Encryption: Fix tests

pkg/api/pluginproxy/ds_proxy_test.go

@@ -75,7 +75,7 @@ func TestDSRouteRule(t *testing.T) {
 			}
 
 			setting.SecretKey = "password" //nolint:goconst
-			key, _ := util.Encrypt([]byte("123"), "password")
+			key, _ := util.Encrypt([]byte("123"))
 
 			ds := &models.DataSource{
 				JsonData: simplejson.NewFromAny(map[string]interface{}{
@@ -189,7 +189,7 @@ func TestDSRouteRule(t *testing.T) {
 			}
 
 			setting.SecretKey = "password"
-			key, _ := util.Encrypt([]byte("123"), "password")
+			key, _ := util.Encrypt([]byte("123"))
 
 			ds := &models.DataSource{
 				JsonData: simplejson.NewFromAny(map[string]interface{}{

pkg/api/pluginproxy/pluginproxy_test.go

@@ -23,7 +23,7 @@ func TestPluginProxy(t *testing.T) {
 		setting.SecretKey = "password"
 
 		bus.AddHandler("test", func(query *models.GetPluginSettingByIdQuery) error {
-			key, err := util.Encrypt([]byte("123"), "password")
+			key, err := util.Encrypt([]byte("123"))
 			if err != nil {
 				return err
 			}

pkg/models/datasource_cache_test.go

@@ -54,7 +54,7 @@ func TestDataSourceProxyCache(t *testing.T) {
 		json := simplejson.New()
 		json.Set("tlsAuthWithCACert", true)
 
-		tlsCaCert, err := util.Encrypt([]byte(caCert), "password")
+		tlsCaCert, err := util.Encrypt([]byte(caCert))
 		So(err, ShouldBeNil)
 		ds := DataSource{
 			Id:             1,
@@ -96,9 +96,9 @@ func TestDataSourceProxyCache(t *testing.T) {
 		json := simplejson.New()
 		json.Set("tlsAuth", true)
 
-		tlsClientCert, err := util.Encrypt([]byte(clientCert), "password")
+		tlsClientCert, err := util.Encrypt([]byte(clientCert))
 		So(err, ShouldBeNil)
-		tlsClientKey, err := util.Encrypt([]byte(clientKey), "password")
+		tlsClientKey, err := util.Encrypt([]byte(clientKey))
 		So(err, ShouldBeNil)
 
 		ds := DataSource{
@@ -130,7 +130,7 @@ func TestDataSourceProxyCache(t *testing.T) {
 		json := simplejson.New()
 		json.Set("tlsAuthWithCACert", true)
 
-		tlsCaCert, err := util.Encrypt([]byte(caCert), "password")
+		tlsCaCert, err := util.Encrypt([]byte(caCert))
 		So(err, ShouldBeNil)
 
 		ds := DataSource{
@@ -179,7 +179,7 @@ func TestDataSourceProxyCache(t *testing.T) {
 		json := simplejson.NewFromAny(map[string]interface{}{
 			"httpHeaderName1": "Authorization",
 		})
-		encryptedData, err := util.Encrypt([]byte(`Bearer xf5yhfkpsnmgo`), setting.SecretKey)
+		encryptedData, err := util.Encrypt([]byte(`Bearer xf5yhfkpsnmgo`))
 		if err != nil {
 			log.Fatal(err.Error())
 		}

pkg/services/secrets/encryption_test.go

@@ -0,0 +1,40 @@
+package secrets
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncryption_keyDerivationLength(t *testing.T) {
+	salt := []byte("salt")
+
+	tests := []struct {
+		secret []byte
+		salt   []byte
+	}{
+		{[]byte("secret"), salt},
+		{[]byte("a very long secret key that is larger then 32bytes"), salt},
+	}
+
+	for i, tc := range tests {
+		tc := tc
+		t.Run(fmt.Sprintf("deriving key #%d", i), func(t *testing.T) {
+			key, err := encryptionKeyToBytes(tc.secret, tc.salt)
+			require.NoError(t, err)
+			assert.Len(t, key, 32)
+		})
+	}
+}
+
+func TestEncryption_basic(t *testing.T) {
+	encrypted, err := encrypt([]byte("grafana"), []byte("1234"))
+	require.NoError(t, err)
+
+	decrypted, err := decrypt(encrypted, []byte("1234"))
+	require.NoError(t, err)
+
+	assert.Equal(t, []byte("grafana"), decrypted)
+}

pkg/util/encryption.go

@@ -7,11 +7,13 @@ import (
 var ErrNotInitialized = errors.New("function is not initialized")
 
 // Decrypt decrypts a payload with a given secret.
+// Real implementation in github.com/grafana/grafana/pkg/services/secrets
 var Decrypt = func(_ []byte) ([]byte, error) {
 	return nil, ErrNotInitialized
 }
 
 // Encrypt encrypts a payload with a given secret.
+// Real implementation in github.com/grafana/grafana/pkg/services/secrets
 var Encrypt = func(_ []byte) ([]byte, error) {
 	return nil, ErrNotInitialized
 }

pkg/util/encryption_test.go

@@ -1,30 +0,0 @@
-package util
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestEncryption(t *testing.T) {
-	t.Run("getting encryption key", func(t *testing.T) {
-		key, err := encryptionKeyToBytes("secret", "salt")
-		require.NoError(t, err)
-		assert.Len(t, key, 32)
-
-		key, err = encryptionKeyToBytes("a very long secret key that is larger then 32bytes", "salt")
-		require.NoError(t, err)
-		assert.Len(t, key, 32)
-	})
-
-	t.Run("decrypting basic payload", func(t *testing.T) {
-		encrypted, err := Encrypt([]byte("grafana"), "1234")
-		require.NoError(t, err)
-
-		decrypted, err := Decrypt(encrypted, "1234")
-		require.NoError(t, err)
-
-		assert.Equal(t, []byte("grafana"), decrypted)
-	})
-}