Plugins: Forward user header (X-Grafana-User) in backend plugin requests (#58646)

Grafana would forward the X-Grafana-User header to backend plugin request when 
dataproxy.send_user_header is enabled. In addition, X-Grafana-User will be automatically
forwarded in outgoing HTTP requests for core/builtin HTTP datasources. 
Use grafana-plugin-sdk-go v0.147.0.

Fixes #47734

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>

pkg/api/pluginproxy/ds_proxy.go

@@ -222,7 +222,7 @@ func (proxy *DataSourceProxy) director(req *http.Request) {
 		req.Header.Set("Authorization", dsAuth)
 	}
 
-	applyUserHeader(proxy.cfg.SendUserHeader, req, proxy.ctx.SignedInUser)
+	proxyutil.ApplyUserHeader(proxy.cfg.SendUserHeader, req, proxy.ctx.SignedInUser)
 
 	proxyutil.ClearCookieHeader(req, proxy.ds.AllowedCookies(), []string{proxy.cfg.LoginCookieName})
 	req.Header.Set("User-Agent", fmt.Sprintf("Grafana/%s", setting.BuildVersion))

pkg/api/pluginproxy/pluginproxy.go

@@ -154,7 +154,7 @@ func (proxy PluginProxy) director(req *http.Request) {
 
 	req.Header.Set("X-Grafana-Context", string(ctxJSON))
 
-	applyUserHeader(proxy.cfg.SendUserHeader, req, proxy.ctx.SignedInUser)
+	proxyutil.ApplyUserHeader(proxy.cfg.SendUserHeader, req, proxy.ctx.SignedInUser)
 
 	if err := addHeaders(&req.Header, proxy.matchedRoute, data); err != nil {
 		proxy.ctx.JsonApiErr(500, "Failed to render plugin headers", err)

pkg/api/pluginproxy/utils.go

@@ -9,7 +9,6 @@ import (
 	"text/template"
 
 	"github.com/grafana/grafana/pkg/plugins"
-	"github.com/grafana/grafana/pkg/services/user"
 )
 
 // interpolateString accepts template data and return a string with substitutions
@@ -84,11 +83,3 @@ func setBodyContent(req *http.Request, route *plugins.Route, data templateData)
 
 	return nil
 }
-
-// Set the X-Grafana-User header if needed (and remove if not)
-func applyUserHeader(sendUserHeader bool, req *http.Request, user *user.SignedInUser) {
-	req.Header.Del("X-Grafana-User")
-	if sendUserHeader && !user.IsAnonymous {
-		req.Header.Set("X-Grafana-User", user.Login)
-	}
-}

pkg/plugins/backendplugin/coreplugin/registry.go

@@ -148,3 +148,8 @@ func (l *logWrapper) Error(msg string, args ...interface{}) {
 func (l *logWrapper) Level() sdklog.Level {
 	return sdklog.NoLevel
 }
+
+func (l *logWrapper) With(args ...interface{}) sdklog.Logger {
+	l.logger = l.logger.New(args...)
+	return l
+}

