Encryption: Refactor securejsondata.SecureJsonData to stop relying on global functions (#38865)

* Encryption: Add support to encrypt/decrypt sjd

* Add datasources.Service as a proxy to datasources db operations

* Encrypt ds.SecureJsonData before calling SQLStore

* Move ds cache code into ds service

* Fix tlsmanager tests

* Fix pluginproxy tests

* Remove some securejsondata.GetEncryptedJsonData usages

* Add pluginsettings.Service as a proxy for plugin settings db operations

* Add AlertNotificationService as a proxy for alert notification db operations

* Remove some securejsondata.GetEncryptedJsonData usages

* Remove more securejsondata.GetEncryptedJsonData usages

* Fix lint errors

* Minor fixes

* Remove encryption global functions usages from ngalert

* Fix lint errors

* Minor fixes

* Minor fixes

* Remove securejsondata.DecryptedValue usage

* Refactor the refactor

* Remove securejsondata.DecryptedValue usage

* Move securejsondata to migrations package

* Move securejsondata to migrations package

* Minor fix

* Fix integration test

* Fix integration tests

* Undo undesired changes

* Fix tests

* Add context.Context into encryption methods

* Fix tests

* Fix tests

* Fix tests

* Trigger CI

* Fix test

* Add names to params of encryption service interface

* Remove bus from CacheServiceImpl

* Add logging

* Add keys to logger

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>

* Add missing key to logger

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>

* Undo changes in markdown files

* Fix formatting

* Add context to secrets service

* Rename decryptSecureJsonData to decryptSecureJsonDataFn

* Name args in GetDecryptedValueFn

* Add template back to NewAlertmanagerNotifier

* Copy GetDecryptedValueFn to ngalert

* Add logging to pluginsettings

* Fix pluginsettings test

Co-authored-by: Tania B <yalyna.ts@gmail.com>
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>

pkg/models/alert_notifications.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"time"
 
-	"github.com/grafana/grafana/pkg/components/securejsondata"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 )
 
@@ -27,19 +26,19 @@ var (
 )
 
 type AlertNotification struct {
-	Id                    int64                         `json:"id"`
-	Uid                   string                        `json:"-"`
-	OrgId                 int64                         `json:"-"`
-	Name                  string                        `json:"name"`
-	Type                  string                        `json:"type"`
-	SendReminder          bool                          `json:"sendReminder"`
-	DisableResolveMessage bool                          `json:"disableResolveMessage"`
-	Frequency             time.Duration                 `json:"frequency"`
-	IsDefault             bool                          `json:"isDefault"`
-	Settings              *simplejson.Json              `json:"settings"`
-	SecureSettings        securejsondata.SecureJsonData `json:"secureSettings"`
-	Created               time.Time                     `json:"created"`
-	Updated               time.Time                     `json:"updated"`
+	Id                    int64             `json:"id"`
+	Uid                   string            `json:"-"`
+	OrgId                 int64             `json:"-"`
+	Name                  string            `json:"name"`
+	Type                  string            `json:"type"`
+	SendReminder          bool              `json:"sendReminder"`
+	DisableResolveMessage bool              `json:"disableResolveMessage"`
+	Frequency             time.Duration     `json:"frequency"`
+	IsDefault             bool              `json:"isDefault"`
+	Settings              *simplejson.Json  `json:"settings"`
+	SecureSettings        map[string][]byte `json:"secureSettings"`
+	Created               time.Time         `json:"created"`
+	Updated               time.Time         `json:"updated"`
 }
 
 type CreateAlertNotificationCommand struct {
@@ -53,7 +52,9 @@ type CreateAlertNotificationCommand struct {
 	Settings              *simplejson.Json  `json:"settings"`
 	SecureSettings        map[string]string `json:"secureSettings"`
 
-	OrgId  int64 `json:"-"`
+	OrgId                   int64             `json:"-"`
+	EncryptedSecureSettings map[string][]byte `json:"-"`
+
 	Result *AlertNotification
 }
 
@@ -69,7 +70,9 @@ type UpdateAlertNotificationCommand struct {
 	Settings              *simplejson.Json  `json:"settings"  binding:"Required"`
 	SecureSettings        map[string]string `json:"secureSettings"`
 
