IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Encryption: Use secrets service (#40251)

Browse Source 
* Use secrets service in pluginproxy

* Use secrets service in pluginxontext

* Use secrets service in pluginsettings

* Use secrets service in provisioning

* Use secrets service in authinfoservice

* Use secrets service in api

* Use secrets service in sqlstore

* Use secrets service in dashboardshapshots

* Use secrets service in tsdb

* Use secrets service in datasources

* Use secrets service in alerting

* Use secrets service in ngalert

* Break cyclic dependancy

* Refactor service

* Break cyclic dependancy

* Add FakeSecretsStore

* Setup Secrets Service in sqlstore

* Fix

* Continue secrets service refactoring

* Fix cyclic dependancy in sqlstore tests

* Fix secrets service references

* Fix linter errors

* Add fake secrets service for tests

* Refactor SetupTestSecretsService

* Update setting up secret service in tests

* Fix missing secrets service in multiorg_alertmanager_test

* Use fake db in tests and sort imports

* Use fake db in datasources tests

* Fix more tests

* Fix linter issues

* Attempt to fix plugin proxy tests

* Pass secrets service to getPluginProxiedRequest in pluginproxy tests

* Fix pluginproxy tests

* Revert using secrets service in alerting and provisioning

* Update decryptFn in alerting migration

* Rename defaultProvider to currentProvider

* Use fake secrets service in alert channels tests

* Refactor secrets service test helper

* Update setting up secrets service in tests

* Revert alerting changes in api

* Add comments

* Remove secrets service from background services

* Convert global encryption functions into vars

* Revert "Convert global encryption functions into vars"

This reverts commit 498eb19859.

* Add feature toggle for envelope encryption

* Rename toggle

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
Co-authored-by: Joan López de la Franca Beltran <joanjan14@gmail.com>
This commit is contained in:
Tania B
2021-11-04 18:47:21 +02:00
committed by GitHub
parent 9e29484c80
commit 5652bde447
58 changed files with 441 additions and 364 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
pkg/api/pluginproxy/pluginproxy_test.go
View File

@@ -9,7 +9,9 @@ import (
"github.com/grafana/grafana/pkg/bus"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/plugins"
"github.com/grafana/grafana/pkg/services/encryption/ossencryption"
"github.com/grafana/grafana/pkg/services/secrets"
"github.com/grafana/grafana/pkg/services/secrets/fakes"
secretsManager "github.com/grafana/grafana/pkg/services/secrets/manager"
"github.com/grafana/grafana/pkg/setting"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@@ -17,6 +19,9 @@ import (
)
func TestPluginProxy(t *testing.T) {
setting.SecretKey = "password"
secretsService := secretsManager.SetupTestService(t, fakes.NewFakeSecretsStore())
t.Run("When getting proxy headers", func(t *testing.T) {
route := &plugins.Route{
Headers: []plugins.Header{
@@ -24,10 +29,8 @@ func TestPluginProxy(t *testing.T) {
},
}
setting.SecretKey = "password"
bus.AddHandlerCtx("test", func(ctx context.Context, query *models.GetPluginSettingByIdQuery) error {
key, err := ossencryption.ProvideService().Encrypt(ctx, []byte("123"), "password")
key, err := secretsService.Encrypt(ctx, []byte("123"), secrets.WithoutScope())
if err != nil {
return err
}
@@ -45,6 +48,7 @@ func TestPluginProxy(t *testing.T) {
req := getPluginProxiedRequest(
t,
secretsService,
&models.ReqContext{
SignedInUser: &models.SignedInUser{
Login: "test_user",
@@ -66,6 +70,7 @@ func TestPluginProxy(t *testing.T) {
req := getPluginProxiedRequest(
t,
secretsService,
&models.ReqContext{
SignedInUser: &models.SignedInUser{
Login: "test_user",
@@ -88,6 +93,7 @@ func TestPluginProxy(t *testing.T) {
req := getPluginProxiedRequest(
t,
secretsService,
&models.ReqContext{
SignedInUser: &models.SignedInUser{
Login: "test_user",
@@ -109,6 +115,7 @@ func TestPluginProxy(t *testing.T) {
req := getPluginProxiedRequest(
t,
secretsService,
&models.ReqContext{
SignedInUser: &models.SignedInUser{IsAnonymous: true},
Context: &macaron.Context{
@@ -143,6 +150,7 @@ func TestPluginProxy(t *testing.T) {
req := getPluginProxiedRequest(
t,
secretsService,
&models.ReqContext{
SignedInUser: &models.SignedInUser{
Login: "test_user",
@@ -174,6 +182,7 @@ func TestPluginProxy(t *testing.T) {
req := getPluginProxiedRequest(
t,
secretsService,
&models.ReqContext{
SignedInUser: &models.SignedInUser{
Login: "test_user",
@@ -196,10 +205,10 @@ func TestPluginProxy(t *testing.T) {
}
bus.AddHandlerCtx("test", func(ctx context.Context, query *models.GetPluginSettingByIdQuery) error {
encryptedJsonData, err := ossencryption.ProvideService().EncryptJsonData(
encryptedJsonData, err := secretsService.EncryptJsonData(
ctx,
map[string]string{"key": "123"},
setting.SecretKey,
secrets.WithoutScope(),
)
if err != nil {
@@ -220,6 +229,7 @@ func TestPluginProxy(t *testing.T) {
req := getPluginProxiedRequest(
t,
secretsService,
&models.ReqContext{
SignedInUser: &models.SignedInUser{
Login: "test_user",
@@ -238,7 +248,7 @@ func TestPluginProxy(t *testing.T) {
}
// getPluginProxiedRequest is a helper for easier setup of tests based on global config and ReqContext.
func getPluginProxiedRequest(t *testing.T, ctx *models.ReqContext, cfg *setting.Cfg, route *plugins.Route) *http.Request {
func getPluginProxiedRequest(t *testing.T, secretsService secrets.Service, ctx *models.ReqContext, cfg *setting.Cfg, route *plugins.Route) *http.Request {
// insert dummy route if none is specified
if route == nil {
route = &plugins.Route{
@@ -247,7 +257,7 @@ func getPluginProxiedRequest(t *testing.T, ctx *models.ReqContext, cfg *setting.
ReqRole: models.ROLE_EDITOR,
}
}
proxy := NewApiPluginProxy(ctx, "", route, "", cfg, ossencryption.ProvideService())
proxy := NewApiPluginProxy(ctx, "", route, "", cfg, secretsService)
req, err := http.NewRequest(http.MethodGet, "/api/plugin-proxy/grafana-simple-app/api/v4/alerts", nil)
require.NoError(t, err)