Provisioning: Fix overwrite SecureJSONData on provisioning (#72395)

* Overwrite SecureJSONData on provisioning

pkg/services/datasources/models.go

@@ -134,6 +134,7 @@ type UpdateDataSourceCommand struct {
 	ReadOnly                bool              `json:"-"`
 	EncryptedSecureJsonData map[string][]byte `json:"-"`
 	UpdateSecretFn          UpdateSecretFn    `json:"-"`
+	IgnoreOldSecureJsonData bool              `json:"-"`
 }
 
 // DeleteDataSourceCommand will delete a DataSource based on OrgID as well as the UID (preferred), ID, or Name.

pkg/services/datasources/service/datasource.go

@@ -644,11 +644,13 @@ func (s *Service) fillWithSecureJSONData(ctx context.Context, cmd *datasources.U
 		cmd.SecureJsonData = make(map[string]string)
 	}
 
+	if !cmd.IgnoreOldSecureJsonData {
 		for k, v := range decrypted {
 			if _, ok := cmd.SecureJsonData[k]; !ok {
 				cmd.SecureJsonData[k] = v
 			}
 		}
+	}
 
 	cmd.EncryptedSecureJsonData = make(map[string][]byte)
 	if !s.features.IsEnabled(featuremgmt.FlagDisableSecretsCompatibility) {

pkg/services/datasources/service/datasource_test.go

@@ -187,6 +187,96 @@ func TestService_UpdateDataSource(t *testing.T) {
 		_, err = dsService.UpdateDataSource(context.Background(), cmd)
 		require.ErrorIs(t, err, datasources.ErrDataSourceNameExists)
 	})
+
+	t.Run("should merge cmd.SecureJsonData with db data", func(t *testing.T) {
+		sqlStore := db.InitTestDB(t)
+		secretsService := secretsmng.SetupTestService(t, fakes.NewFakeSecretsStore())
+		secretsStore := secretskvs.NewSQLSecretsKVStore(sqlStore, secretsService, log.New("test.logger"))
+		quotaService := quotatest.New(false, nil)
+		mockPermission := acmock.NewMockedPermissionsService()
+		dsService, err := ProvideService(sqlStore, secretsService, secretsStore, cfg, featuremgmt.WithFeatures(), actest.FakeAccessControl{}, mockPermission, quotaService)
+		require.NoError(t, err)
+
+		mockPermission.On("SetPermissions", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return([]accesscontrol.ResourcePermission{}, nil)
+
+		expectedDbKey := "db-secure-key"
+		expectedDbValue := "db-secure-value"
+		ds, err := dsService.AddDataSource(context.Background(), &datasources.AddDataSourceCommand{
+			OrgID: 1,
+			Name:  "test-datasource",
+			SecureJsonData: map[string]string{
+				expectedDbKey: expectedDbValue,
+			},
+		})
+		require.NoError(t, err)
+
+		expectedOgKey := "cmd-secure-key"
+		expectedOgValue := "cmd-secure-value"
+
+		cmd := &datasources.UpdateDataSourceCommand{
+			ID:    ds.ID,
+			OrgID: ds.OrgID,
+			Name:  "test-datasource-updated",
+			SecureJsonData: map[string]string{
+				expectedOgKey: expectedOgValue,
+			},
+		}
+
+		ds, err = dsService.UpdateDataSource(context.Background(), cmd)
+		require.NoError(t, err)
+
+		secret, err := dsService.DecryptedValues(context.Background(), ds)
+		require.NoError(t, err)
+
+		assert.Equal(t, secret[expectedDbKey], expectedDbValue)
+		assert.Equal(t, secret[expectedOgKey], expectedOgValue)
+	})
+
+	t.Run("should preserve cmd.SecureJsonData when cmd.IgnoreOldSecureJsonData=true", func(t *testing.T) {
+		sqlStore := db.InitTestDB(t)
+		secretsService := secretsmng.SetupTestService(t, fakes.NewFakeSecretsStore())
+		secretsStore := secretskvs.NewSQLSecretsKVStore(sqlStore, secretsService, log.New("test.logger"))
+		quotaService := quotatest.New(false, nil)
+		mockPermission := acmock.NewMockedPermissionsService()
+		dsService, err := ProvideService(sqlStore, secretsService, secretsStore, cfg, featuremgmt.WithFeatures(), actest.FakeAccessControl{}, mockPermission, quotaService)
+		require.NoError(t, err)
+
+		mockPermission.On("SetPermissions", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return([]accesscontrol.ResourcePermission{}, nil)
+
+		notExpectedDbKey := "db-secure-key"
+		dbValue := "db-secure-value"
+		ds, err := dsService.AddDataSource(context.Background(), &datasources.AddDataSourceCommand{
+			OrgID: 1,
+			Name:  "test-datasource",
+			SecureJsonData: map[string]string{
+				notExpectedDbKey: dbValue,
+			},
+		})
+		require.NoError(t, err)
+
+		expectedOgKey := "cmd-secure-key"
+		expectedOgValue := "cmd-secure-value"
+
+		cmd := &datasources.UpdateDataSourceCommand{
+			ID:    ds.ID,
+			OrgID: ds.OrgID,
+			Name:  "test-datasource-updated",
+			SecureJsonData: map[string]string{
+				expectedOgKey: expectedOgValue,
+			},
+			IgnoreOldSecureJsonData: true,
+		}
+
+		ds, err = dsService.UpdateDataSource(context.Background(), cmd)
+		require.NoError(t, err)
+
+		secret, err := dsService.DecryptedValues(context.Background(), ds)
+		require.NoError(t, err)
+
+		assert.Equal(t, secret[expectedOgKey], expectedOgValue)
+		_, ok := secret[notExpectedDbKey]
+		assert.False(t, ok)
+	})
 }
 
 func TestService_NameScopeResolver(t *testing.T) {

pkg/services/provisioning/datasources/types.go

@@ -258,5 +258,6 @@ func createUpdateCommand(ds *upsertDataSourceFromConfig, id int64) *datasources.
 		JsonData:                jsonData,
 		SecureJsonData:          ds.SecureJSONData,
 		ReadOnly:                !ds.Editable,
+		IgnoreOldSecureJsonData: true,
 	}
 }