-	OrgId  int64 `json:"-"`
+	OrgId                   int64             `json:"-"`
+	EncryptedSecureSettings map[string][]byte `json:"-"`
+
 	Result *AlertNotification
 }
 
@@ -166,11 +169,3 @@ type GetOrCreateNotificationStateQuery struct {
 
 	Result *AlertNotificationState
 }
-
-// decryptedValue returns decrypted value from secureSettings
-func (an *AlertNotification) DecryptedValue(field string, fallback string) string {
-	if value, ok := an.SecureSettings.DecryptedValue(field); ok {
-		return value
-	}
-	return fallback
-}

pkg/models/datasource.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"time"
 
-	"github.com/grafana/grafana/pkg/components/securejsondata"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 )
 
@@ -38,47 +37,27 @@ type DataSource struct {
 	OrgId   int64 `json:"orgId"`
 	Version int   `json:"version"`
 
-	Name              string                        `json:"name"`
-	Type              string                        `json:"type"`
-	Access            DsAccess                      `json:"access"`
-	Url               string                        `json:"url"`
-	Password          string                        `json:"password"`
-	User              string                        `json:"user"`
-	Database          string                        `json:"database"`
-	BasicAuth         bool                          `json:"basicAuth"`
-	BasicAuthUser     string                        `json:"basicAuthUser"`
-	BasicAuthPassword string                        `json:"basicAuthPassword"`
-	WithCredentials   bool                          `json:"withCredentials"`
-	IsDefault         bool                          `json:"isDefault"`
-	JsonData          *simplejson.Json              `json:"jsonData"`
-	SecureJsonData    securejsondata.SecureJsonData `json:"secureJsonData"`
-	ReadOnly          bool                          `json:"readOnly"`
-	Uid               string                        `json:"uid"`
+	Name              string            `json:"name"`
+	Type              string            `json:"type"`
+	Access            DsAccess          `json:"access"`
+	Url               string            `json:"url"`
+	Password          string            `json:"password"`
+	User              string            `json:"user"`
+	Database          string            `json:"database"`
+	BasicAuth         bool              `json:"basicAuth"`
+	BasicAuthUser     string            `json:"basicAuthUser"`
+	BasicAuthPassword string            `json:"basicAuthPassword"`
+	WithCredentials   bool              `json:"withCredentials"`
+	IsDefault         bool              `json:"isDefault"`
+	JsonData          *simplejson.Json  `json:"jsonData"`
+	SecureJsonData    map[string][]byte `json:"secureJsonData"`
+	ReadOnly          bool              `json:"readOnly"`
+	Uid               string            `json:"uid"`
 
 	Created time.Time `json:"created"`
 	Updated time.Time `json:"updated"`
 }
 
-// DecryptedBasicAuthPassword returns data source basic auth password in plain text. It uses either deprecated
-// basic_auth_password field or encrypted secure_json_data[basicAuthPassword] variable.
-func (ds *DataSource) DecryptedBasicAuthPassword() string {
-	return ds.decryptedValue("basicAuthPassword", ds.BasicAuthPassword)
-}
-
-// DecryptedPassword returns data source password in plain text. It uses either deprecated password field
-// or encrypted secure_json_data[password] variable.
-func (ds *DataSource) DecryptedPassword() string {
-	return ds.decryptedValue("password", ds.Password)
-}
-
-// decryptedValue returns decrypted value from secureJsonData
-func (ds *DataSource) decryptedValue(field string, fallback string) string {
-	if value, ok := ds.DecryptedValue(field); ok {
-		return value
-	}
-	return fallback
-}
-
 // ----------------------
 // COMMANDS
 
@@ -100,8 +79,9 @@ type AddDataSourceCommand struct {
 	SecureJsonData    map[string]string `json:"secureJsonData"`
 	Uid               string            `json:"uid"`
 
-	OrgId    int64 `json:"-"`
-	ReadOnly bool  `json:"-"`
+	OrgId                   int64             `json:"-"`
+	ReadOnly                bool              `json:"-"`
+	EncryptedSecureJsonData map[string][]byte `json:"-"`
 
 	Result *DataSource
 }
@@ -125,9 +105,10 @@ type UpdateDataSourceCommand struct {
 	Version           int               `json:"version"`
 	Uid               string            `json:"uid"`
 
