Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment
RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
This commit is contained in:
@@ -0,0 +1,17 @@
|
||||
CREATE TABLE IF NOT EXISTS audit_log
|
||||
(
|
||||
id BIGSERIAL PRIMARY KEY,
|
||||
tenant_id TEXT NOT NULL,
|
||||
user_id UUID,
|
||||
source TEXT NOT NULL CHECK (source IN ('api', 'web', 'cli', 'alerting')),
|
||||
event_type TEXT NOT NULL CHECK (event_type IN ('query', 'role_change', 'grant_change', 'sso_config_change', 'secret_reveal')),
|
||||
query_text TEXT,
|
||||
row_count INT,
|
||||
duration_ms INT,
|
||||
status TEXT NOT NULL CHECK (status IN ('success', 'error')),
|
||||
error_message TEXT,
|
||||
detail JSONB NOT NULL DEFAULT '{}',
|
||||
prev_hash TEXT,
|
||||
row_hash TEXT NOT NULL,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
)
|
||||
@@ -0,0 +1 @@
|
||||
CREATE INDEX IF NOT EXISTS audit_log_tenant_created_at_idx ON audit_log (tenant_id, created_at DESC)
|
||||
@@ -0,0 +1 @@
|
||||
CREATE ROLE audit_writer LOGIN PASSWORD :'audit_writer_password'
|
||||
@@ -0,0 +1 @@
|
||||
GRANT INSERT, SELECT ON audit_log TO audit_writer
|
||||
@@ -0,0 +1 @@
|
||||
GRANT USAGE ON SEQUENCE audit_log_id_seq TO audit_writer
|
||||
@@ -0,0 +1,5 @@
|
||||
CREATE OR REPLACE FUNCTION audit_log_deny_update_delete() RETURNS TRIGGER AS $$
|
||||
BEGIN
|
||||
RAISE EXCEPTION 'audit_log is append-only: % is not permitted', TG_OP;
|
||||
END
|
||||
$$ LANGUAGE plpgsql
|
||||
@@ -0,0 +1,3 @@
|
||||
CREATE TRIGGER audit_log_immutable
|
||||
BEFORE UPDATE OR DELETE ON audit_log
|
||||
FOR EACH ROW EXECUTE FUNCTION audit_log_deny_update_delete()
|
||||
@@ -0,0 +1,13 @@
|
||||
CREATE TABLE IF NOT EXISTS users
|
||||
(
|
||||
id UUID PRIMARY KEY,
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
display_name TEXT NOT NULL DEFAULT '',
|
||||
-- Set on first successful SSO login (OIDC "sub" or SAML NameID) --
|
||||
-- nullable because a user row can exist before their first login in
|
||||
-- principle (e.g. pre-provisioned by an Admin), though Phase 4's
|
||||
-- baseline flow always creates the row and the SSO subject together.
|
||||
sso_subject TEXT,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
)
|
||||
@@ -0,0 +1,17 @@
|
||||
CREATE TABLE IF NOT EXISTS tenants
|
||||
(
|
||||
id TEXT PRIMARY KEY,
|
||||
display_name TEXT NOT NULL,
|
||||
-- Provisioning state machine from /docs/phase-4-isolation-design.md:
|
||||
-- every tenant-resolution path must refuse to serve a tenant not in
|
||||
-- 'active' state, checked server-side against this column.
|
||||
status TEXT NOT NULL DEFAULT 'provisioning'
|
||||
CHECK (status IN ('provisioning', 'active', 'suspended', 'deprovisioning')),
|
||||
clickhouse_database_name TEXT,
|
||||
tantivy_index_path TEXT,
|
||||
-- Nullable until the first Owner exists -- a tenant can be created
|
||||
-- (provisioning) before any user has logged in to claim ownership.
|
||||
owner_user_id UUID REFERENCES users(id),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
)
|
||||
@@ -0,0 +1,8 @@
|
||||
-- Every Phase 0-3 row (dashboards, alert_rules, notification_targets --
|
||||
-- see their tenant_id DEFAULT 'default' columns) belongs to this tenant.
|
||||
-- Marked 'active' immediately: this data already exists and is already
|
||||
-- being served, unlike a genuinely new tenant that must pass through
|
||||
-- provisioning first.
|
||||
INSERT INTO tenants (id, display_name, status)
|
||||
VALUES ('default', 'Default', 'active')
|
||||
ON CONFLICT (id) DO NOTHING
|
||||
@@ -0,0 +1,14 @@
|
||||
-- A user's role is per-tenant, not global -- see
|
||||
-- /docs/phase-4-rbac-design.md's role matrix (Viewer/Editor/Admin/Owner).
|
||||
-- One row per (tenant, user); a user with no row for a tenant has no
|
||||
-- access to it at all (default-deny, not default-viewer).
|
||||
CREATE TABLE IF NOT EXISTS tenant_memberships
|
||||
(
|
||||
id UUID PRIMARY KEY,
|
||||
tenant_id TEXT NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
|
||||
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
role TEXT NOT NULL CHECK (role IN ('viewer', 'editor', 'admin', 'owner')),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
UNIQUE (tenant_id, user_id)
|
||||
)
|
||||
@@ -0,0 +1,4 @@
|
||||
-- Supports "which tenants does this user belong to" (session/authorize
|
||||
-- lookups), the reverse direction from the UNIQUE(tenant_id, user_id)
|
||||
-- constraint's own index.