pkg/services/pluginsintegration/clientmiddleware/user_header_middleware.go

@@ -0,0 +1,103 @@
+package clientmiddleware
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider"
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/services/contexthandler"
+	"github.com/grafana/grafana/pkg/util/proxyutil"
+)
+
+// NewUserHeaderMiddleware creates a new plugins.ClientMiddleware that will
+// populate the X-Grafana-User header on outgoing plugins.Client and HTTP
+// requests.
+func NewUserHeaderMiddleware() plugins.ClientMiddleware {
+	return plugins.ClientMiddlewareFunc(func(next plugins.Client) plugins.Client {
+		return &UserHeaderMiddleware{
+			next: next,
+		}
+	})
+}
+
+type UserHeaderMiddleware struct {
+	next plugins.Client
+}
+
+func (m *UserHeaderMiddleware) applyToken(ctx context.Context, pCtx backend.PluginContext, h backend.ForwardHTTPHeaders) context.Context {
+	reqCtx := contexthandler.FromContext(ctx)
+	// if no HTTP request context skip middleware
+	if h == nil || reqCtx == nil || reqCtx.Req == nil || reqCtx.SignedInUser == nil {
+		return ctx
+	}
+
+	h.DeleteHTTPHeader(proxyutil.UserHeaderName)
+	if !reqCtx.IsAnonymous {
+		h.SetHTTPHeader(proxyutil.UserHeaderName, reqCtx.Login)
+	}
+
+	middlewares := []sdkhttpclient.Middleware{}
+
+	if !reqCtx.IsAnonymous {
+		httpHeaders := http.Header{
+			proxyutil.UserHeaderName: []string{reqCtx.Login},
+		}
+
+		middlewares = append(middlewares, httpclientprovider.SetHeadersMiddleware(httpHeaders))
+	} else {
+		middlewares = append(middlewares, httpclientprovider.DeleteHeadersMiddleware(proxyutil.UserHeaderName))
+	}
+
+	ctx = sdkhttpclient.WithContextualMiddleware(ctx, middlewares...)
+
+	return ctx
+}
+
+func (m *UserHeaderMiddleware) QueryData(ctx context.Context, req *backend.QueryDataRequest) (*backend.QueryDataResponse, error) {
+	if req == nil {
+		return m.next.QueryData(ctx, req)
+	}
+
+	ctx = m.applyToken(ctx, req.PluginContext, req)
+
+	return m.next.QueryData(ctx, req)
+}
+
+func (m *UserHeaderMiddleware) CallResource(ctx context.Context, req *backend.CallResourceRequest, sender backend.CallResourceResponseSender) error {
+	if req == nil {
+		return m.next.CallResource(ctx, req, sender)
+	}
+
+	ctx = m.applyToken(ctx, req.PluginContext, req)
+
+	return m.next.CallResource(ctx, req, sender)
+}
+
+func (m *UserHeaderMiddleware) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) {
+	if req == nil {
+		return m.next.CheckHealth(ctx, req)
+	}
+
+	ctx = m.applyToken(ctx, req.PluginContext, req)
+
+	return m.next.CheckHealth(ctx, req)
+}
+
+func (m *UserHeaderMiddleware) CollectMetrics(ctx context.Context, req *backend.CollectMetricsRequest) (*backend.CollectMetricsResult, error) {
+	return m.next.CollectMetrics(ctx, req)
+}
+
+func (m *UserHeaderMiddleware) SubscribeStream(ctx context.Context, req *backend.SubscribeStreamRequest) (*backend.SubscribeStreamResponse, error) {
+	return m.next.SubscribeStream(ctx, req)
+}
+
+func (m *UserHeaderMiddleware) PublishStream(ctx context.Context, req *backend.PublishStreamRequest) (*backend.PublishStreamResponse, error) {
+	return m.next.PublishStream(ctx, req)
+}
+
+func (m *UserHeaderMiddleware) RunStream(ctx context.Context, req *backend.RunStreamRequest, sender *backend.StreamSender) error {
+	return m.next.RunStream(ctx, req, sender)
+}