-	OrgId    int64 `json:"-"`
-	Id       int64 `json:"-"`
-	ReadOnly bool  `json:"-"`
+	OrgId                   int64             `json:"-"`
+	Id                      int64             `json:"-"`
+	ReadOnly                bool              `json:"-"`
+	EncryptedSecureJsonData map[string][]byte `json:"-"`
 
 	Result *DataSource
 }

pkg/models/datasource_cache.go

@@ -1,292 +0,0 @@
-package models
-
-import (
-	"crypto/tls"
-	"fmt"
-	"net/http"
-	"strconv"
-	"sync"
-	"time"
-
-	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
-	"github.com/grafana/grafana/pkg/components/simplejson"
-	"github.com/grafana/grafana/pkg/infra/httpclient"
-	"github.com/grafana/grafana/pkg/setting"
-	"github.com/grafana/grafana/pkg/tsdb/azuremonitor/azcredentials"
-)
-
-func (ds *DataSource) getTimeout() time.Duration {
-	timeout := 0
-	if ds.JsonData != nil {
-		timeout = ds.JsonData.Get("timeout").MustInt()
-		if timeout <= 0 {
-			if timeoutStr := ds.JsonData.Get("timeout").MustString(); timeoutStr != "" {
-				if t, err := strconv.Atoi(timeoutStr); err == nil {
-					timeout = t
-				}
-			}
-		}
-	}
-	if timeout <= 0 {
-		return sdkhttpclient.DefaultTimeoutOptions.Timeout
-	}
-
-	return time.Duration(timeout) * time.Second
-}
-
-type proxyTransportCache struct {
-	cache map[int64]cachedRoundTripper
-	sync.Mutex
-}
-
-type cachedRoundTripper struct {
-	updated      time.Time
-	roundTripper http.RoundTripper
-}
-
-var ptc = proxyTransportCache{
-	cache: make(map[int64]cachedRoundTripper),
-}
-
-func (ds *DataSource) GetHTTPClient(provider httpclient.Provider) (*http.Client, error) {
-	transport, err := ds.GetHTTPTransport(provider)
-	if err != nil {
-		return nil, err
-	}
-
-	return &http.Client{
-		Timeout:   ds.getTimeout(),
-		Transport: transport,
-	}, nil
-}
-
-func (ds *DataSource) GetHTTPTransport(provider httpclient.Provider, customMiddlewares ...sdkhttpclient.Middleware) (http.RoundTripper, error) {
-	ptc.Lock()
-	defer ptc.Unlock()
-
-	if t, present := ptc.cache[ds.Id]; present && ds.Updated.Equal(t.updated) {
-		return t.roundTripper, nil
-	}
-
-	opts, err := ds.HTTPClientOptions()
-	if err != nil {
-		return nil, err
-	}
-
-	opts.Middlewares = customMiddlewares
-
-	rt, err := provider.GetTransport(*opts)
-	if err != nil {
-		return nil, err
-	}
-
-	ptc.cache[ds.Id] = cachedRoundTripper{
-		roundTripper: rt,
-		updated:      ds.Updated,
-	}
-
-	return rt, nil
-}
-
-func (ds *DataSource) HTTPClientOptions() (*sdkhttpclient.Options, error) {
-	tlsOptions := ds.TLSOptions()
-	timeouts := &sdkhttpclient.TimeoutOptions{
-		Timeout:               ds.getTimeout(),
-		DialTimeout:           sdkhttpclient.DefaultTimeoutOptions.DialTimeout,
-		KeepAlive:             sdkhttpclient.DefaultTimeoutOptions.KeepAlive,
-		TLSHandshakeTimeout:   sdkhttpclient.DefaultTimeoutOptions.TLSHandshakeTimeout,
