diff --git a/pkg/registry/apis/secret/contracts/mutator.go b/pkg/registry/apis/secret/contracts/mutator.go new file mode 100644 index 00000000000..110b0d90ba9 --- /dev/null +++ b/pkg/registry/apis/secret/contracts/mutator.go @@ -0,0 +1,14 @@ +package contracts + +import ( + secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" + "k8s.io/apiserver/pkg/admission" +) + +type SecureValueMutator interface { + Mutate(sv *secretv1beta1.SecureValue, operation admission.Operation) error +} + +type KeeperMutator interface { + Mutate(kp *secretv1beta1.Keeper, operation admission.Operation) error +} diff --git a/pkg/registry/apis/secret/contracts/validator.go b/pkg/registry/apis/secret/contracts/validator.go index a0f326ab268..0e68cc874eb 100644 --- a/pkg/registry/apis/secret/contracts/validator.go +++ b/pkg/registry/apis/secret/contracts/validator.go @@ -5,6 +5,7 @@ import ( "k8s.io/apiserver/pkg/admission" secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" + "github.com/grafana/grafana/pkg/registry/apis/secret/xkube" ) type SecureValueValidator interface { @@ -14,3 +15,21 @@ type SecureValueValidator interface { type KeeperValidator interface { Validate(keeper *secretv1beta1.Keeper, oldKeeper *secretv1beta1.Keeper, operation admission.Operation) field.ErrorList } + +type ErrValidateSecureValue struct { + list field.ErrorList +} + +var _ xkube.ErrorLister = (*ErrValidateSecureValue)(nil) + +func NewErrValidateSecureValue(list field.ErrorList) *ErrValidateSecureValue { + return &ErrValidateSecureValue{list: list} +} + +func (e *ErrValidateSecureValue) Error() string { + return e.list.ToAggregate().Error() +} + +func (e *ErrValidateSecureValue) ErrorList() field.ErrorList { + return e.list +} diff --git a/pkg/registry/apis/secret/inline/inline_secure_value.go b/pkg/registry/apis/secret/inline/inline_secure_value.go index 4e675486f48..08ce9f3068b 100644 --- a/pkg/registry/apis/secret/inline/inline_secure_value.go +++ b/pkg/registry/apis/secret/inline/inline_secure_value.go @@ -17,7 +17,6 @@ import ( "github.com/grafana/grafana/pkg/apimachinery/utils" "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" "github.com/grafana/grafana/pkg/registry/apis/secret/xkube" - "github.com/grafana/grafana/pkg/util" ) type LocalInlineSecureValueService struct { @@ -209,8 +208,7 @@ func (s *LocalInlineSecureValueService) CreateInline(ctx context.Context, owner obj := &secretv1beta1.SecureValue{ ObjectMeta: metav1.ObjectMeta{ - //GenerateName: "inline-", - Name: "inline-" + util.GenerateShortUID(), + GenerateName: "inline-", Namespace: owner.Namespace, OwnerReferences: []metav1.OwnerReference{owner.ToOwnerReference()}, }, @@ -223,7 +221,7 @@ func (s *LocalInlineSecureValueService) CreateInline(ctx context.Context, owner createdSv, err := s.secureValueService.Create(ctx, obj, authInfo.GetUID()) if err != nil { - return "", fmt.Errorf("error creating secure value %s for owner %v: %w", obj.Name, owner, err) + return "", fmt.Errorf("error creating secure value for owner %v: %w", owner, err) } return createdSv.GetName(), nil diff --git a/pkg/registry/apis/secret/mutator/keeper.go b/pkg/registry/apis/secret/mutator/keeper.go new file mode 100644 index 00000000000..87ff7e9ea6a --- /dev/null +++ b/pkg/registry/apis/secret/mutator/keeper.go @@ -0,0 +1,31 @@ +package mutator + +import ( + "cmp" + "fmt" + + secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" + "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" + "github.com/grafana/grafana/pkg/util" + "k8s.io/apiserver/pkg/admission" +) + +type keeperMutator struct{} + +var _ contracts.KeeperMutator = &keeperMutator{} + +func ProvideKeeperMutator() contracts.KeeperMutator { + return &keeperMutator{} +} + +func (*keeperMutator) Mutate(kp *secretv1beta1.Keeper, operation admission.Operation) error { + if kp == nil { + return fmt.Errorf("expected Keeper to be non-nil") + } + + if operation == admission.Create && kp.Name == "" { + kp.SetName(cmp.Or(kp.GetGenerateName(), "kp-") + util.GenerateShortUID()) + } + + return nil +} diff --git a/pkg/registry/apis/secret/mutator/keeper_test.go b/pkg/registry/apis/secret/mutator/keeper_test.go new file mode 100644 index 00000000000..643dfc93795 --- /dev/null +++ b/pkg/registry/apis/secret/mutator/keeper_test.go @@ -0,0 +1,71 @@ +package mutator + +import ( + "strings" + "testing" + + "github.com/stretchr/testify/require" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apiserver/pkg/admission" + + secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" +) + +func TestKeeperMutator(t *testing.T) { + mutator := ProvideKeeperMutator() + + t.Run("when keeper is nil, it returns an error", func(t *testing.T) { + err := mutator.Mutate(nil, admission.Create) + require.Error(t, err) + require.Equal(t, "expected Keeper to be non-nil", err.Error()) + }) + + t.Run("when operation is Create and name is empty without GenerateName", func(t *testing.T) { + keeper := &secretv1beta1.Keeper{} + + err := mutator.Mutate(keeper, admission.Create) + require.NoError(t, err) + require.NotEmpty(t, keeper.Name) + require.True(t, strings.HasPrefix(keeper.Name, "kp-")) + }) + + t.Run("when operation is Create and name is already set", func(t *testing.T) { + keeper := &secretv1beta1.Keeper{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + }, + } + originalName := keeper.Name + + err := mutator.Mutate(keeper, admission.Create) + require.NoError(t, err) + require.Equal(t, originalName, keeper.Name) + }) + + t.Run("when operation is Create and GenerateName is set", func(t *testing.T) { + keeper := &secretv1beta1.Keeper{ + ObjectMeta: metav1.ObjectMeta{ + GenerateName: "custom-prefix-", + }, + } + + err := mutator.Mutate(keeper, admission.Create) + require.NoError(t, err) + require.NotEmpty(t, keeper.Name) + require.True(t, strings.HasPrefix(keeper.Name, "custom-prefix-")) + }) + + t.Run("when operation is Create and both name and GenerateName are set", func(t *testing.T) { + keeper := &secretv1beta1.Keeper{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + GenerateName: "custom-prefix-", + }, + } + originalName := keeper.Name + + err := mutator.Mutate(keeper, admission.Create) + require.NoError(t, err) + require.Equal(t, originalName, keeper.Name) + }) +} diff --git a/pkg/registry/apis/secret/mutator/secure_value.go b/pkg/registry/apis/secret/mutator/secure_value.go new file mode 100644 index 00000000000..a8033127be8 --- /dev/null +++ b/pkg/registry/apis/secret/mutator/secure_value.go @@ -0,0 +1,37 @@ +package mutator + +import ( + "cmp" + "fmt" + + secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" + "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" + "github.com/grafana/grafana/pkg/util" + "k8s.io/apiserver/pkg/admission" +) + +type secureValueMutator struct{} + +var _ contracts.SecureValueMutator = &secureValueMutator{} + +func ProvideSecureValueMutator() contracts.SecureValueMutator { + return &secureValueMutator{} +} + +func (*secureValueMutator) Mutate(sv *secretv1beta1.SecureValue, operation admission.Operation) error { + if sv == nil { + return fmt.Errorf("expected SecureValue to be non-nil") + } + + if operation == admission.Create && sv.Name == "" { + sv.SetName(cmp.Or(sv.GetGenerateName(), "sv-") + util.GenerateShortUID()) + } + + // On any mutation to a `SecureValue`, clear the status. + if operation == admission.Create || operation == admission.Update { + sv.Status.ExternalID = "" + sv.Status.Version = 0 + } + + return nil +} diff --git a/pkg/registry/apis/secret/mutator/secure_value_test.go b/pkg/registry/apis/secret/mutator/secure_value_test.go new file mode 100644 index 00000000000..55a94ddf68a --- /dev/null +++ b/pkg/registry/apis/secret/mutator/secure_value_test.go @@ -0,0 +1,179 @@ +package mutator + +import ( + "strings" + "testing" + + "github.com/stretchr/testify/require" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apiserver/pkg/admission" + + secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" +) + +func TestSecureValueMutator(t *testing.T) { + mutator := ProvideSecureValueMutator() + + populatedStatus := secretv1beta1.SecureValueStatus{ + ExternalID: "existing-external-id", + Version: 1, + } + + t.Run("when secure value is nil, it returns an error", func(t *testing.T) { + err := mutator.Mutate(nil, admission.Create) + require.Error(t, err) + require.Equal(t, "expected SecureValue to be non-nil", err.Error()) + }) + + t.Run("when operation is Create and name is empty", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + Status: populatedStatus, + } + + err := mutator.Mutate(secureValue, admission.Create) + require.NoError(t, err) + require.NotEmpty(t, secureValue.Name) + require.True(t, strings.HasPrefix(secureValue.Name, "sv-")) + require.Empty(t, secureValue.Status.ExternalID) + require.Equal(t, int64(0), secureValue.Status.Version) + }) + + t.Run("when operation is Create and name is already set", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + }, + Status: populatedStatus, + } + originalName := secureValue.Name + + err := mutator.Mutate(secureValue, admission.Create) + require.NoError(t, err) + require.Equal(t, originalName, secureValue.Name) + require.Empty(t, secureValue.Status.ExternalID) + require.Equal(t, int64(0), secureValue.Status.Version) + }) + + t.Run("when operation is Create and GenerateName is set", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + ObjectMeta: metav1.ObjectMeta{ + GenerateName: "custom-prefix-", + }, + Status: populatedStatus, + } + + err := mutator.Mutate(secureValue, admission.Create) + require.NoError(t, err) + require.NotEmpty(t, secureValue.Name) + require.True(t, strings.HasPrefix(secureValue.Name, "custom-prefix-")) + require.Empty(t, secureValue.Status.ExternalID) + require.Equal(t, int64(0), secureValue.Status.Version) + }) + + t.Run("when operation is Create and both name and GenerateName are set", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + GenerateName: "custom-prefix-", + }, + Status: populatedStatus, + } + originalName := secureValue.Name + + err := mutator.Mutate(secureValue, admission.Create) + require.NoError(t, err) + require.Equal(t, originalName, secureValue.Name) + require.Empty(t, secureValue.Status.ExternalID) + require.Equal(t, int64(0), secureValue.Status.Version) + }) + + t.Run("when operation is Update", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + }, + Status: populatedStatus, + } + originalName := secureValue.Name + + err := mutator.Mutate(secureValue, admission.Update) + require.NoError(t, err) + require.Equal(t, originalName, secureValue.Name) + require.Empty(t, secureValue.Status.ExternalID) + require.Equal(t, int64(0), secureValue.Status.Version) + }) + + t.Run("when operation is Update and name is empty", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + Status: populatedStatus, + } + + err := mutator.Mutate(secureValue, admission.Update) + require.NoError(t, err) + require.Empty(t, secureValue.Name) + require.Empty(t, secureValue.Status.ExternalID) + require.Equal(t, int64(0), secureValue.Status.Version) + }) + + t.Run("when operation is Delete", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + }, + Status: populatedStatus, + } + originalName := secureValue.Name + originalExternalID := secureValue.Status.ExternalID + originalVersion := secureValue.Status.Version + + err := mutator.Mutate(secureValue, admission.Delete) + require.NoError(t, err) + require.Equal(t, originalName, secureValue.Name) + require.Equal(t, originalExternalID, secureValue.Status.ExternalID) + require.Equal(t, originalVersion, secureValue.Status.Version) + }) + + t.Run("when operation is Connect", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + }, + Status: populatedStatus, + } + originalName := secureValue.Name + originalExternalID := secureValue.Status.ExternalID + originalVersion := secureValue.Status.Version + + err := mutator.Mutate(secureValue, admission.Connect) + require.NoError(t, err) + require.Equal(t, originalName, secureValue.Name) + require.Equal(t, originalExternalID, secureValue.Status.ExternalID) + require.Equal(t, originalVersion, secureValue.Status.Version) + }) + + t.Run("when operation is Create with empty status", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + }, + } + + err := mutator.Mutate(secureValue, admission.Create) + require.NoError(t, err) + require.Empty(t, secureValue.Status.ExternalID) + require.Equal(t, int64(0), secureValue.Status.Version) + }) + + t.Run("when operation is Update with empty status", func(t *testing.T) { + secureValue := &secretv1beta1.SecureValue{ + ObjectMeta: metav1.ObjectMeta{ + Name: "existing-name", + }, + } + + err := mutator.Mutate(secureValue, admission.Update) + require.NoError(t, err) + require.Empty(t, secureValue.Status.ExternalID) + require.Equal(t, int64(0), secureValue.Status.Version) + }) +} diff --git a/pkg/registry/apis/secret/service/consolidation_test.go b/pkg/registry/apis/secret/service/consolidation_test.go index 57ac94253c9..638ced19a81 100644 --- a/pkg/registry/apis/secret/service/consolidation_test.go +++ b/pkg/registry/apis/secret/service/consolidation_test.go @@ -81,8 +81,9 @@ func TestConsolidation(t *testing.T) { Namespace: tc.namespace, }, Spec: secretv1beta1.SecureValueSpec{ - Value: ptr.To(secretv1beta1.NewExposedSecureValue(tc.value)), - Decrypters: []string{"decrypter1"}, + Description: "test description", + Value: ptr.To(secretv1beta1.NewExposedSecureValue(tc.value)), + Decrypters: []string{"decrypter1"}, }, } @@ -158,8 +159,9 @@ func TestConsolidation(t *testing.T) { Namespace: tc.namespace, }, Spec: secretv1beta1.SecureValueSpec{ - Value: ptr.To(secretv1beta1.NewExposedSecureValue(tc.value)), - Decrypters: []string{"decrypter1"}, + Description: "test description", + Value: ptr.To(secretv1beta1.NewExposedSecureValue(tc.value)), + Decrypters: []string{"decrypter1"}, }, } diff --git a/pkg/registry/apis/secret/service/secure_value.go b/pkg/registry/apis/secret/service/secure_value.go index fe32208562d..f8b1f91d727 100644 --- a/pkg/registry/apis/secret/service/secure_value.go +++ b/pkg/registry/apis/secret/service/secure_value.go @@ -9,6 +9,7 @@ import ( claims "github.com/grafana/authlib/types" "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/trace" + "k8s.io/apiserver/pkg/admission" "github.com/grafana/grafana-app-sdk/logging" secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" @@ -27,6 +28,8 @@ type SecureValueService struct { accessClient claims.AccessClient database contracts.Database secureValueMetadataStorage contracts.SecureValueMetadataStorage + secureValueValidator contracts.SecureValueValidator + secureValueMutator contracts.SecureValueMutator keeperMetadataStorage contracts.KeeperMetadataStorage keeperService contracts.KeeperService metrics *metrics.SecureValueServiceMetrics @@ -37,6 +40,8 @@ func ProvideSecureValueService( accessClient claims.AccessClient, database contracts.Database, secureValueMetadataStorage contracts.SecureValueMetadataStorage, + secureValueValidator contracts.SecureValueValidator, + secureValueMutator contracts.SecureValueMutator, keeperMetadataStorage contracts.KeeperMetadataStorage, keeperService contracts.KeeperService, reg prometheus.Registerer, @@ -46,29 +51,34 @@ func ProvideSecureValueService( accessClient: accessClient, database: database, secureValueMetadataStorage: secureValueMetadataStorage, + secureValueValidator: secureValueValidator, + secureValueMutator: secureValueMutator, keeperMetadataStorage: keeperMetadataStorage, keeperService: keeperService, metrics: metrics.NewSecureValueServiceMetrics(reg), } } -func (s *SecureValueService) Create(ctx context.Context, sv *secretv1beta1.SecureValue, actorUID string) (_ *secretv1beta1.SecureValue, createErr error) { +func (s *SecureValueService) Create(ctx context.Context, sv *secretv1beta1.SecureValue, actorUID string) (createdSv *secretv1beta1.SecureValue, createErr error) { start := time.Now() - name, namespace := sv.GetName(), sv.GetNamespace() + ctx, span := s.tracer.Start(ctx, "SecureValueService.Create", trace.WithAttributes( - attribute.String("name", name), - attribute.String("namespace", namespace), + attribute.String("namespace", sv.GetNamespace()), attribute.String("actor", actorUID), )) defer span.End() defer func() { args := []any{ - "name", name, - "namespace", namespace, + "namespace", sv.GetNamespace(), "actorUID", actorUID, } + if createdSv != nil { + args = append(args, "name", createdSv.GetName()) + span.SetAttributes(attribute.String("name", createdSv.GetName())) + } + success := createErr == nil args = append(args, "success", success) if !success { @@ -151,6 +161,14 @@ func (s *SecureValueService) Update(ctx context.Context, newSecureValue *secretv } func (s *SecureValueService) createNewVersion(ctx context.Context, sv *secretv1beta1.SecureValue, actorUID string) (*secretv1beta1.SecureValue, error) { + if err := s.secureValueMutator.Mutate(sv, admission.Create); err != nil { + return nil, err + } + + if errorList := s.secureValueValidator.Validate(sv, nil, admission.Create); len(errorList) > 0 { + return nil, contracts.NewErrValidateSecureValue(errorList) + } + createdSv, err := s.secureValueMetadataStorage.Create(ctx, sv, actorUID) if err != nil { return nil, fmt.Errorf("creating secure value: %w", err) @@ -196,6 +214,13 @@ func (s *SecureValueService) createNewVersion(ctx context.Context, sv *secretv1b } func (s *SecureValueService) Read(ctx context.Context, namespace xkube.Namespace, name string) (_ *secretv1beta1.SecureValue, readErr error) { + if namespace == "" { + return nil, fmt.Errorf("namespace cannot be empty") + } + if name == "" { + return nil, fmt.Errorf("name cannot be empty") + } + start := time.Now() ctx, span := s.tracer.Start(ctx, "SecureValueService.Read", trace.WithAttributes( @@ -229,6 +254,10 @@ func (s *SecureValueService) Read(ctx context.Context, namespace xkube.Namespace } func (s *SecureValueService) List(ctx context.Context, namespace xkube.Namespace) (_ *secretv1beta1.SecureValueList, listErr error) { + if namespace == "" { + return nil, fmt.Errorf("namespace cannot be empty") + } + start := time.Now() ctx, span := s.tracer.Start(ctx, "SecureValueService.List", trace.WithAttributes( @@ -292,6 +321,13 @@ func (s *SecureValueService) List(ctx context.Context, namespace xkube.Namespace } func (s *SecureValueService) Delete(ctx context.Context, namespace xkube.Namespace, name string) (_ *secretv1beta1.SecureValue, deleteErr error) { + if namespace == "" { + return nil, fmt.Errorf("namespace cannot be empty") + } + if name == "" { + return nil, fmt.Errorf("name cannot be empty") + } + start := time.Now() ctx, span := s.tracer.Start(ctx, "SecureValueService.Delete", trace.WithAttributes( diff --git a/pkg/registry/apis/secret/testutils/testutils.go b/pkg/registry/apis/secret/testutils/testutils.go index 6ade8366c89..66b37a91f40 100644 --- a/pkg/registry/apis/secret/testutils/testutils.go +++ b/pkg/registry/apis/secret/testutils/testutils.go @@ -20,8 +20,10 @@ import ( cipher "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/cipher/service" osskmsproviders "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/kmsproviders" "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/manager" + "github.com/grafana/grafana/pkg/registry/apis/secret/mutator" "github.com/grafana/grafana/pkg/registry/apis/secret/secretkeeper/sqlkeeper" "github.com/grafana/grafana/pkg/registry/apis/secret/service" + "github.com/grafana/grafana/pkg/registry/apis/secret/validator" "github.com/grafana/grafana/pkg/registry/apis/secret/xkube" "github.com/grafana/grafana/pkg/services/accesscontrol" "github.com/grafana/grafana/pkg/services/accesscontrol/acimpl" @@ -123,7 +125,10 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut { keeperService = setupCfg.KeeperService } - secureValueService := service.ProvideSecureValueService(tracer, accessClient, database, secureValueMetadataStorage, keeperMetadataStorage, keeperService, nil) + secureValueValidator := validator.ProvideSecureValueValidator() + secureValueMutator := mutator.ProvideSecureValueMutator() + + secureValueService := service.ProvideSecureValueService(tracer, accessClient, database, secureValueMetadataStorage, secureValueValidator, secureValueMutator, keeperMetadataStorage, keeperService, nil) decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) diff --git a/pkg/server/wire.go b/pkg/server/wire.go index e3198908997..0204e37e25d 100644 --- a/pkg/server/wire.go +++ b/pkg/server/wire.go @@ -45,6 +45,7 @@ import ( cipher "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/cipher/service" encryptionManager "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/manager" secretinline "github.com/grafana/grafana/pkg/registry/apis/secret/inline" + secretmutator "github.com/grafana/grafana/pkg/registry/apis/secret/mutator" secretsecurevalueservice "github.com/grafana/grafana/pkg/registry/apis/secret/service" secretvalidator "github.com/grafana/grafana/pkg/registry/apis/secret/validator" appregistry "github.com/grafana/grafana/pkg/registry/apps" @@ -437,6 +438,8 @@ var wireBasicSet = wire.NewSet( secretsecurevalueservice.ProvideSecureValueService, secretvalidator.ProvideKeeperValidator, secretvalidator.ProvideSecureValueValidator, + secretmutator.ProvideKeeperMutator, + secretmutator.ProvideSecureValueMutator, secretmigrator.NewWithEngine, secretdatabase.ProvideDatabase, wire.Bind(new(secretcontracts.Database), new(*secretdatabase.Database)), diff --git a/pkg/server/wire_gen.go b/pkg/server/wire_gen.go index 6ef87327da4..c14f55a6507 100644 --- a/pkg/server/wire_gen.go +++ b/pkg/server/wire_gen.go @@ -68,6 +68,7 @@ import ( "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/kmsproviders" manager4 "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/manager" "github.com/grafana/grafana/pkg/registry/apis/secret/inline" + "github.com/grafana/grafana/pkg/registry/apis/secret/mutator" "github.com/grafana/grafana/pkg/registry/apis/secret/secretkeeper" service12 "github.com/grafana/grafana/pkg/registry/apis/secret/service" validator3 "github.com/grafana/grafana/pkg/registry/apis/secret/validator" @@ -763,6 +764,8 @@ func Initialize(cfg *setting.Cfg, opts Options, apiOpts api.ServerOptions) (*Ser if err != nil { return nil, err } + secureValueValidator := validator3.ProvideSecureValueValidator() + secureValueMutator := mutator.ProvideSecureValueMutator() keeperMetadataStorage, err := metadata.ProvideKeeperMetadataStorage(databaseDatabase, tracer, registerer) if err != nil { return nil, err @@ -791,8 +794,7 @@ func Initialize(cfg *setting.Cfg, opts