Security: Add secrets service (#39418)

* Add secrets service

* Revert accidental changes in util encryption

* Make minor changes

Move functional options to models

Revert renaming types to models

* Add context

* Minor change in GetDataKey

* Use CreateDataKeyWithDBSession in CreateDataKey

* Handle empty DEK name in DeleteDataKey

* Rename defaultProvider

* Remove secrets store service

pkg/util/encryption.go

@@ -15,6 +15,8 @@ import (
 const saltLength = 8
 
 // Decrypt decrypts a payload with a given secret.
+// Deprecated. Do not use it.
+// Use encryption.Service instead.
 var Decrypt = func(payload []byte, secret string) ([]byte, error) {
 	if len(payload) < saltLength {
 		return nil, fmt.Errorf("unable to compute salt")
@@ -47,6 +49,8 @@ var Decrypt = func(payload []byte, secret string) ([]byte, error) {
 }
 
 // Encrypt encrypts a payload with a given secret.
+// Deprecated. Do not use it.
+// Use encryption.Service instead.
 var Encrypt = func(payload []byte, secret string) ([]byte, error) {
 	salt, err := GetRandomString(saltLength)
 	if err != nil {

pkg/util/encryption_test.go

@@ -28,7 +28,7 @@ func TestEncryption(t *testing.T) {
 		assert.Equal(t, []byte("grafana"), decrypted)
 	})
 
-	t.Run("decrypting empty payload should not fail", func(t *testing.T) {
+	t.Run("decrypting empty payload should fail", func(t *testing.T) {
 		_, err := Decrypt([]byte(""), "1234")
 		require.Error(t, err)