From 3cda2334686715bc077b5959ce5a6c1643a5cfc0 Mon Sep 17 00:00:00 2001 From: Matheus Macabu Date: Wed, 16 Jul 2025 09:39:33 +0200 Subject: [PATCH] Secrets: Remove temporary allowlist (#108118) --- pkg/registry/apis/secret/contracts/decrypt.go | 3 - .../apis/secret/decrypt/allow_list.go | 8 -- .../apis/secret/decrypt/authorizer.go | 20 +--- .../apis/secret/decrypt/authorizer_test.go | 52 ++++----- .../apis/secret/testutils/testutils.go | 11 +- .../apis/secret/validator/secure_value.go | 29 +---- .../secret/validator/secure_value_test.go | 104 +++++------------- pkg/server/wire.go | 2 - pkg/server/wire_gen.go | 8 +- .../secret/metadata/decrypt_store_test.go | 60 +--------- 10 files changed, 76 insertions(+), 221 deletions(-) delete mode 100644 pkg/registry/apis/secret/decrypt/allow_list.go diff --git a/pkg/registry/apis/secret/contracts/decrypt.go b/pkg/registry/apis/secret/contracts/decrypt.go index 5bc3ac1631a..13c28b1025c 100644 --- a/pkg/registry/apis/secret/contracts/decrypt.go +++ b/pkg/registry/apis/secret/contracts/decrypt.go @@ -23,6 +23,3 @@ type DecryptStorage interface { type DecryptAuthorizer interface { Authorize(ctx context.Context, secureValueName string, secureValueDecrypters []string) (identity string, allowed bool) } - -// TEMPORARY: Needed to pass it with wire. -type DecryptAllowList map[string]struct{} diff --git a/pkg/registry/apis/secret/decrypt/allow_list.go b/pkg/registry/apis/secret/decrypt/allow_list.go deleted file mode 100644 index 9f3e34ec71a..00000000000 --- a/pkg/registry/apis/secret/decrypt/allow_list.go +++ /dev/null @@ -1,8 +0,0 @@ -package decrypt - -import "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" - -// TEMPORARY -func ProvideDecryptAllowList() contracts.DecryptAllowList { - return make(map[string]struct{}, 0) -} diff --git a/pkg/registry/apis/secret/decrypt/authorizer.go b/pkg/registry/apis/secret/decrypt/authorizer.go index 0ae6f5c9796..042ec12e0ab 100644 --- a/pkg/registry/apis/secret/decrypt/authorizer.go +++ b/pkg/registry/apis/secret/decrypt/authorizer.go @@ -15,14 +15,12 @@ import ( // decryptAuthorizer is the authorizer implementation for decrypt operations. type decryptAuthorizer struct { - tracer trace.Tracer - allowList contracts.DecryptAllowList + tracer trace.Tracer } -func ProvideDecryptAuthorizer(tracer trace.Tracer, allowList contracts.DecryptAllowList) contracts.DecryptAuthorizer { +func ProvideDecryptAuthorizer(tracer trace.Tracer) contracts.DecryptAuthorizer { return &decryptAuthorizer{ - tracer: tracer, - allowList: allowList, + tracer: tracer, } } @@ -56,15 +54,9 @@ func (a *decryptAuthorizer) Authorize(ctx context.Context, secureValueName strin return "", false } - serviceIdentity := serviceIdentityList[0] - - // TEMPORARY: while we can't onboard every app into secrets, we can block them from decrypting - // securevalues preemptively here before even reaching out to the database. - // This check can be removed once we open the gates for any service to use secrets. - if len(a.allowList) > 0 { - if _, exists := a.allowList[serviceIdentity]; !exists || serviceIdentity == "" { - return serviceIdentity, false - } + serviceIdentity := strings.TrimSpace(serviceIdentityList[0]) + if len(serviceIdentity) == 0 { + return "", false } // Checks whether the token has the permission to decrypt secure values. diff --git a/pkg/registry/apis/secret/decrypt/authorizer_test.go b/pkg/registry/apis/secret/decrypt/authorizer_test.go index 1e8c33405b2..131ec33fb8b 100644 --- a/pkg/registry/apis/secret/decrypt/authorizer_test.go +++ b/pkg/registry/apis/secret/decrypt/authorizer_test.go @@ -17,7 +17,7 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when no auth info is present, it returns false", func(t *testing.T) { ctx := context.Background() - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", nil) require.Empty(t, identity) @@ -26,7 +26,7 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when token permissions are empty, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), "identity", []string{}) - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", nil) require.NotEmpty(t, identity) @@ -35,7 +35,16 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when service identity is empty, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), "", []string{}) - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) + + identity, allowed := authorizer.Authorize(ctx, "", nil) + require.Empty(t, identity) + require.False(t, allowed) + }) + + t.Run("when service identity is empty string, it returns false", func(t *testing.T) { + ctx := createAuthContext(context.Background(), " ", []string{}) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", nil) require.Empty(t, identity) @@ -43,7 +52,7 @@ func TestDecryptAuthorizer(t *testing.T) { }) t.Run("when permission format is malformed (missing verb), it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) // nameless ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues"}) @@ -59,7 +68,7 @@ func TestDecryptAuthorizer(t *testing.T) { }) t.Run("when permission verb is not exactly `decrypt`, it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) // nameless ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues:*"}) @@ -76,7 +85,7 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when permission does not have 2 or 3 parts, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", nil) require.NotEmpty(t, identity) @@ -85,7 +94,7 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when permission has group that is not `secret.grafana.app`, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), "identity", []string{"wrong.group/securevalues/invalid:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", nil) require.NotEmpty(t, identity) @@ -93,7 +102,7 @@ func TestDecryptAuthorizer(t *testing.T) { }) t.Run("when permission has resource that is not `securevalues`, it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) // nameless ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/invalid-resource:decrypt"}) @@ -110,24 +119,15 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when the allow list is empty, it allows all identities", func(t *testing.T) { ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer, nil) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", []string{"identity"}) require.NotEmpty(t, identity) require.True(t, allowed) }) - t.Run("when the identity is not in the allow list, it returns false", func(t *testing.T) { - ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"allowed1": {}}) - - identity, allowed := authorizer.Authorize(ctx, "", nil) - require.NotEmpty(t, identity) - require.False(t, allowed) - }) - t.Run("when the identity doesn't match any allowed decrypters, it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"identity": {}}) + authorizer := ProvideDecryptAuthorizer(tracer) // nameless ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) @@ -143,7 +143,7 @@ func TestDecryptAuthorizer(t *testing.T) { }) t.Run("when the identity matches an allowed decrypter, it returns true", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"identity": {}}) + authorizer := ProvideDecryptAuthorizer(tracer) // nameless ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) @@ -166,7 +166,7 @@ func TestDecryptAuthorizer(t *testing.T) { "wrong.group/securevalues/group2:decrypt", "secret.grafana.app/securevalues/identity:decrypt", // old style of identity+permission }) - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"identity": {}}) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "name1", []string{"identity"}) require.True(t, allowed) @@ -179,7 +179,7 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when empty secure value name with specific permission, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues/name:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"identity": {}}) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", []string{"identity"}) require.Equal(t, "identity", identity) @@ -188,7 +188,7 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when permission has an extra / but no name, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues/:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"identity": {}}) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", []string{"identity"}) require.Equal(t, "identity", identity) @@ -197,7 +197,7 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when the decrypters list is empty, meaning nothing can decrypt the secure value, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"identity": {}}) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "name", []string{}) require.Equal(t, "identity", identity) @@ -206,7 +206,7 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when one of decrypters matches the identity, it returns true", func(t *testing.T) { ctx := createAuthContext(context.Background(), "identity1", []string{"secret.grafana.app/securevalues:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"identity1": {}, "identity2": {}}) + authorizer := ProvideDecryptAuthorizer(tracer) identity, allowed := authorizer.Authorize(ctx, "", []string{"identity1", "identity2", "identity3"}) require.Equal(t, "identity1", identity) @@ -214,7 +214,7 @@ func TestDecryptAuthorizer(t *testing.T) { }) t.Run("permissions must be case-sensitive and return false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer, map[string]struct{}{"identity": {}}) + authorizer := ProvideDecryptAuthorizer(tracer) ctx := createAuthContext(context.Background(), "identity", []string{"SECRET.grafana.app/securevalues:decrypt"}) identity, allowed := authorizer.Authorize(ctx, "", []string{"identity"}) diff --git a/pkg/registry/apis/secret/testutils/testutils.go b/pkg/registry/apis/secret/testutils/testutils.go index b60e550ee53..a0d547a52f4 100644 --- a/pkg/registry/apis/secret/testutils/testutils.go +++ b/pkg/registry/apis/secret/testutils/testutils.go @@ -6,13 +6,13 @@ import ( "github.com/grafana/authlib/authn" "github.com/grafana/authlib/types" - secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" - "github.com/grafana/grafana/pkg/apimachinery/identity" - encryptionstorage "github.com/grafana/grafana/pkg/storage/secret/encryption" + "github.com/stretchr/testify/require" "go.opentelemetry.io/otel/trace/noop" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/utils/ptr" + secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" + "github.com/grafana/grafana/pkg/apimachinery/identity" "github.com/grafana/grafana/pkg/infra/usagestats" "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" "github.com/grafana/grafana/pkg/registry/apis/secret/decrypt" @@ -28,14 +28,13 @@ import ( "github.com/grafana/grafana/pkg/services/sqlstore" "github.com/grafana/grafana/pkg/setting" "github.com/grafana/grafana/pkg/storage/secret/database" + encryptionstorage "github.com/grafana/grafana/pkg/storage/secret/encryption" "github.com/grafana/grafana/pkg/storage/secret/metadata" "github.com/grafana/grafana/pkg/storage/secret/migrator" - "github.com/stretchr/testify/require" ) type SetupConfig struct { KeeperService contracts.KeeperService - AllowList map[string]struct{} } func defaultSetupCfg() SetupConfig { @@ -121,7 +120,7 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut { secureValueService := service.ProvideSecureValueService(tracer, accessClient, database, secureValueMetadataStorage, keeperMetadataStorage, keeperService) - decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer, setupCfg.AllowList) + decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) decryptStorage, err := metadata.ProvideDecryptStorage(features, tracer, keeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, nil) require.NoError(t, err) diff --git a/pkg/registry/apis/secret/validator/secure_value.go b/pkg/registry/apis/secret/validator/secure_value.go index 1f4130607b8..87d33f636a4 100644 --- a/pkg/registry/apis/secret/validator/secure_value.go +++ b/pkg/registry/apis/secret/validator/secure_value.go @@ -2,7 +2,6 @@ package validator import ( "errors" - "fmt" "strconv" "strings" @@ -14,16 +13,12 @@ import ( "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" ) -type secureValueValidator struct { - decryptersAllowList contracts.DecryptAllowList -} +type secureValueValidator struct{} var _ contracts.SecureValueValidator = &secureValueValidator{} -func ProvideSecureValueValidator(decryptersAllowList contracts.DecryptAllowList) contracts.SecureValueValidator { - return &secureValueValidator{ - decryptersAllowList: decryptersAllowList, - } +func ProvideSecureValueValidator() contracts.SecureValueValidator { + return &secureValueValidator{} } func (v *secureValueValidator) Validate(sv, oldSv *secretv1beta1.SecureValue, operation admission.Operation) field.ErrorList { @@ -50,7 +45,7 @@ func (v *secureValueValidator) Validate(sv, oldSv *secretv1beta1.SecureValue, op ) } - if errs := validateDecrypters(sv.Spec.Decrypters, v.decryptersAllowList); len(errs) > 0 { + if errs := validateDecrypters(sv.Spec.Decrypters); len(errs) > 0 { return errs } @@ -107,7 +102,7 @@ func validateSecureValueUpdate(sv, oldSv *secretv1beta1.SecureValue) field.Error } // validateDecrypters validates that (if populated) the `decrypters` must be unique. -func validateDecrypters(decrypters []string, decryptersAllowList map[string]struct{}) field.ErrorList { +func validateDecrypters(decrypters []string) field.ErrorList { errs := make(field.ErrorList, 0) // Limit the number of decrypters to 64 to not have it unbounded. @@ -134,20 +129,6 @@ func validateDecrypters(decrypters []string, decryptersAllowList map[string]stru continue } - // Allow List: decrypters must match exactly and be in the allowed list to be able to decrypt. - if len(decryptersAllowList) > 0 { - if _, exists := decryptersAllowList[decrypter]; !exists { - errs = append( - errs, - field.Invalid(field.NewPath("spec", "decrypters", "["+strconv.Itoa(i)+"]"), decrypter, fmt.Sprintf("allowed values: %v", decryptersAllowList)), - ) - - return errs - } - - continue - } - // Use the same validation as labels for the decrypters. if verrs := validation.IsValidLabelValue(decrypter); len(verrs) > 0 { for _, verr := range verrs { diff --git a/pkg/registry/apis/secret/validator/secure_value_test.go b/pkg/registry/apis/secret/validator/secure_value_test.go index d1c60834524..4dcf133ae4c 100644 --- a/pkg/registry/apis/secret/validator/secure_value_test.go +++ b/pkg/registry/apis/secret/validator/secure_value_test.go @@ -2,8 +2,6 @@ package validator import ( "fmt" - "maps" - "slices" "strings" "testing" @@ -31,7 +29,7 @@ func TestValidateSecureValue(t *testing.T) { sv := validSecureValue.DeepCopy() sv.Spec.Description = "" - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, nil, admission.Create) require.Len(t, errs, 1) require.Equal(t, "spec.description", errs[0].Field) @@ -43,7 +41,7 @@ func TestValidateSecureValue(t *testing.T) { sv.Spec.Value = nil sv.Spec.Ref = nil - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, nil, admission.Create) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -52,7 +50,7 @@ func TestValidateSecureValue(t *testing.T) { sv.Spec.Value = ptr.To(secretv1beta1.NewExposedSecureValue("")) sv.Spec.Ref = nil - validator = ProvideSecureValueValidator(nil) + validator = ProvideSecureValueValidator() errs = validator.Validate(sv, nil, admission.Create) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -62,7 +60,7 @@ func TestValidateSecureValue(t *testing.T) { sv.Spec.Value = ptr.To(secretv1beta1.NewExposedSecureValue("value")) sv.Spec.Ref = &ref - validator = ProvideSecureValueValidator(nil) + validator = ProvideSecureValueValidator() errs = validator.Validate(sv, nil, admission.Create) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -73,7 +71,7 @@ func TestValidateSecureValue(t *testing.T) { sv.Spec.Value = ptr.To(secretv1beta1.NewExposedSecureValue(strings.Repeat("a", contracts.SECURE_VALUE_RAW_INPUT_MAX_SIZE_BYTES+1))) sv.Spec.Ref = nil - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, nil, admission.Create) require.Len(t, errs, 1) require.Equal(t, "spec.value", errs[0].Field) @@ -95,7 +93,7 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, oldSv, admission.Update) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -115,7 +113,7 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, oldSv, admission.Update) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -137,7 +135,7 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, oldSv, admission.Update) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -148,7 +146,7 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator = ProvideSecureValueValidator(nil) + validator = ProvideSecureValueValidator() errs = validator.Validate(sv, oldSv, admission.Update) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -167,7 +165,7 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, oldSv, admission.Update) require.Empty(t, errs) }) @@ -175,7 +173,7 @@ func TestValidateSecureValue(t *testing.T) { t.Run("when the old object is `nil` it returns an error", func(t *testing.T) { sv := &secretv1beta1.SecureValue{} - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, nil, admission.Update) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -196,7 +194,7 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, oldSv, admission.Update) require.Len(t, errs, 1) require.Equal(t, "spec", errs[0].Field) @@ -216,75 +214,25 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, nil, admission.Create) require.Len(t, errs, 1) require.Equal(t, "spec.decrypters.