pkg/services/pluginsintegration/clientmiddleware/user_header_middleware_test.go

@@ -0,0 +1,254 @@
+package clientmiddleware
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider"
+	"github.com/grafana/grafana/pkg/plugins/manager/client/clienttest"
+	"github.com/grafana/grafana/pkg/services/user"
+	"github.com/grafana/grafana/pkg/util/proxyutil"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUserHeaderMiddleware(t *testing.T) {
+	t.Run("When anononymous user in reqContext", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/some/thing", nil)
+		require.NoError(t, err)
+
+		t.Run("And requests are for a datasource", func(t *testing.T) {
+			cdt := clienttest.NewClientDecoratorTest(t,
+				clienttest.WithReqContext(req, &user.SignedInUser{
+					IsAnonymous: true,
+					Login:       "anonymous"},
+				),
+				clienttest.WithMiddlewares(NewUserHeaderMiddleware()),
+			)
+
+			pluginCtx := backend.PluginContext{
+				DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{},
+			}
+
+			t.Run("Should not forward user header when calling QueryData", func(t *testing.T) {
+				_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.QueryDataReq)
+				require.Empty(t, cdt.QueryDataReq.Headers)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+
+			t.Run("Should not forward user header when calling CallResource", func(t *testing.T) {
+				err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string][]string{},
+				}, nopCallResourceSender)
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CallResourceReq)
+				require.Empty(t, cdt.CallResourceReq.Headers)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+
+			t.Run("Should not forward user header when calling CheckHealth", func(t *testing.T) {
+				_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CheckHealthReq)
+				require.Empty(t, cdt.CheckHealthReq.Headers)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+		})
+
+		t.Run("And requests are for an app", func(t *testing.T) {
+			cdt := clienttest.NewClientDecoratorTest(t,
+				clienttest.WithReqContext(req, &user.SignedInUser{
+					IsAnonymous: true,
+					Login:       "anonymous"},
+				),
+				clienttest.WithMiddlewares(NewUserHeaderMiddleware()),
+			)
+
+			pluginCtx := backend.PluginContext{
+				AppInstanceSettings: &backend.AppInstanceSettings{},
+			}
+
+			t.Run("Should not forward user header when calling QueryData", func(t *testing.T) {
+				_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.QueryDataReq)
+				require.Empty(t, cdt.QueryDataReq.Headers)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+
+			t.Run("Should not forward user header when calling CallResource", func(t *testing.T) {
+				err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string][]string{},
+				}, nopCallResourceSender)
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CallResourceReq)
+				require.Empty(t, cdt.CallResourceReq.Headers)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+
+			t.Run("Should not forward user header when calling CheckHealth", func(t *testing.T) {
+				_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CheckHealthReq)
+				require.Empty(t, cdt.CheckHealthReq.Headers)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+		})
+	})
+
+	t.Run("When real user in reqContext", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/some/thing", nil)
+		require.NoError(t, err)
+
+		t.Run("And requests are for a datasource", func(t *testing.T) {
+			cdt := clienttest.NewClientDecoratorTest(t,
+				clienttest.WithReqContext(req, &user.SignedInUser{
+					Login: "admin",
+				}),
+				clienttest.WithMiddlewares(NewUserHeaderMiddleware()),
+			)
+
+			pluginCtx := backend.PluginContext{
+				DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{},
+			}
+
+			t.Run("Should forward user header when calling QueryData", func(t *testing.T) {
+				_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.QueryDataReq)
+				require.Len(t, cdt.QueryDataReq.Headers, 1)
+				require.Equal(t, "admin", cdt.QueryDataReq.GetHTTPHeader(proxyutil.UserHeaderName))
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+
+			t.Run("Should forward user header when calling CallResource", func(t *testing.T) {
+				err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string][]string{},
+				}, nopCallResourceSender)
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CallResourceReq)
+				require.Len(t, cdt.CallResourceReq.Headers, 1)
+				require.Equal(t, "admin", cdt.CallResourceReq.GetHTTPHeader(proxyutil.UserHeaderName))
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+
+			t.Run("Should forward user header when calling CheckHealth", func(t *testing.T) {
+				_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CheckHealthReq)
+				require.Len(t, cdt.CheckHealthReq.Headers, 1)
+				require.Equal(t, "admin", cdt.CheckHealthReq.GetHTTPHeader(proxyutil.UserHeaderName))
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+		})
+
+		t.Run("And requests are for an app", func(t *testing.T) {
+			cdt := clienttest.NewClientDecoratorTest(t,
+				clienttest.WithReqContext(req, &user.SignedInUser{
+					Login: "admin",
+				}),
+				clienttest.WithMiddlewares(NewUserHeaderMiddleware()),
+			)
+
+			pluginCtx := backend.PluginContext{
+				AppInstanceSettings: &backend.AppInstanceSettings{},
+			}
+
+			t.Run("Should forward user header when calling QueryData", func(t *testing.T) {
+				_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.QueryDataReq)
+				require.Len(t, cdt.QueryDataReq.Headers, 1)
+				require.Equal(t, "admin", cdt.QueryDataReq.GetHTTPHeader(proxyutil.UserHeaderName))
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+
+			t.Run("Should forward user header when calling CallResource", func(t *testing.T) {
+				err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string][]string{},
+				}, nopCallResourceSender)
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CallResourceReq)
+				require.Len(t, cdt.CallResourceReq.Headers, 1)
+				require.Equal(t, "admin", cdt.CallResourceReq.GetHTTPHeader(proxyutil.UserHeaderName))
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+
+			t.Run("Should forward user header when calling CheckHealth", func(t *testing.T) {
+				_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CheckHealthReq)
+				require.Len(t, cdt.CheckHealthReq.Headers, 1)
+				require.Equal(t, "admin", cdt.CheckHealthReq.GetHTTPHeader(proxyutil.UserHeaderName))
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+			})
+		})
+	})
+}