Options, apiOpts api.ServerOptions) (*Ser if err != nil { return nil, err } - secureValueService := service12.ProvideSecureValueService(tracer, accessClient, databaseDatabase, secureValueMetadataStorage, keeperMetadataStorage, ossKeeperService, registerer) - secureValueValidator := validator3.ProvideSecureValueValidator() + secureValueService := service12.ProvideSecureValueService(tracer, accessClient, databaseDatabase, secureValueMetadataStorage, secureValueValidator, secureValueMutator, keeperMetadataStorage, ossKeeperService, registerer) secureValueClient := secret.ProvideSecureValueClient(secureValueService, secureValueValidator, accessClient) decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) decryptStorage, err := metadata.ProvideDecryptStorage(tracer, ossKeeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, registerer) @@ -1332,6 +1334,8 @@ func InitializeForTest(t sqlutil.ITestDB, testingT interface { if err != nil { return nil, err } + secureValueValidator := validator3.ProvideSecureValueValidator() + secureValueMutator := mutator.ProvideSecureValueMutator() keeperMetadataStorage, err := metadata.ProvideKeeperMetadataStorage(databaseDatabase, tracer, registerer) if err != nil { return nil, err @@ -1360,8 +1364,7 @@ func InitializeForTest(t sqlutil.ITestDB, testingT interface { if err != nil { return nil, err } - secureValueService := service12.ProvideSecureValueService(tracer, accessClient, databaseDatabase, secureValueMetadataStorage, keeperMetadataStorage, ossKeeperService, registerer) - secureValueValidator := validator3.ProvideSecureValueValidator() + secureValueService := service12.ProvideSecureValueService(tracer, accessClient, databaseDatabase, secureValueMetadataStorage, secureValueValidator, secureValueMutator, keeperMetadataStorage, ossKeeperService, registerer) secureValueClient := secret.ProvideSecureValueClient(secureValueService, secureValueValidator, accessClient) decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) decryptStorage, err := metadata.ProvideDecryptStorage(tracer, ossKeeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, registerer) @@ -1591,7 +1594,7 @@ var withOTelSet = wire.NewSet( otelTracer, grpcserver.ProvideService, interceptors.ProvideAuthenticator, ) -var wireBasicSet = wire.NewSet(annotationsimpl.ProvideService, wire.Bind(new(annotations.Repository), new(*annotationsimpl.RepositoryImpl)), New, api.ProvideHTTPServer, query.ProvideService, wire.Bind(new(query.Service), new(*query.ServiceImpl)), bus.ProvideBus, wire.Bind(new(bus.Bus), new(*bus.InProcBus)), rendering.ProvideService, wire.Bind(new(rendering.Service), new(*rendering.RenderingService)), routing.ProvideRegister, wire.Bind(new(routing.RouteRegister), new(*routing.RouteRegisterImpl)), hooks.ProvideService, kvstore.ProvideService, localcache.ProvideService, bundleregistry.ProvideService, wire.Bind(new(supportbundles.Service), new(*bundleregistry.Service)), updatemanager.ProvideGrafanaService, updatemanager.ProvidePluginsService, service.ProvideService, wire.Bind(new(usagestats.Service), new(*service.UsageStats)), validator2.ProvideService, legacy.ProvideLegacyMigrator, pluginsintegration.WireSet, dashboards.ProvideFileStoreManager, wire.Bind(new(dashboards.FileStore), new(*dashboards.FileStoreManager)), cloudwatch.ProvideService, cloudmonitoring.ProvideService, azuremonitor.ProvideService, postgres.ProvideService, mysql.ProvideService, mssql.ProvideService, store.ProvideEntityEventsService, dualwrite.ProvideService, httpclientprovider.New, wire.Bind(new(httpclient.Provider), new(*httpclient2.Provider)), serverlock.ProvideService, annotationsimpl.ProvideCleanupService, wire.Bind(new(annotations.Cleaner), new(*annotationsimpl.CleanupServiceImpl)), cleanup.ProvideService, shorturlimpl.ProvideService, wire.Bind(new(shorturls.Service), new(*shorturlimpl.ShortURLService)), queryhistory.ProvideService, wire.Bind(new(queryhistory.Service), new(*queryhistory.QueryHistoryService)), correlations.ProvideService, wire.Bind(new(correlations.Service), new(*correlations.CorrelationsService)), quotaimpl.ProvideService, remotecache.ProvideService, wire.Bind(new(remotecache.CacheStorage), new(*remotecache.RemoteCache)), authinfoimpl.ProvideService, wire.Bind(new(login.AuthInfoService), new(*authinfoimpl.Service)), authinfoimpl.ProvideStore, datasourceproxy.ProvideService, sort.ProvideService, search2.ProvideService, searchV2.ProvideService, searchV2.ProvideSearchHTTPService, store.ProvideService, store.ProvideSystemUsersService, live.ProvideService, pushhttp.ProvideService, contexthandler.ProvideService, service10.ProvideService, wire.Bind(new(service10.LDAP), new(*service10.LDAPImpl)), jwt.ProvideService, wire.Bind(new(jwt.JWTService), new(*jwt.AuthService)), store2.ProvideDBStore, image.ProvideDeleteExpiredService, ngalert.ProvideService, librarypanels.ProvideService, wire.Bind(new(librarypanels.Service), new(*librarypanels.LibraryPanelService)), libraryelements.ProvideService, wire.Bind(new(libraryelements.Service), new(*libraryelements.LibraryElementService)), notifications.ProvideService, notifications.ProvideSmtpService, github.ProvideFactory, tracing.ProvideService, tracing.ProvideTracingConfig, wire.Bind(new(tracing.Tracer), new(*tracing.TracingService)), withOTelSet, testdatasource.ProvideService, api4.ProvideService, opentsdb.ProvideService, socialimpl.ProvideService, influxdb.ProvideService, wire.Bind(new(social.Service), new(*socialimpl.SocialService)), tempo.ProvideService, loki.ProvideService, graphite.ProvideService, prometheus.ProvideService, elasticsearch.ProvideService, pyroscope.ProvideService, parca.ProvideService, zipkin.ProvideService, jaeger.ProvideService, service7.ProvideCacheService, wire.Bind(new(datasources.CacheService), new(*service7.CacheServiceImpl)), service2.ProvideEncryptionService, wire.Bind(new(encryption2.Internal), new(*service2.Service)), manager.ProvideSecretsService, wire.Bind(new(secrets2.Service), new(*manager.SecretsService)), database.ProvideSecretsStore, wire.Bind(new(secrets2.Store), new(*database.SecretsStoreImpl)), grafanads.ProvideService, wire.Bind(new(dashboardsnapshots.Store), new(*database4.DashboardSnapshotStore)), database4.ProvideStore, wire.Bind(new(dashboardsnapshots.Service), new(*service8.ServiceImpl)), service8.ProvideService, service7.ProvideService, wire.Bind(new(datasources.DataSourceService), new(*service7.Service)), service7.ProvideLegacyDataSourceLookup, retriever.ProvideService, wire.Bind(new(serviceaccounts.ServiceAccountRetriever), new(*retriever.Service)), ossaccesscontrol.ProvideServiceAccountPermissions, wire.Bind(new(accesscontrol.ServiceAccountPermissionsService), new(*ossaccesscontrol.ServiceAccountPermissionsService)), manager2.ProvideServiceAccountsService, proxy.ProvideServiceAccountsProxy, wire.Bind(new(serviceaccounts.Service), new(*proxy.ServiceAccountsProxy)), mtdsclient.NewNullMTDatasourceClientBuilder, expr.ProvideService, featuremgmt.ProvideManagerService, featuremgmt.ProvideToggles, service5.ProvideDashboardServiceImpl, wire.Bind(new(dashboards2.PermissionsRegistrationService), new(*service5.DashboardServiceImpl)), service5.ProvideDashboardService, service5.ProvideDashboardProvisioningService, service5.ProvideDashboardPluginService, database2.ProvideDashboardStore, folderimpl.ProvideService, wire.Bind(new(folder.Service), new(*folderimpl.Service)), folderimpl.ProvideStore, wire.Bind(new(folder.Store), new(*folderimpl.FolderStoreImpl)), folderimpl.ProvideDashboardFolderStore, wire.Bind(new(folder.FolderStore), new(*folderimpl.DashboardFolderStoreImpl)), service9.ProvideService, wire.Bind(new(dashboardimport.Service), new(*service9.ImportDashboardService)), service6.ProvideService, wire.Bind(new(plugindashboards.Service), new(*service6.Service)), service6.ProvideDashboardUpdater, sanitizer.ProvideService, kvstore2.ProvideService, avatar.ProvideAvatarCacheServer, statscollector.ProvideService, csrf.ProvideCSRFFilter, wire.Bind(new(csrf.Service), new(*csrf.CSRF)), ossaccesscontrol.ProvideTeamPermissions, wire.Bind(new(accesscontrol.TeamPermissionsService), new(*ossaccesscontrol.TeamPermissionsService)), ossaccesscontrol.ProvideFolderPermissions, wire.Bind(new(accesscontrol.FolderPermissionsService), new(*ossaccesscontrol.FolderPermissionsService)), ossaccesscontrol.ProvideDashboardPermissions, wire.Bind(new(accesscontrol.DashboardPermissionsService), new(*ossaccesscontrol.DashboardPermissionsService)), ossaccesscontrol.ProvideReceiverPermissionsService, wire.Bind(new(accesscontrol.ReceiverPermissionsService), new(*ossaccesscontrol.ReceiverPermissionsService)), starimpl.ProvideService, playlistimpl.ProvideService, apikeyimpl.ProvideService, dashverimpl.ProvideService, service3.ProvideService, wire.Bind(new(publicdashboards.Service), new(*service3.PublicDashboardServiceImpl)), database3.ProvideStore, wire.Bind(new(publicdashboards.Store), new(*database3.PublicDashboardStoreImpl)), metric.ProvideService, api2.ProvideApi, api3.ProvideApi, userimpl.ProvideService, orgimpl.ProvideService, orgimpl.ProvideDeletionService, statsimpl.ProvideService, grpccontext.ProvideContextHandler, grpcserver.ProvideHealthService, grpcserver.ProvideReflectionService, resolver.ProvideEntityReferenceResolver, teamimpl.ProvideService, teamapi.ProvideTeamAPI, tempuserimpl.ProvideService, loginattemptimpl.ProvideService, wire.Bind(new(loginattempt.Service), new(*loginattemptimpl.Service)), migrations2.ProvideDataSourceMigrationService, migrations2.ProvideSecretMigrationProvider, wire.Bind(new(migrations2.SecretMigrationProvider), new(*migrations2.SecretMigrationProviderImpl)), resourcepermissions.NewActionSetService, wire.Bind(new(accesscontrol.ActionResolver), new(resourcepermissions.ActionSetService)), wire.Bind(new(pluginaccesscontrol.ActionSetRegistry), new(resourcepermissions.ActionSetService)), permreg.ProvidePermissionRegistry, acimpl.ProvideAccessControl, dualwrite2.ProvideZanzanaReconciler, navtreeimpl.ProvideService, wire.Bind(new(accesscontrol.AccessControl), new(*acimpl.AccessControl)), wire.Bind(new(notifications.TempUserStore), new(tempuser.Service)), tagimpl.ProvideService, wire.Bind(new(tag.Service), new(*tagimpl.Service)), authnimpl.ProvideService, authnimpl.ProvideIdentitySynchronizer, authnimpl.ProvideAuthnService, authnimpl.ProvideAuthnServiceAuthenticateOnly, authnimpl.ProvideRegistration, supportbundlesimpl.ProvideService, extsvcaccounts.ProvideExtSvcAccountsService, wire.Bind(new(serviceaccounts.ExtSvcAccountsService), new(*extsvcaccounts.ExtSvcAccountsService)), registry2.ProvideExtSvcRegistry, wire.Bind(new(extsvcauth.ExternalServiceRegistry), new(*registry2.Registry)), anonstore.ProvideAnonDBStore, wire.Bind(new(anonstore.AnonStore), new(*anonstore.AnonDBStore)), loggermw.Provide, slogadapter.Provide, signingkeysimpl.ProvideEmbeddedSigningKeysService, wire.Bind(new(signingkeys.Service), new(*signingkeysimpl.Service)), ssosettingsimpl.ProvideService, wire.Bind(new(ssosettings.Service), new(*ssosettingsimpl.Service)), idimpl.ProvideService, wire.Bind(new(auth.IDService), new(*idimpl.Service)), cloudmigrationimpl.ProvideService, userimpl.ProvideVerifier, connectors.ProvideOrgRoleMapper, wire.Bind(new(user.Verifier), new(*userimpl.Verifier)), authz.WireSet, metadata.ProvideSecureValueMetadataStorage, metadata.ProvideKeeperMetadataStorage, metadata.ProvideDecryptStorage, decrypt.ProvideDecryptAuthorizer, decrypt.ProvideDecryptService, inline.ProvideInlineSecureValueService, encryption.ProvideDataKeyStorage, encryption.ProvideGlobalDataKeyStorage, encryption.ProvideEncryptedValueStorage, encryption.ProvideGlobalEncryptedValueStorage, service12.ProvideSecureValueService, validator3.ProvideKeeperValidator, validator3.ProvideSecureValueValidator, migrator2.NewWithEngine, database5.ProvideDatabase, wire.Bind(new(contracts.Database), new(*database5.Database)), manager4.ProvideEncryptionManager, service11.ProvideAESGCMCipherService, resource.ProvideStorageMetrics, resource.ProvideIndexMetrics, apiserver.WireSet, apiregistry.WireSet, appregistry.WireSet) +var