IDforwarding: forward signed id to plugins (#75651)

* Plugins: Add client middlware that forwards the signed grafana id token if present

* DsProxy: Set grafana id header if id token exists

* Add util function to apply id token to header

* Only add id forwarding middleware if feature toggle is enabled

* Add feature toggles to ds proxy and check if id forwarding is enabled

* Clean up test setup

* Change to use backend.ForwardHTTPHeaders interface

* PluginProxy: Forward signed identity when feature toggle is enabled

* PluginProxy: forrward signed id header

pkg/services/pluginsintegration/clientmiddleware/forward_id_middleware.go

@@ -0,0 +1,96 @@
+package clientmiddleware
+
+import (
+	"context"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/services/contexthandler"
+)
+
+const forwardIDHeaderName = "X-Grafana-Id"
+
+// NewForwardIDMiddleware creates a new plugins.ClientMiddleware that will
+// set grafana id header on outgoing plugins.Client requests if the
+// feature toggle FlagIdForwarding is enabled
+func NewForwardIDMiddleware() plugins.ClientMiddleware {
+	return plugins.ClientMiddlewareFunc(func(next plugins.Client) plugins.Client {
+		return &ForwardIDMiddleware{
+			next: next,
+		}
+	})
+}
+
+type ForwardIDMiddleware struct {
+	next plugins.Client
+}
+
+func (m *ForwardIDMiddleware) applyToken(ctx context.Context, pCtx backend.PluginContext, req backend.ForwardHTTPHeaders) error {
+	reqCtx := contexthandler.FromContext(ctx)
+	// if request not for a datasource or no HTTP request context skip middleware
+	if req == nil || reqCtx == nil || reqCtx.SignedInUser == nil {
+		return nil
+	}
+
+	// token will only be present if faeturemgmt.FlagIdForwarding is enabled
+	if token := reqCtx.SignedInUser.GetIDToken(); token != "" {
+		req.SetHTTPHeader(forwardIDHeaderName, token)
+	}
+
+	return nil
+}
+
+func (m *ForwardIDMiddleware) QueryData(ctx context.Context, req *backend.QueryDataRequest) (*backend.QueryDataResponse, error) {
+	if req == nil {
+		return m.next.QueryData(ctx, req)
+	}
+
+	err := m.applyToken(ctx, req.PluginContext, req)
+	if err != nil {
+		return nil, err
+	}
+
+	return m.next.QueryData(ctx, req)
+}
+
+func (m *ForwardIDMiddleware) CallResource(ctx context.Context, req *backend.CallResourceRequest, sender backend.CallResourceResponseSender) error {
+	if req == nil {
+		return m.next.CallResource(ctx, req, sender)
+	}
+
+	err := m.applyToken(ctx, req.PluginContext, req)
+	if err != nil {
+		return err
+	}
+
+	return m.next.CallResource(ctx, req, sender)
+}
+
+func (m *ForwardIDMiddleware) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) {
+	if req == nil {
+		return m.next.CheckHealth(ctx, req)
+	}
+
+	err := m.applyToken(ctx, req.PluginContext, req)
+	if err != nil {
+		return nil, err
+	}
+
+	return m.next.CheckHealth(ctx, req)
+}
+
+func (m *ForwardIDMiddleware) CollectMetrics(ctx context.Context, req *backend.CollectMetricsRequest) (*backend.CollectMetricsResult, error) {
+	return m.next.CollectMetrics(ctx, req)
+}
+
+func (m *ForwardIDMiddleware) SubscribeStream(ctx context.Context, req *backend.SubscribeStreamRequest) (*backend.SubscribeStreamResponse, error) {
+	return m.next.SubscribeStream(ctx, req)
+}
+
+func (m *ForwardIDMiddleware) PublishStream(ctx context.Context, req *backend.PublishStreamRequest) (*backend.PublishStreamResponse, error) {
+	return m.next.PublishStream(ctx, req)
+}
+
+func (m *ForwardIDMiddleware) RunStream(ctx context.Context, req *backend.RunStreamRequest, sender *backend.StreamSender) error {
+	return m.next.RunStream(ctx, req, sender)
+}

pkg/services/pluginsintegration/clientmiddleware/forward_id_middleware_test.go

@@ -0,0 +1,50 @@
+package clientmiddleware
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana/pkg/web"
+	"github.com/stretchr/testify/require"
+
+	"github.com/grafana/grafana/pkg/plugins/manager/client/clienttest"
+	"github.com/grafana/grafana/pkg/services/contexthandler/ctxkey"
+	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
+	"github.com/grafana/grafana/pkg/services/user"
+)
+
+func TestForwardIDMiddleware(t *testing.T) {
+	t.Run("Should set forwarded id header if present", func(t *testing.T) {
+		cdt := clienttest.NewClientDecoratorTest(t, clienttest.WithMiddlewares(NewForwardIDMiddleware()))
+
+		ctx := context.WithValue(context.Background(), ctxkey.Key{}, &contextmodel.ReqContext{
+			Context:      &web.Context{Req: &http.Request{}},
+			SignedInUser: &user.SignedInUser{IDToken: "some-token"},
+		})
+
+		err := cdt.Decorator.CallResource(ctx, &backend.CallResourceRequest{
+			PluginContext: backend.PluginContext{},
+		}, nopCallResourceSender)
+		require.NoError(t, err)
+
+		require.Equal(t, "some-token", cdt.CallResourceReq.Headers[forwardIDHeaderName][0])
+	})
+
+	t.Run("Should not set forwarded id header if not present", func(t *testing.T) {
+		cdt := clienttest.NewClientDecoratorTest(t, clienttest.WithMiddlewares(NewForwardIDMiddleware()))
+
+		ctx := context.WithValue(context.Background(), ctxkey.Key{}, &contextmodel.ReqContext{
+			Context:      &web.Context{Req: &http.Request{}},
+			SignedInUser: &user.SignedInUser{},
+		})
+
+		err := cdt.Decorator.CallResource(ctx, &backend.CallResourceRequest{
+			PluginContext: backend.PluginContext{},
+		}, nopCallResourceSender)
+		require.NoError(t, err)
+
+		require.Len(t, cdt.CallResourceReq.Headers[forwardIDHeaderName], 0)
+	})
+}