-		ExpectContinueTimeout: sdkhttpclient.DefaultTimeoutOptions.ExpectContinueTimeout,
-		MaxConnsPerHost:       sdkhttpclient.DefaultTimeoutOptions.MaxConnsPerHost,
-		MaxIdleConns:          sdkhttpclient.DefaultTimeoutOptions.MaxIdleConns,
-		MaxIdleConnsPerHost:   sdkhttpclient.DefaultTimeoutOptions.MaxIdleConnsPerHost,
-		IdleConnTimeout:       sdkhttpclient.DefaultTimeoutOptions.IdleConnTimeout,
-	}
-	opts := &sdkhttpclient.Options{
-		Timeouts: timeouts,
-		Headers:  getCustomHeaders(ds.JsonData, ds.DecryptedValues()),
-		Labels: map[string]string{
-			"datasource_name": ds.Name,
-			"datasource_uid":  ds.Uid,
-		},
-		TLS: &tlsOptions,
-	}
-
-	if ds.JsonData != nil {
-		opts.CustomOptions = ds.JsonData.MustMap()
-	}
-
-	if ds.BasicAuth {
-		opts.BasicAuth = &sdkhttpclient.BasicAuthOptions{
-			User:     ds.BasicAuthUser,
-			Password: ds.DecryptedBasicAuthPassword(),
-		}
-	} else if ds.User != "" {
-		opts.BasicAuth = &sdkhttpclient.BasicAuthOptions{
-			User:     ds.User,
-			Password: ds.DecryptedPassword(),
-		}
-	}
-
-	if ds.JsonData != nil && ds.JsonData.Get("azureAuth").MustBool() {
-		credentials, err := azcredentials.FromDatasourceData(ds.JsonData.MustMap(), ds.DecryptedValues())
-		if err != nil {
-			err = fmt.Errorf("invalid Azure credentials: %s", err)
-			return nil, err
-		}
-
-		opts.CustomOptions["_azureAuth"] = true
-		if credentials != nil {
-			opts.CustomOptions["_azureCredentials"] = credentials
-		}
-	}
-
-	if ds.JsonData != nil && ds.JsonData.Get("sigV4Auth").MustBool(false) && setting.SigV4AuthEnabled {
-		opts.SigV4 = &sdkhttpclient.SigV4Config{
-			Service:       awsServiceNamespace(ds.Type),
-			Region:        ds.JsonData.Get("sigV4Region").MustString(),
-			AssumeRoleARN: ds.JsonData.Get("sigV4AssumeRoleArn").MustString(),
-			AuthType:      ds.JsonData.Get("sigV4AuthType").MustString(),
-			ExternalID:    ds.JsonData.Get("sigV4ExternalId").MustString(),
-			Profile:       ds.JsonData.Get("sigV4Profile").MustString(),
-		}
-
-		if val, exists := ds.DecryptedValue("sigV4AccessKey"); exists {
-			opts.SigV4.AccessKey = val
-		}
-
-		if val, exists := ds.DecryptedValue("sigV4SecretKey"); exists {
-			opts.SigV4.SecretKey = val
-		}
-	}
-
-	return opts, nil
-}
-
-func (ds *DataSource) TLSOptions() sdkhttpclient.TLSOptions {
-	var tlsSkipVerify, tlsClientAuth, tlsAuthWithCACert bool
-	var serverName string
-
-	if ds.JsonData != nil {
-		tlsClientAuth = ds.JsonData.Get("tlsAuth").MustBool(false)
-		tlsAuthWithCACert = ds.JsonData.Get("tlsAuthWithCACert").MustBool(false)
-		tlsSkipVerify = ds.JsonData.Get("tlsSkipVerify").MustBool(false)
-		serverName = ds.JsonData.Get("serverName").MustString()
-	}
-
-	opts := sdkhttpclient.TLSOptions{
-		InsecureSkipVerify: tlsSkipVerify,
-		ServerName:         serverName,
-	}
-
-	if tlsClientAuth || tlsAuthWithCACert {
-		if tlsAuthWithCACert {
-			if val, exists := ds.DecryptedValue("tlsCACert"); exists && len(val) > 0 {
-				opts.CACertificate = val
-			}
-		}
-
-		if tlsClientAuth {
-			if val, exists := ds.DecryptedValue("tlsClientCert"); exists && len(val) > 0 {
-				opts.ClientCertificate = val
-			}
-			if val, exists := ds.DecryptedValue("tlsClientKey"); exists && len(val) > 0 {
-				opts.ClientKey = val
-			}
-		}
-	}
-
-	return opts
-}
-
-func (ds *DataSource) GetTLSConfig(httpClientProvider httpclient.Provider) (*tls.Config, error) {
-	opts, err := ds.HTTPClientOptions()
-	if err != nil {
-		return nil, err
-	}
-	return httpClientProvider.GetTLSConfig(*opts)
-}
-
-// getCustomHeaders returns a map with all the to be set headers
-// The map key represents the HeaderName and the value represents this header's value
-func getCustomHeaders(jsonData *simplejson.Json, decryptedValues map[string]string) map[string]string {
-	headers := make(map[string]string)
-	if jsonData == nil {
-		return headers
-	}
-
-	index := 1
-	for {
-		headerNameSuffix := fmt.Sprintf("httpHeaderName%d", index)
-		headerValueSuffix := fmt.Sprintf("httpHeaderValue%d", index)
-
-		key := jsonData.Get(headerNameSuffix).MustString()
-		if key == "" {
-			// No (more) header values are available
-			break
-		}
-
-		if val, ok := decryptedValues[headerValueSuffix]; ok {
-			headers[key] = val
-		}
-		index++
-	}
-
-	return headers
-}
-
-type cachedDecryptedJSON struct {
-	updated time.Time
-	json    map[string]string
-}
-
-type secureJSONDecryptionCache struct {
-	cache map[int64]cachedDecryptedJSON
-	sync.Mutex
-}
-
-var dsDecryptionCache = secureJSONDecryptionCache{
-	cache: make(map[int64]cachedDecryptedJSON),
-}
-
-// DecryptedValues returns cached decrypted values from secureJsonData.
-func (ds *DataSource) DecryptedValues() map[string]string {
-	dsDecryptionCache.Lock()
-	defer dsDecryptionCache.Unlock()
-
-	if item, present := dsDecryptionCache.cache[ds.Id]; present && ds.Updated.Equal(item.updated) {
-		return item.json
-	}
-
-	json := ds.SecureJsonData.Decrypt()
-	dsDecryptionCache.cache[ds.Id] = cachedDecryptedJSON{
-		updated: ds.Updated,
-		json:    json,
-	}
-
-	return json
-}
-
-// DecryptedValue returns cached decrypted value from cached secureJsonData.
-func (ds *DataSource) DecryptedValue(key string) (string, bool) {
-	value, exists := ds.DecryptedValues()[key]
-	return value, exists
-}
-
-// ClearDSDecryptionCache clears the datasource decryption cache.
-func ClearDSDecryptionCache() {
-	dsDecryptionCache.Lock()
-	defer dsDecryptionCache.Unlock()
-
-	dsDecryptionCache.cache = make(map[int64]cachedDecryptedJSON)
-}
-
-func awsServiceNamespace(dsType string) string {
-	switch dsType {
-	case DS_ES, DS_ES_OPEN_DISTRO:
-		return "es"
-	case DS_PROMETHEUS:
-		return "aps"
-	default:
-		panic(fmt.Sprintf("Unsupported datasource %q", dsType))
-	}
-}

