SaveExternalService (OAuth) on plugin load (#69764)

pkg/services/pluginsintegration/config/config.go

@@ -39,6 +39,7 @@ func ProvideConfig(settingProvider setting.Provider, grafanaCfg *setting.Cfg, fe
 		grafanaCfg.BuildVersion,
 		grafanaCfg.PluginLogBackendRequests,
 		grafanaCfg.PluginsCDNURLTemplate,
+		grafanaCfg.AppURL,
 		tracingCfg,
 		featuremgmt.ProvideToggles(features),
 		grafanaCfg.AngularSupportEnabled,

pkg/services/pluginsintegration/pluginsintegration.go

@@ -20,6 +20,7 @@ import (
 	"github.com/grafana/grafana/pkg/plugins/manager/signature"
 	"github.com/grafana/grafana/pkg/plugins/manager/sources"
 	"github.com/grafana/grafana/pkg/plugins/manager/store"
+	"github.com/grafana/grafana/pkg/plugins/oauth"
 	"github.com/grafana/grafana/pkg/plugins/pluginscdn"
 	"github.com/grafana/grafana/pkg/plugins/repo"
 	"github.com/grafana/grafana/pkg/services/caching"
@@ -35,6 +36,7 @@ import (
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/plugincontext"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginsettings"
 	pluginSettings "github.com/grafana/grafana/pkg/services/pluginsintegration/pluginsettings/service"
+	"github.com/grafana/grafana/pkg/services/pluginsintegration/serviceregistration"
 	"github.com/grafana/grafana/pkg/setting"
 )
 
@@ -80,6 +82,8 @@ var WireSet = wire.NewSet(
 	wire.Bind(new(plugins.KeyRetriever), new(*keyretriever.Service)),
 	keyretriever.ProvideService,
 	dynamic.ProvideService,
+	serviceregistration.ProvideService,
+	wire.Bind(new(oauth.ExternalServiceRegistry), new(*serviceregistration.Service)),
 )
 
 // WireExtensionSet provides a wire.ProviderSet of plugin providers that can be

pkg/services/pluginsintegration/serviceregistration/serviceregistration.go

@@ -0,0 +1,62 @@
+package serviceregistration
+
+import (
+	"context"
+
+	"github.com/grafana/grafana/pkg/plugins/oauth"
+	"github.com/grafana/grafana/pkg/services/oauthserver"
+)
+
+type Service struct {
+	os oauthserver.OAuth2Server
+}
+
+func ProvideService(os oauthserver.OAuth2Server) *Service {
+	s := &Service{
+		os: os,
+	}
+	return s
+}
+
+// RegisterExternalService is a simplified wrapper around SaveExternalService for the plugin use case.
+func (s *Service) RegisterExternalService(ctx context.Context, svcName string, svc *oauth.ExternalServiceRegistration) (*oauth.ExternalService, error) {
+	impersonation := oauthserver.ImpersonationCfg{}
+	if svc.Impersonation != nil {
+		impersonation.Permissions = svc.Impersonation.Permissions
+		if svc.Impersonation.Enabled != nil {
+			impersonation.Enabled = *svc.Impersonation.Enabled
+		} else {
+			impersonation.Enabled = true
+		}
+		if svc.Impersonation.Groups != nil {
+			impersonation.Groups = *svc.Impersonation.Groups
+		} else {
+			impersonation.Groups = true
+		}
+	}
+
+	self := oauthserver.SelfCfg{}
+	if svc.Self != nil {
+		self.Permissions = svc.Self.Permissions
+		if svc.Self.Enabled != nil {
+			self.Enabled = *svc.Self.Enabled
+		} else {
+			self.Enabled = true
+		}
+	}
+	extSvc, err := s.os.SaveExternalService(ctx, &oauthserver.ExternalServiceRegistration{
+		Name:          svcName,
+		Impersonation: impersonation,
+		Self:          self,
+		Key:           &oauthserver.KeyOption{Generate: true},
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &oauth.ExternalService{
+		ClientID:     extSvc.ID,
+		ClientSecret: extSvc.Secret,
+		PrivateKey:   extSvc.KeyResult.PrivatePem,
+	}, nil
+}