[1]", errs[0].Field) }) - t.Run("when set, the `decrypters` must be one of the allowed in the allow list", func(t *testing.T) { - allowList := map[string]struct{}{"app1": {}, "app2": {}} - decrypters := slices.Collect(maps.Keys(allowList)) + t.Run("`decrypters` list can be empty", func(t *testing.T) { + ref := "ref" + sv := &secretv1beta1.SecureValue{ + Spec: secretv1beta1.SecureValueSpec{ + Description: "description", Ref: &ref, - t.Run("no matches, returns an error", func(t *testing.T) { - ref := "ref" - sv := &secretv1beta1.SecureValue{ - Spec: secretv1beta1.SecureValueSpec{ - Description: "description", Ref: &ref, + Decrypters: []string{}, + }, + } - Decrypters: []string{"app3"}, - }, - } - - validator := ProvideSecureValueValidator(allowList) - errs := validator.Validate(sv, nil, admission.Create) - require.Len(t, errs, 1) - }) - - t.Run("no decrypters, returns no error", func(t *testing.T) { - ref := "ref" - sv := &secretv1beta1.SecureValue{ - Spec: secretv1beta1.SecureValueSpec{ - Description: "description", Ref: &ref, - - Decrypters: []string{}, - }, - } - - validator := ProvideSecureValueValidator(allowList) - errs := validator.Validate(sv, nil, admission.Create) - require.Empty(t, errs) - }) - - t.Run("one match, returns no errors", func(t *testing.T) { - ref := "ref" - sv := &secretv1beta1.SecureValue{ - Spec: secretv1beta1.SecureValueSpec{ - Description: "description", Ref: &ref, - - Decrypters: []string{decrypters[0]}, - }, - } - - validator := ProvideSecureValueValidator(allowList) - errs := validator.Validate(sv, nil, admission.Create) - require.Empty(t, errs) - }) - - t.Run("all matches, returns no errors", func(t *testing.T) { - ref := "ref" - sv := &secretv1beta1.SecureValue{ - Spec: secretv1beta1.SecureValueSpec{ - Description: "description", Ref: &ref, - - Decrypters: decrypters, - }, - } - - validator := ProvideSecureValueValidator(allowList) - errs := validator.Validate(sv, nil, admission.Create) - require.Empty(t, errs) - }) + validator := ProvideSecureValueValidator() + errs := validator.Validate(sv, nil, admission.Create) + require.Empty(t, errs) }) t.Run("`decrypters` must be a valid label value", func(t *testing.T) { @@ -310,7 +258,7 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, nil, admission.Create) require.Len(t, errs, 3) }) @@ -330,7 +278,7 @@ func TestValidateSecureValue(t *testing.T) { }, } - validator := ProvideSecureValueValidator(nil) + validator := ProvideSecureValueValidator() errs := validator.Validate(sv, nil, admission.Create) require.Len(t, errs, 1) require.Equal(t, "spec.decrypters", errs[0].Field) diff --git a/pkg/server/wire.go b/pkg/server/wire.go index 6b9d84eade8..d32e3ca6586 100644 --- a/pkg/server/wire.go +++ b/pkg/server/wire.go @@ -13,7 +13,6 @@ import ( "go.opentelemetry.io/otel/trace" sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient" - "github.com/grafana/grafana/pkg/api" "github.com/grafana/grafana/pkg/api/avatar" "github.com/grafana/grafana/pkg/api/routing" @@ -426,7 +425,6 @@ var wireBasicSet = wire.NewSet( secretmetadata.ProvideKeeperMetadataStorage, secretmetadata.ProvideDecryptStorage, secretdecrypt.ProvideDecryptAuthorizer, - secretdecrypt.ProvideDecryptAllowList, secretdecrypt.ProvideDecryptService, secretencryption.ProvideDataKeyStorage, secretencryption.ProvideEncryptedValueStorage, diff --git a/pkg/server/wire_gen.go b/pkg/server/wire_gen.go index 0550f5a1a5a..cf5ca670c22 100644 --- a/pkg/server/wire_gen.go +++ b/pkg/server/wire_gen.go @@ -771,8 +771,7 @@ func Initialize(cfg *setting.Cfg, opts Options, apiOpts api.ServerOptions) (*Ser return nil, err } secureValueService := service12.ProvideSecureValueService(tracer, accessClient, databaseDatabase, secureValueMetadataStorage, keeperMetadataStorage, ossKeeperService) - decryptAllowList := decrypt.ProvideDecryptAllowList() - decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer, decryptAllowList) + decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) decryptStorage, err := metadata.ProvideDecryptStorage(featureToggles, tracer, ossKeeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, registerer) if err != nil { return nil, err @@ -1321,8 +1320,7 @@ func InitializeForTest(t sqlutil.ITestDB, testingT interface { return nil, err } secureValueService := service12.ProvideSecureValueService(tracer, accessClient, databaseDatabase, secureValueMetadataStorage, keeperMetadataStorage, ossKeeperService) - decryptAllowList := decrypt.ProvideDecryptAllowList() - decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer, decryptAllowList) + decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) decryptStorage, err := metadata.ProvideDecryptStorage(featureToggles, tracer, ossKeeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, registerer) if err != nil { return nil, err @@ -1515,7 +1513,7 @@ var withOTelSet = wire.NewSet( otelTracer, grpcserver.ProvideService, interceptors.ProvideAuthenticator, ) -var wireBasicSet = wire.NewSet(annotationsimpl.ProvideService, wire.Bind(new(annotations.Repository), new(*annotationsimpl.RepositoryImpl)), New, api.ProvideHTTPServer, query.ProvideService, wire.Bind(new(query.Service), new(*query.ServiceImpl)), bus.ProvideBus, wire.Bind(new(bus.Bus), new(*bus.InProcBus)), rendering.ProvideService, wire.Bind(new(rendering.Service), new(*rendering.RenderingService)), routing.ProvideRegister, wire.Bind(new(routing.RouteRegister), new(*routing.RouteRegisterImpl)), hooks.ProvideService, kvstore.ProvideService, localcache.ProvideService, bundleregistry.ProvideService, wire.Bind(new(supportbundles.Service), new(*bundleregistry.Service)), updatemanager.ProvideGrafanaService, updatemanager.ProvidePluginsService, service.ProvideService, wire.Bind(new(usagestats.Service), new(*service.UsageStats)), validator2.ProvideService, legacy.ProvideLegacyMigrator, pluginsintegration.WireSet, dashboards.ProvideFileStoreManager, wire.Bind(new(dashboards.FileStore), new(*dashboards.FileStoreManager)), cloudwatch.ProvideService, cloudmonitoring.ProvideService, azuremonitor.ProvideService, postgres.ProvideService, mysql.ProvideService, mssql.ProvideService, store.ProvideEntityEventsService, dualwrite.ProvideService, httpclientprovider.New, wire.Bind(new(httpclient.Provider), new(*httpclient2.Provider)), serverlock.ProvideService, annotationsimpl.ProvideCleanupService, wire.Bind(new(annotations.Cleaner), new(*annotationsimpl.CleanupServiceImpl)), cleanup.ProvideService, shorturlimpl.ProvideService, wire.Bind(new(shorturls.Service), new(*shorturlimpl.ShortURLService)), queryhistory.ProvideService, wire.Bind(new(queryhistory.Service), new(*queryhistory.QueryHistoryService)), correlations.ProvideService, wire.Bind(new(correlations.Service), new(*correlations.CorrelationsService)), quotaimpl.ProvideService, remotecache.ProvideService, wire.Bind(new(remotecache.CacheStorage), new(*remotecache.RemoteCache)), authinfoimpl.ProvideService, wire.Bind(new(login.AuthInfoService), new(*authinfoimpl.Service)), authinfoimpl.ProvideStore, datasourceproxy.ProvideService, sort.ProvideService, search2.ProvideService, searchV2.ProvideService, searchV2.ProvideSearchHTTPService, store.ProvideService, store.ProvideSystemUsersService, live.ProvideService, pushhttp.ProvideService, contexthandler.ProvideService, service10.ProvideService, wire.Bind(new(service10.LDAP), new(*service10.LDAPImpl)), jwt.ProvideService, wire.Bind(new(jwt.JWTService), new(*jwt.AuthService)), store2.ProvideDBStore, image.ProvideDeleteExpiredService, ngalert.ProvideService, librarypanels.ProvideService, wire.Bind(new(librarypanels.Service), new(*librarypanels.LibraryPanelService)), libraryelements.ProvideService, wire.Bind(new(libraryelements.Service), new(*libraryelements.LibraryElementService)), notifications.ProvideService, notifications.ProvideSmtpService, github.ProvideFactory, tracing.ProvideService, tracing.ProvideTracingConfig, wire.Bind(new(tracing.Tracer), new(*tracing.TracingService)), withOTelSet, testdatasource.ProvideService, api4.ProvideService, opentsdb.ProvideService, socialimpl.ProvideService, influxdb.ProvideService, wire.Bind(new(social.Service), new(*socialimpl.SocialService)), tempo.ProvideService, loki.ProvideService, graphite.ProvideService, prometheus.ProvideService, elasticsearch.ProvideService, pyroscope.ProvideService, parca.ProvideService, zipkin.ProvideService, jaeger.ProvideService, service7.ProvideCacheService, wire.Bind(new(datasources.CacheService), new(*service7.CacheServiceImpl)), service2.ProvideEncryptionService, wire.Bind(new(encryption2.Internal), new(*service2.Service)), manager.ProvideSecretsService, wire.Bind(new(secrets2.Service), new(*manager.SecretsService)), database.ProvideSecretsStore, wire.Bind(new(secrets2.Store), new(*database.SecretsStoreImpl)), grafanads.ProvideService, wire.Bind(new(dashboardsnapshots.Store), new(*database4.DashboardSnapshotStore)), database4.ProvideStore, wire.Bind(new(dashboardsnapshots.Service), new(*service8.ServiceImpl)), service8.ProvideService, service7.ProvideService, wire.Bind(new(datasources.DataSourceService), new(*service7.Service)), service7.ProvideLegacyDataSourceLookup, retriever.ProvideService, wire.Bind(new(serviceaccounts.ServiceAccountRetriever), new(*retriever.Service)), ossaccesscontrol.ProvideServiceAccountPermissions, wire.Bind(new(accesscontrol.ServiceAccountPermissionsService), new(*ossaccesscontrol.ServiceAccountPermissionsService)), manager2.ProvideServiceAccountsService, proxy.ProvideServiceAccountsProxy, wire.Bind(new(serviceaccounts.Service), new(*proxy.ServiceAccountsProxy)), expr.ProvideService, featuremgmt.ProvideManagerService, featuremgmt.ProvideToggles, service5.ProvideDashboardServiceImpl, wire.Bind(new(dashboards2.PermissionsRegistrationService), new(*service5.DashboardServiceImpl)), service5.ProvideDashboardService, service5.ProvideDashboardProvisioningService, service5.ProvideDashboardPluginService, database2.ProvideDashboardStore, folderimpl.ProvideService, wire.Bind(new(folder.Service), new(*folderimpl.Service)), folderimpl.ProvideStore, wire.Bind(new(folder.Store), new(*folderimpl.FolderStoreImpl)), folderimpl.ProvideDashboardFolderStore, wire.Bind(new(folder.FolderStore), new(*folderimpl.DashboardFolderStoreImpl)), service9.ProvideService, wire.Bind(new(dashboardimport.Service), new(*service9.ImportDashboardService)), service6.ProvideService, wire.Bind(new(plugindashboards.Service), new(*service6.Service)), service6.ProvideDashboardUpdater, sanitizer.ProvideService, kvstore2.ProvideService, avatar.ProvideAvatarCacheServer, statscollector.ProvideService, csrf.ProvideCSRFFilter, wire.Bind(new(csrf.Service), new(*csrf.CSRF)), ossaccesscontrol.ProvideTeamPermissions, wire.Bind(new(accesscontrol.TeamPermissionsService), new(*ossaccesscontrol.TeamPermissionsService)), ossaccesscontrol.ProvideFolderPermissions, wire.Bind(new(accesscontrol.FolderPermissionsService), new(*ossaccesscontrol.FolderPermissionsService)), ossaccesscontrol.ProvideDashboardPermissions, wire.Bind(new(accesscontrol.DashboardPermissionsService), new(*ossaccesscontrol.DashboardPermissionsService)), ossaccesscontrol.ProvideReceiverPermissionsService, wire.Bind(new(accesscontrol.ReceiverPermissionsService), new(*ossaccesscontrol.ReceiverPermissionsService)), starimpl.ProvideService, playlistimpl.ProvideService, apikeyimpl.ProvideService, dashverimpl.ProvideService, service3.ProvideService, wire.Bind(new(publicdashboards.Service), new(*service3.PublicDashboardServiceImpl)), database3.ProvideStore, wire.Bind(new(publicdashboards.Store), new(*database3.PublicDashboardStoreImpl)), metric.ProvideService, api2.ProvideApi, api3.ProvideApi, userimpl.ProvideService, orgimpl.ProvideService, orgimpl.ProvideDeletionService, statsimpl.ProvideService, grpccontext.ProvideContextHandler, grpcserver.ProvideHealthService, grpcserver.ProvideReflectionService, resolver.ProvideEntityReferenceResolver, teamimpl.ProvideService, teamapi.ProvideTeamAPI, tempuserimpl.ProvideService, loginattemptimpl.ProvideService, wire.Bind(new(loginattempt.Service), new(*loginattemptimpl.Service)), migrations2.ProvideDataSourceMigrationService, migrations2.ProvideSecretMigrationProvider, wire.Bind(new(migrations2.SecretMigrationProvider), new(*migrations2.SecretMigrationProviderImpl)), resourcepermissions.NewActionSetService, wire.Bind(new(accesscontrol.ActionResolver), new(resourcepermissions.ActionSetService)), wire.Bind(new(pluginaccesscontrol.ActionSetRegistry), new(resourcepermissions.ActionSetService)), permreg.ProvidePermissionRegistry, acimpl.ProvideAccessControl, dualwrite2.ProvideZanzanaReconciler, navtreeimpl.ProvideService, wire.Bind(new(accesscontrol.AccessControl), new(*acimpl.AccessControl)), wire.Bind(new(notifications.TempUserStore), new(tempuser.Service)), tagimpl.ProvideService, wire.Bind(new(tag.Service), new(*tagimpl.Service)), authnimpl.ProvideService, authnimpl.ProvideIdentitySynchronizer, authnimpl.ProvideAuthnService, authnimpl.ProvideAuthnServiceAuthenticateOnly, authnimpl.ProvideRegistration, supportbundlesimpl.ProvideService, extsvcaccounts.ProvideExtSvcAccountsService, wire.Bind(new(serviceaccounts.ExtSvcAccountsService), new(*extsvcaccounts.ExtSvcAccountsService)), registry2.ProvideExtSvcRegistry, wire.Bind(new(extsvcauth.ExternalServiceRegistry), new(*registry2.Registry)), anonstore.ProvideAnonDBStore, wire.Bind(new(anonstore.AnonStore), new(*anonstore.AnonDBStore)), loggermw.Provide, slogadapter.Provide, signingkeysimpl.ProvideEmbeddedSigningKeysService, wire.Bind(new(signingkeys.Service), new(*signingkeysimpl.Service)), ssosettingsimpl.ProvideService, wire.Bind(new(ssosettings.Service), new(*ssosettingsimpl.Service)), idimpl.ProvideService, wire.Bind(new(auth.IDService), new(*idimpl.Service)), cloudmigrationimpl.ProvideService, userimpl.ProvideVerifier, connectors.ProvideOrgRoleMapper, wire.Bind(new(user.Verifier), new(*userimpl.Verifier)), authz.WireSet, metadata.ProvideSecureValueMetadataStorage, metadata.ProvideKeeperMetadataStorage, metadata.ProvideDecryptStorage, decrypt.ProvideDecryptAuthorizer, decrypt.ProvideDecryptAllowList, decrypt.ProvideDecryptService, encryption.ProvideDataKeyStorage, encryption.ProvideEncryptedValueStorage, service12.ProvideSecureValueService, validator3.ProvideKeeperValidator, validator3.ProvideSecureValueValidator, migrator2.NewWithEngine, database5.ProvideDatabase, wire.Bind(new(contracts.Database), new(*database5.Database)), manager4.ProvideEncryptionManager, service11.ProvideAESGCMCipherService, resource.ProvideStorageMetrics, resource.ProvideIndexMetrics, apiserver.WireSet, apiregistry.WireSet, appregistry.WireSet) +var wireBasicSet = wire.NewSet(annotationsimpl.ProvideService, wire.Bind(new(annotations.Repository), new(*annotationsimpl.RepositoryImpl)), New, api.ProvideHTTPServer, query.ProvideService, wire.Bind(new(query.Service), new(*query.ServiceImpl)), bus.ProvideBus, wire.Bind(new(bus.Bus), new(*bus.InProcBus)), rendering.ProvideService, wire.Bind(new(rendering.Service), new(*rendering.RenderingService)), routing.ProvideRegister, wire.Bind(new(routing.RouteRegister), new(*routing.RouteRegisterImpl)), hooks.ProvideService, kvstore.ProvideService, localcache.ProvideService, bundleregistry.ProvideService, wire.Bind(new(supportbundles.Service), new(*bundleregistry.Service)), updatemanager.ProvideGrafanaService, updatemanager.ProvidePluginsService, service.ProvideService, wire.Bind(new(usagestats.Service), new(*service.UsageStats)), validator2.ProvideService, legacy.ProvideLegacyMigrator, pluginsintegration.WireSet, dashboards.ProvideFileStoreManager, wire.Bind(new(dashboards.FileStore), new(*dashboards.FileStoreManager)), cloudwatch.ProvideService, cloudmonitoring.ProvideService, azuremonitor.ProvideService, postgres.ProvideService, mysql.ProvideService, mssql.ProvideService, store.ProvideEntityEventsService, dualwrite.ProvideService, httpclientprovider.New, wire.Bind(new(httpclient.Provider), new(*httpclient2.Provider)), serverlock.ProvideService, annotationsimpl.ProvideCleanupService, wire.Bind(new(annotations.Cleaner), new(*annotationsimpl.CleanupServiceImpl)), cleanup.ProvideService, shorturlimpl.ProvideService, wire.Bind(new(shorturls.Service), new(*shorturlimpl.ShortURLService)), queryhistory.ProvideService, wire.Bind(new(queryhistory.Service), new(*queryhistory.QueryHistoryService)), correlations.ProvideService, wire.Bind(new(correlations.Service), new(*correlations.CorrelationsService)), quotaimpl.ProvideService, remotecache.ProvideService, wire.Bind(new(remotecache.CacheStorage), new(*remotecache.RemoteCache)), authinfoimpl.ProvideService, wire.Bind(new(login.AuthInfoService), new(*authinfoimpl.Service)), authinfoimpl.ProvideStore, datasourceproxy.ProvideService, sort.ProvideService, search2.ProvideService, searchV2.ProvideService, searchV2.ProvideSearchHTTPService, store.ProvideService, store.ProvideSystemUsersService, live.ProvideService, pushhttp.ProvideService, contexthandler.ProvideService, service10.ProvideService, wire.Bind(new(service10