantivy index, since it has no
+// Postgres access of its own (see search/src/tenants.rs's doc comment
+// for the full design). Deliberately narrower than
+// ListProvisionedDataSources (which also requires ClickHouse
+// credentials to be present, since chwriter.Registry needs those to
+// actually connect): search's write path needs nothing but the id.
+func (s *Store) ListActiveTenantIDs(ctx context.Context) ([]string, error) {
+	rows, err := s.pool.Query(ctx, `SELECT id FROM tenants WHERE status = 'active'`)
+	if err != nil {
+		return nil, fmt.Errorf("rbacstore: listing active tenant ids: %w", err)
+	}
+	defer rows.Close()
+	var ids []string
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("rbacstore: scanning active tenant id: %w", err)
+		}
+		ids = append(ids, id)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("rbacstore: iterating active tenant ids: %w", err)
+	}
+	return ids, nil
+}
+
 // SetTenantStatus is the only way a tenant's status column changes --
 // every tenant-resolution path elsewhere must re-check this via
 // GetTenant, never cache/assume 'active', per

enterprise/internal/rbacstore/rbacstore_test.go

@@ -470,6 +470,41 @@ func createTestDashboard(t *testing.T, s *Store, tenantID, createdBy string) str
 	return id
 }
 
+func TestListActiveTenantIDsExcludesNonActive(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+
+	active := "test-tenant-" + uniqueSuffix()
+	provisioning := "test-tenant-" + uniqueSuffix()
+
+	for _, id := range []string{active, provisioning} {
+		if _, err := s.CreateTenant(ctx, id, id); err != nil {
+			t.Fatalf("CreateTenant %s: %v", id, err)
+		}
+	}
+	if err := s.SetTenantStatus(ctx, active, "active"); err != nil {
+		t.Fatalf("SetTenantStatus active: %v", err)
+	}
+	// provisioning stays in 'provisioning' (CreateTenant's default).
+
+	ids, err := s.ListActiveTenantIDs(ctx)
+	if err != nil {
+		t.Fatalf("ListActiveTenantIDs: %v", err)
+	}
+	foundActive := false
+	for _, id := range ids {
+		if id == provisioning {
+			t.Fatalf("non-active tenant %q leaked into ListActiveTenantIDs", provisioning)
+		}
+		if id == active {
+			foundActive = true
+		}
+	}
+	if !foundActive {
+		t.Fatal("expected the active tenant to be in the list")
+	}
+}
+
 func TestSetDashboardPermissionThenGet(t *testing.T) {
 	s := testStore(t)
 	ctx := context.Background()