public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chore: Refactor securedata to remove global encryption calls from dashboard snapshots (#38714)

Browse Source 
* Add encryption service

* Add tests for encryption service

* Inject encryption service into http server

* Replace encryption global function usage in login tests

* Migrate to Wire

* Move Encryption bindings to OSS Wire set

* Chore: Refactor securedata to remove global encryption calls from dashboard snapshots

* Fix dashboard snapshot tests

* Remove no longer user test

* Add dashboard snapshots service tests

* Refactor service initialization

* Set up dashboard snapshots service as a background service

Co-authored-by: Tania B <yalyna.ts@gmail.com>
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
This commit is contained in:
Joan López de la Franca Beltran
2021-09-01 13:05:15 +02:00
committed by GitHub
co-authored by Tania B Emil Tullstedt
parent a4e253bcf9
commit 6cfb640a0b
10 changed files with 209 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/sqlstore/dashboard_snapshot.go
+7 -27
View File
@@ -3,25 +3,15 @@ package sqlstore
import (
"time"
"github.com/grafana/grafana/pkg/bus"
"github.com/grafana/grafana/pkg/components/securedata"
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/setting"
)
func init() {
bus.AddHandler("sql", CreateDashboardSnapshot)
bus.AddHandler("sql", GetDashboardSnapshot)
bus.AddHandler("sql", DeleteDashboardSnapshot)
bus.AddHandler("sql", SearchDashboardSnapshots)
bus.AddHandler("sql", DeleteExpiredSnapshots)
}
// DeleteExpiredSnapshots removes snapshots with old expiry dates.
// SnapShotRemoveExpired is deprecated and should be removed in the future.
// Snapshot expiry is decided by the user when they share the snapshot.
func DeleteExpiredSnapshots(cmd *models.DeleteExpiredSnapshotsCommand) error {
func (ss *SQLStore) DeleteExpiredSnapshots(cmd *models.DeleteExpiredSnapshotsCommand) error {
return inTransaction(func(sess *DBSession) error {
if !setting.SnapShotRemoveExpired {
sqlog.Warn("[Deprecated] The snapshot_remove_expired setting is outdated. Please remove from your config.")
@@ -39,7 +29,7 @@ func DeleteExpiredSnapshots(cmd *models.DeleteExpiredSnapshotsCommand) error {
})
}
func CreateDashboardSnapshot(cmd *models.CreateDashboardSnapshotCommand) error {
func (ss *SQLStore) CreateDashboardSnapshot(cmd *models.CreateDashboardSnapshotCommand) error {
return inTransaction(func(sess *DBSession) error {
// never
var expires = time.Now().Add(time.Hour * 24 * 365 * 50)
@@ -47,16 +37,6 @@ func CreateDashboardSnapshot(cmd *models.CreateDashboardSnapshotCommand) error {
expires = time.Now().Add(time.Second * time.Duration(cmd.Expires))
}
marshalledData, err := cmd.Dashboard.Encode()
if err != nil {
return err
}
encryptedDashboard, err := securedata.Encrypt(marshalledData)
if err != nil {
return err
}
snapshot := &models.DashboardSnapshot{
Name: cmd.Name,
Key: cmd.Key,
@@ -67,19 +47,19 @@ func CreateDashboardSnapshot(cmd *models.CreateDashboardSnapshotCommand) error {
ExternalUrl: cmd.ExternalUrl,
ExternalDeleteUrl: cmd.ExternalDeleteUrl,
Dashboard: simplejson.New(),
DashboardEncrypted: encryptedDashboard,
DashboardEncrypted: cmd.DashboardEncrypted,
Expires: expires,
Created: time.Now(),
Updated: time.Now(),
}
_, err = sess.Insert(snapshot)
_, err := sess.Insert(snapshot)
cmd.Result = snapshot
return err
})
}
func DeleteDashboardSnapshot(cmd *models.DeleteDashboardSnapshotCommand) error {
func (ss *SQLStore) DeleteDashboardSnapshot(cmd *models.DeleteDashboardSnapshotCommand) error {
return inTransaction(func(sess *DBSession) error {
var rawSQL = "DELETE FROM dashboard_snapshot WHERE delete_key=?"
_, err := sess.Exec(rawSQL, cmd.DeleteKey)
@@ -87,7 +67,7 @@ func DeleteDashboardSnapshot(cmd *models.DeleteDashboardSnapshotCommand) error {
})
}
func GetDashboardSnapshot(query *models.GetDashboardSnapshotQuery) error {
func (ss *SQLStore) GetDashboardSnapshot(query *models.GetDashboardSnapshotQuery) error {
snapshot := models.DashboardSnapshot{Key: query.Key, DeleteKey: query.DeleteKey}
has, err := x.Get(&snapshot)
@@ -103,7 +83,7 @@ func GetDashboardSnapshot(query *models.GetDashboardSnapshotQuery) error {
// SearchDashboardSnapshots returns a list of all snapshots for admins
// for other roles, it returns snapshots created by the user
func SearchDashboardSnapshots(query *models.GetDashboardSnapshotsQuery) error {
func (ss *SQLStore) SearchDashboardSnapshots(query *models.GetDashboardSnapshotsQuery) error {
var snapshots = make(models.DashboardSnapshotsList, 0)
sess := x.NewSession()
pkg/services/sqlstore/dashboard_snapshot_test.go
+42 -28
View File
@@ -6,16 +6,16 @@ import (
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/encryption/ossencryption"
"github.com/grafana/grafana/pkg/setting"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestDashboardSnapshotDBAccess(t *testing.T) {