.LDAP), new(*service10.LDAPImpl)), jwt.ProvideService, wire.Bind(new(jwt.JWTService), new(*jwt.AuthService)), store2.ProvideDBStore, image.ProvideDeleteExpiredService, ngalert.ProvideService, librarypanels.ProvideService, wire.Bind(new(librarypanels.Service), new(*librarypanels.LibraryPanelService)), libraryelements.ProvideService, wire.Bind(new(libraryelements.Service), new(*libraryelements.LibraryElementService)), notifications.ProvideService, notifications.ProvideSmtpService, github.ProvideFactory, tracing.ProvideService, tracing.ProvideTracingConfig, wire.Bind(new(tracing.Tracer), new(*tracing.TracingService)), withOTelSet, testdatasource.ProvideService, api4.ProvideService, opentsdb.ProvideService, socialimpl.ProvideService, influxdb.ProvideService, wire.Bind(new(social.Service), new(*socialimpl.SocialService)), tempo.ProvideService, loki.ProvideService, graphite.ProvideService, prometheus.ProvideService, elasticsearch.ProvideService, pyroscope.ProvideService, parca.ProvideService, zipkin.ProvideService, jaeger.ProvideService, service7.ProvideCacheService, wire.Bind(new(datasources.CacheService), new(*service7.CacheServiceImpl)), service2.ProvideEncryptionService, wire.Bind(new(encryption2.Internal), new(*service2.Service)), manager.ProvideSecretsService, wire.Bind(new(secrets2.Service), new(*manager.SecretsService)), database.ProvideSecretsStore, wire.Bind(new(secrets2.Store), new(*database.SecretsStoreImpl)), grafanads.ProvideService, wire.Bind(new(dashboardsnapshots.Store), new(*database4.DashboardSnapshotStore)), database4.ProvideStore, wire.Bind(new(dashboardsnapshots.Service), new(*service8.ServiceImpl)), service8.ProvideService, service7.ProvideService, wire.Bind(new(datasources.DataSourceService), new(*service7.Service)), service7.ProvideLegacyDataSourceLookup, retriever.ProvideService, wire.Bind(new(serviceaccounts.ServiceAccountRetriever), new(*retriever.Service)), ossaccesscontrol.ProvideServiceAccountPermissions, wire.Bind(new(accesscontrol.ServiceAccountPermissionsService), new(*ossaccesscontrol.ServiceAccountPermissionsService)), manager2.ProvideServiceAccountsService, proxy.ProvideServiceAccountsProxy, wire.Bind(new(serviceaccounts.Service), new(*proxy.ServiceAccountsProxy)), expr.ProvideService, featuremgmt.ProvideManagerService, featuremgmt.ProvideToggles, service5.ProvideDashboardServiceImpl, wire.Bind(new(dashboards2.PermissionsRegistrationService), new(*service5.DashboardServiceImpl)), service5.ProvideDashboardService, service5.ProvideDashboardProvisioningService, service5.ProvideDashboardPluginService, database2.ProvideDashboardStore, folderimpl.ProvideService, wire.Bind(new(folder.Service), new(*folderimpl.Service)), folderimpl.ProvideStore, wire.Bind(new(folder.Store), new(*folderimpl.FolderStoreImpl)), folderimpl.ProvideDashboardFolderStore, wire.Bind(new(folder.FolderStore), new(*folderimpl.DashboardFolderStoreImpl)), service9.ProvideService, wire.Bind(new(dashboardimport.Service), new(*service9.ImportDashboardService)), service6.ProvideService, wire.Bind(new(plugindashboards.Service), new(*service6.Service)), service6.ProvideDashboardUpdater, sanitizer.ProvideService, kvstore2.ProvideService, avatar.ProvideAvatarCacheServer, statscollector.ProvideService, csrf.ProvideCSRFFilter, wire.Bind(new(csrf.Service), new(*csrf.CSRF)), ossaccesscontrol.ProvideTeamPermissions, wire.Bind(new(accesscontrol.TeamPermissionsService), new(*ossaccesscontrol.TeamPermissionsService)), ossaccesscontrol.ProvideFolderPermissions, wire.Bind(new(accesscontrol.FolderPermissionsService), new(*ossaccesscontrol.FolderPermissionsService)), ossaccesscontrol.ProvideDashboardPermissions, wire.Bind(new(accesscontrol.DashboardPermissionsService), new(*ossaccesscontrol.DashboardPermissionsService)), ossaccesscontrol.ProvideReceiverPermissionsService, wire.Bind(new(accesscontrol.ReceiverPermissionsService), new(*ossaccesscontrol.ReceiverPermissionsService)), starimpl.ProvideService, playlistimpl.ProvideService, apikeyimpl.ProvideService, dashverimpl.ProvideService, service3.ProvideService, wire.Bind(new(publicdashboards.Service), new(*service3.PublicDashboardServiceImpl)), database3.ProvideStore, wire.Bind(new(publicdashboards.Store), new(*database3.PublicDashboardStoreImpl)), metric.ProvideService, api2.ProvideApi, api3.ProvideApi, userimpl.ProvideService, orgimpl.ProvideService, orgimpl.ProvideDeletionService, statsimpl.ProvideService, grpccontext.ProvideContextHandler, grpcserver.ProvideHealthService, grpcserver.ProvideReflectionService, resolver.ProvideEntityReferenceResolver, teamimpl.ProvideService, teamapi.ProvideTeamAPI, tempuserimpl.ProvideService, loginattemptimpl.ProvideService, wire.Bind(new(loginattempt.Service), new(*loginattemptimpl.Service)), migrations2.ProvideDataSourceMigrationService, migrations2.ProvideSecretMigrationProvider, wire.Bind(new(migrations2.SecretMigrationProvider), new(*migrations2.SecretMigrationProviderImpl)), resourcepermissions.NewActionSetService, wire.Bind(new(accesscontrol.ActionResolver), new(resourcepermissions.ActionSetService)), wire.Bind(new(pluginaccesscontrol.ActionSetRegistry), new(resourcepermissions.ActionSetService)), permreg.ProvidePermissionRegistry, acimpl.ProvideAccessControl, dualwrite2.ProvideZanzanaReconciler, navtreeimpl.ProvideService, wire.Bind(new(accesscontrol.AccessControl), new(*acimpl.AccessControl)), wire.Bind(new(notifications.TempUserStore), new(tempuser.Service)), tagimpl.ProvideService, wire.Bind(new(tag.Service), new(*tagimpl.Service)), authnimpl.ProvideService, authnimpl.ProvideIdentitySynchronizer, authnimpl.ProvideAuthnService, authnimpl.ProvideAuthnServiceAuthenticateOnly, authnimpl.ProvideRegistration, supportbundlesimpl.ProvideService, extsvcaccounts.ProvideExtSvcAccountsService