pkg/services/pluginsintegration/pluginsintegration.go

@@ -77,5 +77,9 @@ func CreateMiddlewares(cfg *setting.Cfg, oAuthTokenService oauthtoken.OAuthToken
 		clientmiddleware.NewCookiesMiddleware(skipCookiesNames),
 	}
 
+	if cfg.SendUserHeader {
+		middlewares = append(middlewares, clientmiddleware.NewUserHeaderMiddleware())
+	}
+
 	return middlewares
 }

pkg/util/proxyutil/proxyutil.go

@@ -4,8 +4,13 @@ import (
 	"net"
 	"net/http"
 	"sort"
+
+	"github.com/grafana/grafana/pkg/services/user"
 )
 
+// UserHeaderName name of the header used when forwarding the Grafana user login.
+const UserHeaderName = "X-Grafana-User"
+
 // PrepareProxyRequest prepares a request for being proxied.
 // Removes X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto, Origin, Referer headers.
 // Set X-Grafana-Referer based on contents of Referer.
@@ -69,3 +74,11 @@ func ClearCookieHeader(req *http.Request, keepCookiesNames []string, skipCookies
 func SetProxyResponseHeaders(header http.Header) {
 	header.Set("Content-Security-Policy", "sandbox")
 }
+
+// ApplyUserHeader Set the X-Grafana-User header if needed (and remove if not).
+func ApplyUserHeader(sendUserHeader bool, req *http.Request, user *user.SignedInUser) {
+	req.Header.Del(UserHeaderName)
+	if sendUserHeader && user != nil && !user.IsAnonymous {
+		req.Header.Set(UserHeaderName, user.Login)
+	}
+}

pkg/util/proxyutil/proxyutil_test.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"testing"
 
+	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/stretchr/testify/require"
 )
 
@@ -109,3 +110,39 @@ func TestClearCookieHeader(t *testing.T) {
 		require.Equal(t, "cookie1=", req.Header.Get("Cookie"))
 	})
 }
+
+func TestApplyUserHeader(t *testing.T) {
+	t.Run("Should not apply user header when not enabled, should remove the existing", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		require.NoError(t, err)
+		req.Header.Set("X-Grafana-User", "admin")
+
+		ApplyUserHeader(false, req, &user.SignedInUser{Login: "admin"})
+		require.NotContains(t, req.Header, "X-Grafana-User")
+	})
+
+	t.Run("Should not apply user header when user is nil, should remove the existing", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		require.NoError(t, err)
+		req.Header.Set("X-Grafana-User", "admin")
+
+		ApplyUserHeader(false, req, nil)
+		require.NotContains(t, req.Header, "X-Grafana-User")
+	})
+
+	t.Run("Should not apply user header for anonomous user", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		require.NoError(t, err)
+
+		ApplyUserHeader(true, req, &user.SignedInUser{IsAnonymous: true})
+		require.NotContains(t, req.Header, "X-Grafana-User")
+	})
+
+	t.Run("Should apply user header for non-anonomous user", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		require.NoError(t, err)
+
+		ApplyUserHeader(true, req, &user.SignedInUser{Login: "admin"})
+		require.Equal(t, "admin", req.Header.Get("X-Grafana-User"))
+	})
+}