InitTestDB(t)
sqlstore := InitTestDB(t)
origSecret := setting.SecretKey
setting.SecretKey = "dashboard_snapshot_testing"
@@ -23,27 +23,41 @@ func TestDashboardSnapshotDBAccess(t *testing.T) {
setting.SecretKey = origSecret
})
dashboard := simplejson.NewFromAny(map[string]interface{}{"hello": "mupp"})
t.Run("Given saved snapshot", func(t *testing.T) {
rawDashboard, err := dashboard.Encode()
require.NoError(t, err)
encryptedDashboard, err := ossencryption.ProvideService().Encrypt(rawDashboard, setting.SecretKey)
require.NoError(t, err)
cmd := models.CreateDashboardSnapshotCommand{
Key: "hej",
Dashboard: simplejson.NewFromAny(map[string]interface{}{
"hello": "mupp",
}),
UserId: 1000,
OrgId: 1,
Key: "hej",
DashboardEncrypted: encryptedDashboard,
UserId: 1000,
OrgId: 1,
}
err := CreateDashboardSnapshot(&cmd)
err = sqlstore.CreateDashboardSnapshot(&cmd)
require.NoError(t, err)
t.Run("Should be able to get snapshot by key", func(t *testing.T) {
query := models.GetDashboardSnapshotQuery{Key: "hej"}
err := GetDashboardSnapshot(&query)
err := sqlstore.GetDashboardSnapshot(&query)
require.NoError(t, err)
assert.NotNil(t, query.Result)
dashboard, err := query.Result.DashboardJSON()
decryptedDashboard, err := ossencryption.ProvideService().Decrypt(
query.Result.DashboardEncrypted,
setting.SecretKey,
)
require.NoError(t, err)
dashboard, err := simplejson.NewJson(decryptedDashboard)
require.NoError(t, err)
assert.Equal(t, "mupp", dashboard.Get("hello").MustString())
})
@@ -52,7 +66,7 @@ func TestDashboardSnapshotDBAccess(t *testing.T) {
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_ADMIN},
}
err := SearchDashboardSnapshots(&query)
err := sqlstore.SearchDashboardSnapshots(&query)
require.NoError(t, err)
t.Run("Should return all the snapshots", func(t *testing.T) {
@@ -66,7 +80,7 @@ func TestDashboardSnapshotDBAccess(t *testing.T) {
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, UserId: 1000},
}
err := SearchDashboardSnapshots(&query)
err := sqlstore.SearchDashboardSnapshots(&query)
require.NoError(t, err)
t.Run("Should return all the snapshots", func(t *testing.T) {
@@ -80,7 +94,7 @@ func TestDashboardSnapshotDBAccess(t *testing.T) {
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, UserId: 2},
}
err := SearchDashboardSnapshots(&query)
err := sqlstore.SearchDashboardSnapshots(&query)
require.NoError(t, err)
t.Run("Should not return any snapshots", func(t *testing.T) {
@@ -99,7 +113,7 @@ func TestDashboardSnapshotDBAccess(t *testing.T) {
UserId: 0,
OrgId: 1,
}
err := CreateDashboardSnapshot(&cmd)
err := sqlstore.CreateDashboardSnapshot(&cmd)
require.NoError(t, err)
t.Run("Should not return any snapshots", func(t *testing.T) {
@@ -107,7 +121,7 @@ func TestDashboardSnapshotDBAccess(t *testing.T) {
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, IsAnonymous: true, UserId: 0},
}
err := SearchDashboardSnapshots(&query)
err := sqlstore.SearchDashboardSnapshots(&query)
require.NoError(t, err)
require.NotNil(t, query.Result)
@@ -116,13 +130,13 @@ func TestDashboardSnapshotDBAccess(t *testing.T) {
})
t.Run("Should have encrypted dashboard data", func(t *testing.T) {
original, err := cmd.Dashboard.Encode()
decryptedDashboard, err := ossencryption.ProvideService().Decrypt(
cmd.Result.DashboardEncrypted,
setting.SecretKey,
)
require.NoError(t, err)
decrypted, err := cmd.Result.DashboardEncrypted.Decrypt()
require.NoError(t, err)
require.Equal(t, decrypted, original)
require.Equal(t, decryptedDashboard, rawDashboard)
})
})
}
@@ -137,27 +151,27 @@ func TestDeleteExpiredSnapshots(t *testing.T) {
createTestSnapshot(t, sqlstore, "key2", -1200)
createTestSnapshot(t, sqlstore, "key3", -1200)
err := DeleteExpiredSnapshots(&models.DeleteExpiredSnapshotsCommand{})
err := sqlstore.DeleteExpiredSnapshots(&models.DeleteExpiredSnapshotsCommand{})
require.NoError(t, err)
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_ADMIN},
}
err = SearchDashboardSnapshots(&query)
err = sqlstore.SearchDashboardSnapshots(&query)
require.NoError(t, err)
assert.Len(t, query.Result, 1)
assert.Equal(t, nonExpiredSnapshot.Key, query.Result[0].Key)
err = DeleteExpiredSnapshots(&models.DeleteExpiredSnapshotsCommand{})
err = sqlstore.DeleteExpiredSnapshots(&models.DeleteExpiredSnapshotsCommand{})
require.NoError(t, err)
query = models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_ADMIN},
}
err = SearchDashboardSnapshots(&query)
err = sqlstore.SearchDashboardSnapshots(&query)
require.NoError(t, err)
require.Len(t, query.Result, 1)
@@ -176,7 +190,7 @@ func createTestSnapshot(t *testing.T, sqlstore *SQLStore, key string, expires in
OrgId: 1,
Expires: expires,
}
err := CreateDashboardSnapshot(&cmd)
err := sqlstore.CreateDashboardSnapshot(&cmd)
require.NoError(t, err)
// Set expiry date manually - to be able to create expired snapshots