IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Chore: Remove public vars in setting package (#81018)

Browse Source 
Removes the public variable setting.SecretKey plus some other ones. 
Introduces some new functions for creating setting.Cfg.
This commit is contained in:
Marcus Efraimsson
2024-01-23 12:36:22 +01:00
committed by GitHub
parent 147bf01745
commit 6768c6c059
131 changed files with 759 additions and 699 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cmd/grafana-cli/commands/commands.go
+3 -2
View File
@@ -30,7 +30,7 @@ func runRunnerCommand(command func(commandLine utils.CommandLine, runner server.
}
}
func runDbCommand(command func(commandLine utils.CommandLine, sqlStore db.DB) error) func(context *cli.Context) error {
func runDbCommand(command func(commandLine utils.CommandLine, cfg *setting.Cfg, sqlStore db.DB) error) func(context *cli.Context) error {
return func(context *cli.Context) error {
cmd := &utils.ContextCommandLine{Context: context}
runner, err := initializeRunner(cmd)
@@ -38,8 +38,9 @@ func runDbCommand(command func(commandLine utils.CommandLine, sqlStore db.DB) er
return fmt.Errorf("%v: %w", "failed to initialize runner", err)
}
cfg := runner.Cfg
sqlStore := runner.SQLStore
if err := command(cmd, sqlStore); err != nil {
if err := command(cmd, cfg, sqlStore); err != nil {
return err
}
pkg/cmd/grafana-cli/commands/datamigrations/encrypt_datasource_passwords.go
+9 -9
View File
@@ -27,14 +27,14 @@ var (
// EncryptDatasourcePasswords migrates unencrypted secrets on datasources
// to the secureJson Column.
func EncryptDatasourcePasswords(c utils.CommandLine, sqlStore db.DB) error {
func EncryptDatasourcePasswords(c utils.CommandLine, cfg *setting.Cfg, sqlStore db.DB) error {
return sqlStore.WithDbSession(context.Background(), func(session *db.Session) error {
passwordsUpdated, err := migrateColumn(session, "password")
passwordsUpdated, err := migrateColumn(cfg, session, "password")
if err != nil {
return err
}
basicAuthUpdated, err := migrateColumn(session, "basic_auth_password")
basicAuthUpdated, err := migrateColumn(cfg, session, "basic_auth_password")
if err != nil {
return err
}
@@ -61,7 +61,7 @@ func EncryptDatasourcePasswords(c utils.CommandLine, sqlStore db.DB) error {
})
}
func migrateColumn(session *db.Session, column string) (int, error) {
func migrateColumn(cfg *setting.Cfg, session *db.Session, column string) (int, error) {
var rows []map[string][]byte
session.Cols("id", column, "secure_json_data")
@@ -74,18 +74,18 @@ func migrateColumn(session *db.Session, column string) (int, error) {
return 0, fmt.Errorf("failed to select column: %s: %w", column, err)
}
rowsUpdated, err := updateRows(session, rows, column)
rowsUpdated, err := updateRows(cfg, session, rows, column)
if err != nil {
return rowsUpdated, fmt.Errorf("failed to update column: %s: %w", column, err)
}
return rowsUpdated, err
}
func updateRows(session *db.Session, rows []map[string][]byte, passwordFieldName string) (int, error) {
func updateRows(cfg *setting.Cfg, session *db.Session, rows []map[string][]byte, passwordFieldName string) (int, error) {
var rowsUpdated int
for _, row := range rows {
newSecureJSONData, err := getUpdatedSecureJSONData(row, passwordFieldName)
newSecureJSONData, err := getUpdatedSecureJSONData(cfg.SecretKey, row, passwordFieldName)
if err != nil {
return 0, err
}
@@ -111,8 +111,8 @@ func updateRows(session *db.Session, rows []map[string][]byte, passwordFieldName
return rowsUpdated, nil
}
func getUpdatedSecureJSONData(row map[string][]byte, passwordFieldName string) (map[string]any, error) {
encryptedPassword, err := util.Encrypt(row[passwordFieldName], setting.SecretKey)
func getUpdatedSecureJSONData(secretKey string, row map[string][]byte, passwordFieldName string) (map[string]any, error) {
encryptedPassword, err := util.Encrypt(row[passwordFieldName], secretKey)
if err != nil {
return nil, err
}
pkg/cmd/grafana-cli/commands/datamigrations/encrypt_datasource_passwords_test.go
+8 -5
View File
@@ -38,8 +38,10 @@ func passwordMigration(t *testing.T, session *db.Session, sqlstore db.DB) {
ds.Created = time.Now()
ds.Updated = time.Now()
cfg := setting.NewCfg()
if ds.Name == "elasticsearch" {
key, err := util.Encrypt([]byte("value"), setting.SecretKey)
key, err := util.Encrypt([]byte("value"), cfg.SecretKey)
require.NoError(t, err)
ds.SecureJsonData = map[string][]byte{"key": key}
@@ -58,7 +60,7 @@ func passwordMigration(t *testing.T, session *db.Session, sqlstore db.DB) {
// run migration
c, err := commandstest.NewCliContext(map[string]string{})
require.Nil(t, err)
err = EncryptDatasourcePasswords(c, sqlstore)
err = EncryptDatasourcePasswords(c, setting.NewCfg(), sqlstore)
require.NoError(t, err)
// verify that no datasources still have password or basic_auth
@@ -68,7 +70,8 @@ func passwordMigration(t *testing.T, session *db.Session, sqlstore db.DB) {
assert.Equal(t, len(dss), 4)
for _, ds := range dss {
sj, err := DecryptSecureJsonData(ds)
cfg := setting.NewCfg()
sj, err := DecryptSecureJsonData(cfg.SecretKey, ds)
require.NoError(t, err)
if ds.Name == "influxdb" {
@@ -101,10 +104,10 @@ func passwordMigration(t *testing.T, session *db.Session, sqlstore db.DB) {
}
}
func DecryptSecureJsonData(ds *datasources.DataSource) (map[string]string, error) {
func DecryptSecureJsonData(secretKey string, ds *datasources.DataSource) (map[string]string, error) {
decrypted := make(map[string]string)
for key, data := range ds.SecureJsonData {
decryptedData, err := util.Decrypt(data, setting.SecretKey)
decryptedData, err := util.Decrypt(data, secretKey)
if err != nil {
return nil, err
}