2 Commits

Include renames

Author	SHA1	Message	Date
jcoffey-dev	4b5dae5879	Add local login, agent extra log paths, IPv4/IPv6 metrics; remediate security audit findings ... This is a large squashed commit covering two batches of prior uncommitted work plus a full security-audit remediation pass, kept together because go.mod/go.sum and several shared files (main.go, handler.go) were touched by both and splitting risked non-building intermediate commits. Features (built earlier, previously uncommitted): - Local username/password login for single-tenant deployments with no SSO configured (api/localauth, alerting/internal/sessioncheck, sentryctl users, web/src/routes/login, metadata migrations 0040/0041). - Remotely-editable additional log file paths for agents, on top of their existing primary source (api/agents, agent/sentry-agent extra-file-path diffing, web agent config UI). - IPv4/IPv6 addresses reported alongside other host system metrics. Security audit remediation (this pass, all live-verified in production): - Critical: block ClickHouse SSRF table functions (url/remote/file/s3/...) in the raw-SQL query escape hatch. - High: deny sensitive paths and require Admin to add agent extra_file_paths (Editor could previously point an agent at /etc/shadow or an SSH key); alerting webhook targets now validate against internal/metadata/loopback addresses, both at creation and send time; alerting's session middleware now enforces an Editor+ floor on mutating requests instead of "any authenticated session"; bumped goxmldsig to close a SAML signature-verification bypass (GO-2026-4753). - Medium: per-IP login rate limiting; security response headers (HSTS/CSP/nosniff/X-Frame-Options/Referrer-Policy/Permissions-Policy) on web/nginx.conf; a DevCredentialWarnings check in every Go service's config loader, logging loudly at startup if a deployment is still on docker-compose.yml's literal dev-only credentials; dependency bumps (golang.org/x/text, grpc, x/net, quick-xml, h2) across every affected Go module and both Rust crates, including a previously-uncovered x/net vulnerability in deploy/operator; a new security-scan.yml CI workflow running cargo-deny/govulncheck/npm-audit, mirroring the existing license-compliance.yml matrix shape. - Low: removed sentryctl's plaintext --password flag (shell history/`ps` exposure) in favor of stdin and a --password-stdin flag for reset-password's optional specific-password path; a dummy bcrypt comparison closes a login response-time username-enumeration side-channel.	2026-08-18 23:53:20 -07:00
jcoffey-dev	49dd050689	Start the Terraform provider: sentry_dashboard, the first resource ... CLAUDE.md names the Terraform provider a first-class deliverable alongside sentryctl ("CLI and Terraform provider are first-class, not afterthoughts"), but no phase before this one had actually built any of it -- no terraform/ directory existed. This is a first slice, not a finished provider: one resource, scoped and confirmed with the project owner before starting (a new pinned external dependency and an architectural decision not covered in /docs/architecture.md are both things CLAUDE.md's own "When in doubt" section says to ask about). New Go module (terraform/, github.com/sentry/sentry/terraform) built on HashiCorp's terraform-plugin-framework -- the actively-developed library, not the legacy SDKv2, since there's no existing provider code to migrate and no reason to start new on the framework HashiCorp itself steers people away from. internal/provider/client.go talks the exact same JSON contract sentryctl's "dashboards apply" and web's Export JSON button already use against api/dashboards.Handler (POST/GET/PUT/DELETE /dashboards[/{id}]) -- cli/README.md already named this "the seed of a future Terraform provider: one JSON contract, multiple callers," this is that third caller, not a new contract invented for Terraform's sake. sentry_dashboard's schema deliberately leaves default_earliest/ default_latest Optional+Computed with no Terraform-side static default, even though the API defaults them to "-1h"/"now" when empty -- letting the API stay the one source of truth for what "unset" means rather than duplicating that default in two places that could drift. tenant_id is Computed-only, matching api/dashboards.Handler's own tenantID() doc comment that a client-supplied value is always overridden server-side. Panels are not modeled by this resource -- a genuinely separate resource shape (own lifecycle, own endpoints, own validation needs), scoped out deliberately, not an oversight. Alert rules, notification targets, and tenant/RBAC resources are the same: real, disclosed future work, not attempted in this pass. See terraform/README.md for the full accounting. Verified: client_test.go runs real HTTP round trips against httptest. Server (request construction, response parsing, the 404-vs-other-error distinction Read/Delete need for Terraform's out-of-band-deletion convention) -- same pattern cli/cmd/sentryctl's own tests already use against the same api/dashboards endpoints. provider_test.go validates both schemas are internally well-formed without needing a Terraform binary. dashboard_resource_test.go's TestAccDashboardResource_basic is a real acceptance test (terraform-plugin-testing), skip-gated by TF_ACC=1 per that framework's own convention -- even with TF_ACC set it would still need a live api service (Postgres+ClickHouse) to apply against, which this environment has no Docker access to bring up, so it has not actually run here, same disclosed gap as every other live-infra test in this repo.	2026-08-15 00:06:26 -07:00