jcoffey-dev
088677643f
search/src/consumer.rs's write-routing (built last pass) had no active- tenant check at all: IndexRegistry.resolve() would open-or-create an index directory for any syntactically-valid tenant_id, active or not -- unlike ClickHouse's chwriter.Registry (an active-tenants-only snapshot built at enterprise-ingest startup) or the read side (gated by searchclient.TenantChecker, a direct rbacstore query). search is AGPL core with no Postgres access and no enterprise/ import allowed, so it needed a network boundary instead -- the same shape ingest's TenantResolver already uses against enterprise-auth, just Rust calling Go instead of Go calling Go. New GET /internal/active-tenants endpoint on enterprise-auth (rbacstore.ListActiveTenantIDs + authhandler.handleActiveTenants), gated on a RoleService Bearer credential -- server-to-server auth, the same shape alerting presents to api, minted via the already-generic enterprise-auth -mint-service-token search. search/src/tenants.rs's ActiveTenantTracker polls it every 60s, blocking startup on the first fetch succeeding (fail-closed cold start -- a control-plane outage at boot must not silently accept every tenant_id) and keeping the last- known-good set on any later refresh failure (a transient blip shouldn't stop every tenant's indexing, only prevent the allowlist from growing/ shrinking until connectivity resumes). consumer.rs refuses any tagged record whose tenant isn't in the polled set, before ever calling resolve() -- IndexRegistry itself stays policy-free, matching the same mechanism/policy split clickhousewriter.Writer vs. chwriter.Registry already draws on the ClickHouse side. Off unless ENTERPRISE_AUTH_URL/ENTERPRISE_AUTH_SERVICE_TOKEN are both set (search/src/config.rs rejects exactly one being set) -- every existing deployment is unaffected. Verified with real HTTP round trips in this environment: tenants.rs's tests exercise real reqwest requests (actual Authorization: Bearer header, actual JSON parsing) against a hand-rolled dependency-free TCP test server, including both fail-closed paths (rejected first fetch, unreachable server). authhandler's new tests cover the credential-kind distinction this endpoint exists to enforce -- a real human session, even for a genuine Owner, must not satisfy a check meant for a service identity. One asymmetry remains, disclosed rather than fixed: chwriter.Registry's snapshot still never refreshes (stale until enterprise-ingest restarts), while ActiveTenantTracker's 60s poll gives Tantivy a materially tighter staleness window. Neither is a live per-write check -- that would mean a database/HTTP round trip per record, a throughput cost neither implementation accepts -- so both have some staleness window by design; the gap between the two windows is what's disclosed, not a claim either is fully live.
47 lines
1.5 KiB
TOML
47 lines
1.5 KiB
TOML
[package]
|
|
name = "sentry-search"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
license = "AGPL-3.0-only"
|
|
description = "Sentry Tantivy-backed full-text search service"
|
|
|
|
[[bin]]
|
|
name = "sentry-search"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
tokio = { version = "1", features = ["rt-multi-thread", "macros", "fs", "sync", "signal", "time"] }
|
|
tonic = "0.12"
|
|
prost = "0.13"
|
|
|
|
tantivy = "0.22"
|
|
rskafka = "0.6"
|
|
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# tenants.rs's only outbound HTTP call (GET enterprise-auth's
|
|
# /internal/active-tenants) -- default-features = false drops TLS
|
|
# support entirely, matching every other internal service-to-service
|
|
# call in this repo (plain HTTP, network placement is the trust
|
|
# boundary, not TLS -- see ingest/internal/grpcserver.
|
|
# HTTPTenantResolver's identical posture against the same service).
|
|
reqwest = { version = "0.12", default-features = false, features = ["json"] }
|
|
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
[build-dependencies]
|
|
tonic-build = "0.12"
|
|
|
|
[dev-dependencies]
|
|
# Already in the dependency graph transitively (tantivy/tonic-build both
|
|
# pull it in); promoted to a direct dev-dependency for test use.
|
|
tempfile = "3"
|
|
# tenants.rs's tests spin up a tiny real TCP server to exercise reqwest
|
|
# against, rather than pulling in a mocking crate -- needs tokio
|
|
# features the main binary doesn't (edition 2021's resolver keeps these
|
|
# out of the release build, test-only).
|
|
tokio = { version = "1", features = ["net", "io-util"] }
|