wireBasicSet = wire.NewSet(annotationsimpl.ProvideService, wire.Bind(new(annotations.Repository), new(*annotationsimpl.RepositoryImpl)), New, api.ProvideHTTPServer, query.ProvideService, wire.Bind(new(query.Service), new(*query.ServiceImpl)), bus.ProvideBus, wire.Bind(new(bus.Bus), new(*bus.InProcBus)), rendering.ProvideService, wire.Bind(new(rendering.Service), new(*rendering.RenderingService)), routing.ProvideRegister, wire.Bind(new(routing.RouteRegister), new(*routing.RouteRegisterImpl)), hooks.ProvideService, kvstore.ProvideService, localcache.ProvideService, bundleregistry.ProvideService, wire.Bind(new(supportbundles.Service), new(*bundleregistry.Service)), updatemanager.ProvideGrafanaService, updatemanager.ProvidePluginsService, service.ProvideService, wire.Bind(new(usagestats.Service), new(*service.UsageStats)), validator2.ProvideService, legacy.ProvideLegacyMigrator, pluginsintegration.WireSet, dashboards.ProvideFileStoreManager, wire.Bind(new(dashboards.FileStore), new(*dashboards.FileStoreManager)), cloudwatch.ProvideService, cloudmonitoring.ProvideService, azuremonitor.ProvideService, postgres.ProvideService, mysql.ProvideService, mssql.ProvideService, store.ProvideEntityEventsService, dualwrite.ProvideService, httpclientprovider.New, wire.Bind(new(httpclient.Provider), new(*httpclient2.Provider)), serverlock.ProvideService, annotationsimpl.ProvideCleanupService, wire.Bind(new(annotations.Cleaner), new(*annotationsimpl.CleanupServiceImpl)), cleanup.ProvideService, shorturlimpl.ProvideService, wire.Bind(new(shorturls.Service), new(*shorturlimpl.ShortURLService)), queryhistory.ProvideService, wire.Bind(new(queryhistory.Service), new(*queryhistory.QueryHistoryService)), correlations.ProvideService, wire.Bind(new(correlations.Service), new(*correlations.CorrelationsService)), quotaimpl.ProvideService, remotecache.ProvideService, wire.Bind(new(remotecache.CacheStorage), new(*remotecache.RemoteCache)), authinfoimpl.ProvideService, wire.Bind(new(login.AuthInfoService), new(*authinfoimpl.Service)), authinfoimpl.ProvideStore, datasourceproxy.ProvideService, sort.ProvideService, search2.ProvideService, searchV2.ProvideService, searchV2.ProvideSearchHTTPService, store.ProvideService, store.ProvideSystemUsersService, live.ProvideService, pushhttp.ProvideService, contexthandler.ProvideService, service10.ProvideService, wire.Bind(new(service10.LDAP), new(*service10.LDAPImpl)), jwt.ProvideService, wire.Bind(new(jwt.JWTService), new(*jwt.AuthService)), store2.ProvideDBStore, image.ProvideDeleteExpiredService, ngalert.ProvideService, librarypanels.ProvideService, wire.Bind(new(librarypanels.Service), new(*librarypanels.LibraryPanelService)), libraryelements.ProvideService, wire.Bind(new(libraryelements.Service), new(*libraryelements.LibraryElementService)), notifications.ProvideService, notifications.ProvideSmtpService, github.ProvideFactory, tracing.ProvideService, tracing.ProvideTracingConfig, wire.Bind(new(tracing.Tracer), new(*tracing.TracingService)), withOTelSet, testdatasource.ProvideService, api4.ProvideService, opentsdb.ProvideService, socialimpl.ProvideService, influxdb.ProvideService, wire.Bind(new(social.Service), new(*socialimpl.SocialService)), tempo.ProvideService, loki.ProvideService, graphite.ProvideService, prometheus.ProvideService, elasticsearch.ProvideService, pyroscope.ProvideService, parca.ProvideService, zipkin.ProvideService, jaeger.ProvideService, service7.ProvideCacheService, wire.Bind(new(datasources.CacheService), new(*service7.CacheServiceImpl)), service2.ProvideEncryptionService, wire.Bind(new(encryption2.Internal), new(*service2.Service)), manager.ProvideSecretsService, wire.Bind(new(secrets2.Service), new(*manager.SecretsService)), database.ProvideSecretsStore, wire.Bind(new(secrets2.Store), new(*database.SecretsStoreImpl)), grafanads.ProvideService, wire.Bind(new(dashboardsnapshots.Store), new(*database4.DashboardSnapshotStore)), database4.ProvideStore, wire.Bind(new(dashboardsnapshots.Service), new(*service8.ServiceImpl)), service8.ProvideService, service7.ProvideService, wire.Bind(new(datasources.DataSourceService), new(*service7.Service)), service7.ProvideLegacyDataSourceLookup, retriever.ProvideService, wire.Bind(new(serviceaccounts.ServiceAccountRetriever), new(*retriever.Service)), ossaccesscontrol.ProvideServiceAccountPermissions, wire.Bind(new(accesscontrol.ServiceAccountPermissionsService), new(*ossaccesscontrol.ServiceAccountPermissionsService)), manager2.ProvideServiceAccountsService, proxy.ProvideServiceAccountsProxy, wire.Bind(new(serviceaccounts.Service), new(*proxy.ServiceAccountsProxy)), mtdsclient.NewNullMTDatasourceClientBuilder, expr.ProvideService, featuremgmt.ProvideManagerService, featuremgmt.ProvideToggles, service5.ProvideDashboardServiceImpl, wire.Bind(new(dashboards2.PermissionsRegistrationService), new(*service5.DashboardServiceImpl)), service5.ProvideDashboardService, service5.ProvideDashboardProvisioningService, service5.ProvideDashboardPluginService, database2.ProvideDashboardStore, folderimpl.ProvideService, wire.Bind(new(folder.Service), new(*folderimpl.Service)), folderimpl.ProvideStore, wire.Bind(new(folder.Store), new(*folderimpl.FolderStoreImpl)), folderimpl.ProvideDashboardFolderStore, wire.Bind(new(folder.FolderStore), new(*folderimpl.DashboardFolderStoreImpl)), service9.ProvideService, wire.Bind(new(dashboardimport.Service), new(*service9.ImportDashboardService)), service6.ProvideService, wire.Bind(new(plugindashboards.Service), new(*service6.Service)), service6.ProvideDashboardUpdater, sanitizer.ProvideService, kvstore2.ProvideService, avatar.ProvideAvatarCacheServer, statscollector.ProvideService, csrf.ProvideCSRFFilter, wire.Bind(new(csrf.Service), new(*csrf.CSRF)), ossaccesscontrol.ProvideTeamPermissions, wire.Bind(new(accesscontrol.TeamPermissionsService), new(*ossaccesscontrol.TeamPermissionsService)), ossaccesscontrol.ProvideFolderPermissions, wire.Bind(new(accesscontrol.FolderPermissionsService), new(*ossaccesscontrol.FolderPermissionsService)), ossaccesscontrol.ProvideDashboardPermissions, wire.Bind(new(accesscontrol.DashboardPermissionsService), new(*ossaccesscontrol.DashboardPermissionsService)), ossaccesscontrol.ProvideReceiverPermissionsService, wire.Bind(new(accesscontrol.ReceiverPermissionsService), new(*ossaccesscontrol.ReceiverPermissionsService)), starimpl.ProvideService, playlistimpl.ProvideService, apikeyimpl.ProvideService, dashverimpl.ProvideService, service3.ProvideService, wire.Bind(new(publicdashboards.Service), new(*service3.PublicDashboardServiceImpl)), database3.ProvideStore, wire.Bind(new(publicdashboards.Store), new(*database3.PublicDashboardStoreImpl)), metric.ProvideService, api2.ProvideApi, api3.ProvideApi, userimpl.ProvideService, orgimpl.ProvideService, orgimpl.ProvideDeletionService, statsimpl.ProvideService, grpccontext.ProvideContextHandler, grpcserver.ProvideHealthService, grpcserver.ProvideReflectionService, resolver.ProvideEntityReferenceResolver, teamimpl.ProvideService, teamapi.ProvideTeamAPI, tempuserimpl.ProvideService, loginattemptimpl.ProvideService, wire.Bind(new(loginattempt.Service), new(*loginattemptimpl.Service)), migrations2.ProvideDataSourceMigrationService, migrations2.ProvideSecretMigrationProvider, wire.Bind(new(migrations2.SecretMigrationProvider), new(*migrations2.SecretMigrationProviderImpl)), resourcepermissions.NewActionSetService, wire.Bind(new(accesscontrol.ActionResolver), new(resourcepermissions.ActionSetService)), wire.Bind(new(pluginaccesscontrol.ActionSetRegistry), new(resourcepermissions.ActionSetService)), permreg.ProvidePermissionRegistry, acimpl.ProvideAccessControl, dualwrite2.ProvideZanzanaReconciler, navtreeimpl.ProvideService, wire.Bind(new(accesscontrol.AccessControl), new(*acimpl.AccessControl)), wire.Bind(new(notifications.TempUserStore), new(tempuser.Service)), tagimpl.ProvideService, wire.Bind(new(tag.Service), new(*tagimpl.Service)), authnimpl.ProvideService, authnimpl.ProvideIdentitySynchronizer, authnimpl.ProvideAuthnService, authnimpl.ProvideAuthnServiceAuthenticateOnly, authnimpl.ProvideRegistration, supportbundlesimpl.ProvideService, extsvcaccounts.ProvideExtSvcAccountsService, wire.Bind(new(serviceaccounts.ExtSvcAccountsService), new(*extsvcaccounts.ExtSvcAccountsService)), registry2.ProvideExtSvcRegistry, wire.Bind(new(extsvcauth.ExternalServiceRegistry), new(*registry2.Registry)), anonstore.ProvideAnonDBStore, wire.Bind(new(anonstore.AnonStore), new(*anonstore.AnonDBStore)), loggermw.Provide, slogadapter.Provide, signingkeysimpl.ProvideEmbeddedSigningKeysService, wire.Bind(new(signingkeys.Service), new(*signingkeysimpl.Service)), ssosettingsimpl.ProvideService, wire.Bind(new(ssosettings.Service), new(*ssosettingsimpl.Service)), idimpl.ProvideService, wire.Bind(new(auth.IDService), new(*idimpl.Service)), cloudmigrationimpl.ProvideService, userimpl.ProvideVerifier, connectors.ProvideOrgRoleMapper, wire.Bind(new(user.Verifier), new(*userimpl.Verifier)), authz.WireSet, metadata.ProvideSecureValueMetadataStorage, metadata.ProvideKeeperMetadataStorage, metadata.ProvideDecryptStorage, decrypt.ProvideDecryptAuthorizer, decrypt.ProvideDecryptService, inline.ProvideInlineSecureValueService, encryption.ProvideDataKeyStorage, encryption.ProvideGlobalDataKeyStorage, encryption.ProvideEncryptedValueStorage, encryption.ProvideGlobalEncryptedValueStorage, service12.ProvideSecureValueService, validator3.ProvideKeeperValidator, validator3.ProvideSecureValueValidator, mutator.ProvideKeeperMutator, mutator.ProvideSecureValueMutator, migrator2.NewWithEngine, database5.ProvideDatabase, wire.Bind(new(contracts.Database), new(*database5.Database)), manager4.ProvideEncryptionManager, service11.ProvideAESGCMCipherService, resource.ProvideStorageMetrics, resource.ProvideIndexMetrics, apiserver.WireSet, apiregistry.WireSet, appregistry.WireSet) var wireSet = wire.NewSet( wireBasicSet, metrics.WireSet, sqlstore.ProvideService, metrics2.ProvideService, wire.Bind(new(notifications.Service), new(*notifications.NotificationService)), wire.Bind(new(notifications.WebhookSender), new(*notifications.NotificationService)), wire.Bind(new(notifications.EmailSender), new(*notifications.NotificationService)), wire.Bind(new(db.DB), new(*sqlstore.SQLStore)), prefimpl.ProvideService, oauthtoken.ProvideService, wire.Bind(new(oauthtoken.OAuthTokenService), new(*oauthtoken.Service)), wire.Bind(new(cleanup.AlertRuleService), new(*store2.DBstore)),