|
||||
CREATE INDEX IF NOT EXISTS idx_tenant_memberships_user_id ON tenant_memberships (user_id)
|
||||
@@ -0,0 +1,18 @@
|
||||
-- Correction to a Phase 3 gap found during Phase 4 planning: alert_state
|
||||
-- never got a tenant_id column, unlike alert_rules/dashboards/
|
||||
-- notification_targets. Backfilled via a join through alert_rules.id
|
||||
-- (its owning rule's tenant), not blindly defaulted, even though in
|
||||
-- practice every pre-Phase-4 row's rule already belongs to 'default'.
|
||||
-- Bundled as one migration (add nullable -> backfill -> enforce NOT
|
||||
-- NULL) since it's one logical schema change, same shape as
|
||||
-- /storage/migrations/0002_add_record_id.sql bundling an ADD COLUMN
|
||||
-- with its index in one file.
|
||||
ALTER TABLE alert_state ADD COLUMN IF NOT EXISTS tenant_id TEXT;
|
||||
|
||||
UPDATE alert_state
|
||||
SET tenant_id = alert_rules.tenant_id
|
||||
FROM alert_rules
|
||||
WHERE alert_state.rule_id = alert_rules.id
|
||||
AND alert_state.tenant_id IS NULL;
|
||||
|
||||
ALTER TABLE alert_state ALTER COLUMN tenant_id SET NOT NULL
|
||||
@@ -0,0 +1,10 @@
|
||||
-- Same gap and same fix as 0022, for delivery_log.
|
||||
ALTER TABLE delivery_log ADD COLUMN IF NOT EXISTS tenant_id TEXT;
|
||||
|
||||
UPDATE delivery_log
|
||||
SET tenant_id = alert_rules.tenant_id
|
||||
FROM alert_rules
|
||||
WHERE delivery_log.rule_id = alert_rules.id
|
||||
AND delivery_log.tenant_id IS NULL;
|
||||
|
||||
ALTER TABLE delivery_log ALTER COLUMN tenant_id SET NOT NULL
|
||||
@@ -0,0 +1,14 @@
|
||||
-- Additive-only per-resource grant: lets a specific user exceed their
|
||||
-- tenant-baseline role on one dashboard (e.g. an Editor granted Admin on
|
||||
-- a dashboard they don't own). No deny-overrides -- named non-goal in
|
||||
-- /docs/phase-4-rbac-design.md and CLAUDE.md's Phase 4 exit criteria.
|
||||
CREATE TABLE IF NOT EXISTS dashboard_permissions
|
||||
(
|
||||
id UUID PRIMARY KEY,
|
||||
dashboard_id UUID NOT NULL REFERENCES dashboards(id) ON DELETE CASCADE,
|
||||
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
role TEXT NOT NULL CHECK (role IN ('viewer', 'editor', 'admin')),
|
||||
granted_by UUID REFERENCES users(id),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
UNIQUE (dashboard_id, user_id)
|
||||
)
|
||||
@@ -0,0 +1,14 @@
|
||||
-- Extension point named in /docs/phase-4-rbac-design.md: one row
|
||||
-- per-tenant today (each tenant has exactly one ClickHouse database +
|
||||
-- one Tantivy index), not pretending multiple sources per tenant exist
|
||||
-- yet -- that's real future work, this table just leaves room for it.
|
||||
CREATE TABLE IF NOT EXISTS data_sources
|
||||
(
|
||||
id UUID PRIMARY KEY,
|
||||
tenant_id TEXT NOT NULL REFERENCES tenants(id),
|
||||
name TEXT NOT NULL,
|
||||
clickhouse_database_name TEXT NOT NULL,
|
||||
tantivy_index_path TEXT NOT NULL,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
UNIQUE (tenant_id, name)
|
||||
)
|
||||
@@ -0,0 +1,7 @@
|
||||
-- The 'default' tenant's single data source, pointing at the one
|
||||
-- ClickHouse database ("sentry") and Tantivy index every Phase 0-3
|
||||
-- deployment already uses -- see api/internal/config's CLICKHOUSE_DATABASE
|
||||
-- default and search's index path default.
|
||||
INSERT INTO data_sources (id, tenant_id, name, clickhouse_database_name, tantivy_index_path)
|
||||
SELECT '00000000-0000-0000-0000-000000000001', 'default', 'default', 'sentry', '/var/lib/sentry-search'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM data_sources WHERE tenant_id = 'default')
|
||||
@@ -0,0 +1 @@
|
||||
ALTER TABLE dashboards ADD CONSTRAINT fk_dashboards_tenant FOREIGN KEY (tenant_id) REFERENCES tenants(id)
|
||||
@@ -0,0 +1 @@
|
||||
ALTER TABLE alert_rules ADD CONSTRAINT fk_alert_rules_tenant FOREIGN KEY (tenant_id) REFERENCES tenants(id)
|
||||
@@ -0,0 +1 @@
|
||||
ALTER TABLE notification_targets ADD CONSTRAINT fk_notification_targets_tenant FOREIGN KEY (tenant_id) REFERENCES tenants(id)
|
||||
@@ -0,0 +1 @@
|
||||
ALTER TABLE alert_state ADD CONSTRAINT fk_alert_state_tenant FOREIGN KEY (tenant_id) REFERENCES tenants(id)
|
||||
@@ -0,0 +1 @@
|
||||
ALTER TABLE delivery_log ADD CONSTRAINT fk_delivery_log_tenant FOREIGN KEY (tenant_id) REFERENCES tenants(id)
|
||||
Reference in New Issue
Block a user