, wire.Bind(new(serviceaccounts.ExtSvcAccountsService), new(*extsvcaccounts.ExtSvcAccountsService)), registry2.ProvideExtSvcRegistry, wire.Bind(new(extsvcauth.ExternalServiceRegistry), new(*registry2.Registry)), anonstore.ProvideAnonDBStore, wire.Bind(new(anonstore.AnonStore), new(*anonstore.AnonDBStore)), loggermw.Provide, slogadapter.Provide, signingkeysimpl.ProvideEmbeddedSigningKeysService, wire.Bind(new(signingkeys.Service), new(*signingkeysimpl.Service)), ssosettingsimpl.ProvideService, wire.Bind(new(ssosettings.Service), new(*ssosettingsimpl.Service)), idimpl.ProvideService, wire.Bind(new(auth.IDService), new(*idimpl.Service)), cloudmigrationimpl.ProvideService, userimpl.ProvideVerifier, connectors.ProvideOrgRoleMapper, wire.Bind(new(user.Verifier), new(*userimpl.Verifier)), authz.WireSet, metadata.ProvideSecureValueMetadataStorage, metadata.ProvideKeeperMetadataStorage, metadata.ProvideDecryptStorage, decrypt.ProvideDecryptAuthorizer, decrypt.ProvideDecryptService, encryption.ProvideDataKeyStorage, encryption.ProvideEncryptedValueStorage, service12.ProvideSecureValueService, validator3.ProvideKeeperValidator, validator3.ProvideSecureValueValidator, migrator2.NewWithEngine, database5.ProvideDatabase, wire.Bind(new(contracts.Database), new(*database5.Database)), manager4.ProvideEncryptionManager, service11.ProvideAESGCMCipherService, resource.ProvideStorageMetrics, resource.ProvideIndexMetrics, apiserver.WireSet, apiregistry.WireSet, appregistry.WireSet) var wireSet = wire.NewSet( wireBasicSet, metrics.WireSet, sqlstore.ProvideService, metrics2.ProvideService, wire.Bind(new(notifications.Service), new(*notifications.NotificationService)), wire.Bind(new(notifications.WebhookSender), new(*notifications.NotificationService)), wire.Bind(new(notifications.EmailSender), new(*notifications.NotificationService)), wire.Bind(new(db.DB), new(*sqlstore.SQLStore)), prefimpl.ProvideService, oauthtoken.ProvideService, wire.Bind(new(oauthtoken.OAuthTokenService), new(*oauthtoken.Service)), wire.Bind(new(cleanup.AlertRuleService), new(*store2.DBstore)), diff --git a/pkg/storage/secret/metadata/decrypt_store_test.go b/pkg/storage/secret/metadata/decrypt_store_test.go index b3ad4643b8a..08e22e6bc6e 100644 --- a/pkg/storage/secret/metadata/decrypt_store_test.go +++ b/pkg/storage/secret/metadata/decrypt_store_test.go @@ -44,53 +44,13 @@ func TestIntegrationDecrypt(t *testing.T) { // Create auth context with proper permissions authCtx := createAuthContext(ctx, "default", []string{"secret.grafana.app/securevalues/group1:decrypt"}, "svc", types.TypeUser) - sut := testutils.Setup(t, testutils.WithMutateCfg(func(sc *testutils.SetupConfig) { - sc.AllowList = map[string]struct{}{"group1": {}} - })) + sut := testutils.Setup(t) exposed, err := sut.DecryptStorage.Decrypt(authCtx, "default", "non-existent-value") require.ErrorIs(t, err, contracts.ErrDecryptNotFound) require.Empty(t, exposed) }) - t.Run("when auth info is not in allowlist, it returns an unauthorized error", func(t *testing.T) { - t.Parallel() - - ctx, cancel := context.WithCancel(context.Background()) - t.Cleanup(cancel) - - svName := "sv-test" - svcIdentity := "svc" - - // Create auth context with identity that is not in allowlist - authCtx := createAuthContext(ctx, "default", []string{"secret.grafana.app/securevalues/" + svName + ":decrypt"}, svcIdentity, types.TypeUser) - - // Create an allowlist that doesn't include the permission - allowList := map[string]struct{}{"allowed-group": {}} - - // Setup service - sut := testutils.Setup(t, testutils.WithMutateCfg(func(sc *testutils.SetupConfig) { - sc.AllowList = allowList - })) - - // Create a secure value that is not in the allowlist - spec := secretv1beta1.SecureValueSpec{ - Description: "description", - Decrypters: []string{svcIdentity}, - Value: ptr.To(secretv1beta1.NewExposedSecureValue("value")), - } - sv := &secretv1beta1.SecureValue{Spec: spec} - sv.Name = svName - sv.Namespace = "default" - - _, err := sut.CreateSv(authCtx, testutils.CreateSvWithSv(sv)) - require.NoError(t, err) - - exposed, err := sut.DecryptStorage.Decrypt(authCtx, "default", svName) - require.ErrorIs(t, err, contracts.ErrDecryptNotAuthorized) - require.Empty(t, exposed) - }) - t.Run("when happy path with valid auth and permissions, it returns decrypted value", func(t *testing.T) { t.Parallel() @@ -102,15 +62,10 @@ func TestIntegrationDecrypt(t *testing.T) { // Create auth context with proper permissions that match the decrypters authCtx := createAuthContext(ctx, "default", []string{"secret.grafana.app/securevalues:decrypt"}, svcIdentity, types.TypeUser) - // Include the group in allowlist - allowList := map[string]struct{}{svcIdentity: {}} - // Setup service - sut := testutils.Setup(t, testutils.WithMutateCfg(func(sc *testutils.SetupConfig) { - sc.AllowList = allowList - })) + sut := testutils.Setup(t) - // Create a secure value that is in the allowlist + // Create a secure value spec := secretv1beta1.SecureValueSpec{ Description: "description", Decrypters: []string{svcIdentity}, @@ -141,15 +96,10 @@ func TestIntegrationDecrypt(t *testing.T) { // Create auth context with proper permissions that match the decrypters authCtx := createAuthContext(ctx, "default", []string{"secret.grafana.app/securevalues/sv-test2:decrypt"}, svcIdentity, types.TypeUser) - // Include the group in allowlist - allowList := map[string]struct{}{svcIdentity: {}} - // Setup service - sut := testutils.Setup(t, testutils.WithMutateCfg(func(sc *testutils.SetupConfig) { - sc.AllowList = allowList - })) + sut := testutils.Setup(t) - // Create a secure value that is in the allowlist + // Create a secure value spec := secretv1beta1.SecureValueSpec{ Description: "description", Decrypters: []string{svcIdentity},