pkg/models/datasource_cache_test.go

@@ -1,581 +0,0 @@
-package models
-
-import (
-	"io/ioutil"
-	"log"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
-	"github.com/grafana/grafana/pkg/components/securejsondata"
-	"github.com/grafana/grafana/pkg/components/simplejson"
-	"github.com/grafana/grafana/pkg/infra/httpclient"
-	"github.com/grafana/grafana/pkg/setting"
-	"github.com/grafana/grafana/pkg/tsdb/azuremonitor/azcredentials"
-	"github.com/grafana/grafana/pkg/util"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-//nolint:goconst
-func TestDataSource_GetHttpTransport(t *testing.T) {
-	t.Run("Should use cached proxy", func(t *testing.T) {
-		var configuredTransport *http.Transport
-		provider := httpclient.NewProvider(sdkhttpclient.ProviderOptions{
-			ConfigureTransport: func(opts sdkhttpclient.Options, transport *http.Transport) {
-				configuredTransport = transport
-			},
-		})
-
-		clearDSProxyCache(t)
-		ds := DataSource{
-			Id:   1,
-			Url:  "http://k8s:8001",
-			Type: "Kubernetes",
-		}
-
-		rt1, err := ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, rt1)
-		tr1 := configuredTransport
-
-		rt2, err := ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, rt2)
-		tr2 := configuredTransport
-
-		require.Same(t, tr1, tr2)
-
-		require.False(t, tr1.TLSClientConfig.InsecureSkipVerify)
-		require.Empty(t, tr1.TLSClientConfig.Certificates)
-		require.Nil(t, tr1.TLSClientConfig.RootCAs)
-	})
-
-	t.Run("Should not use cached proxy when datasource updated", func(t *testing.T) {
-		var configuredTransport *http.Transport
-		provider := httpclient.NewProvider(sdkhttpclient.ProviderOptions{
-			ConfigureTransport: func(opts sdkhttpclient.Options, transport *http.Transport) {
-				configuredTransport = transport
-			},
-		})
-		clearDSProxyCache(t)
-		setting.SecretKey = "password"
-
-		json := simplejson.New()
-		json.Set("tlsAuthWithCACert", true)
-
-		tlsCaCert, err := util.Encrypt([]byte(caCert), "password")
-		require.NoError(t, err)
-		ds := DataSource{
-			Id:             1,
-			Url:            "http://k8s:8001",
-			Type:           "Kubernetes",
-			SecureJsonData: map[string][]byte{"tlsCACert": tlsCaCert},
-			Updated:        time.Now().Add(-2 * time.Minute),
-		}
-
-		rt1, err := ds.GetHTTPTransport(provider)
-		require.NotNil(t, rt1)
-		require.NoError(t, err)
-
-		tr1 := configuredTransport
-
-		require.False(t, tr1.TLSClientConfig.InsecureSkipVerify)
-		require.Empty(t, tr1.TLSClientConfig.Certificates)
-		require.Nil(t, tr1.TLSClientConfig.RootCAs)
-
-		ds.JsonData = nil
-		ds.SecureJsonData = map[string][]byte{}
-		ds.Updated = time.Now()
-
-		rt2, err := ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, rt2)
-		tr2 := configuredTransport
-
-		require.NotSame(t, tr1, tr2)
-		require.Nil(t, tr2.TLSClientConfig.RootCAs)
-	})
-
-	t.Run("Should set TLS client authentication enabled if configured in JsonData", func(t *testing.T) {
-		var configuredTransport *http.Transport
-		provider := httpclient.NewProvider(sdkhttpclient.ProviderOptions{
-			ConfigureTransport: func(opts sdkhttpclient.Options, transport *http.Transport) {
-				configuredTransport = transport
-			},
-		})
-		clearDSProxyCache(t)
-		setting.SecretKey = "password"
-
-		json := simplejson.New()
-		json.Set("tlsAuth", true)
-
-		tlsClientCert, err := util.Encrypt([]byte(clientCert), "password")
-		require.NoError(t, err)
-		tlsClientKey, err := util.Encrypt([]byte(clientKey), "password")
-		require.NoError(t, err)
-
-		ds := DataSource{
-			Id:       1,
-			Url:      "http://k8s:8001",
-			Type:     "Kubernetes",
-			JsonData: json,
-			SecureJsonData: map[string][]byte{
-				"tlsClientCert": tlsClientCert,
-				"tlsClientKey":  tlsClientKey,
-			},
-		}
-
-		rt, err := ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, rt)
-		tr := configuredTransport
-
-		require.False(t, tr.TLSClientConfig.InsecureSkipVerify)
-		require.Len(t, tr.TLSClientConfig.Certificates, 1)
-	})
-
-	t.Run("Should set user-supplied TLS CA if configured in JsonData", func(t *testing.T) {
-		var configuredTransport *http.Transport
-		provider := httpclient.NewProvider(sdkhttpclient.ProviderOptions{
-			ConfigureTransport: func(opts sdkhttpclient.Options, transport *http.Transport) {
-				configuredTransport = transport
-			},
-		})
-		clearDSProxyCache(t)
-		ClearDSDecryptionCache()
-		setting.SecretKey = "password"
-
-		json := simplejson.New()
-		json.Set("tlsAuthWithCACert", true)
-		json.Set("serverName", "server-name")
-
-		tlsCaCert, err := util.Encrypt([]byte(caCert), "password")
-		require.NoError(t, err)
-
-		ds := DataSource{
-			Id:       1,
-			Url:      "http://k8s:8001",
-			Type:     "Kubernetes",
-			JsonData: json,
-			SecureJsonData: map[string][]byte{
-				"tlsCACert": tlsCaCert,
-			},
-		}
-
-		rt, err := ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, rt)
-		tr := configuredTransport
-
-		require.False(t, tr.TLSClientConfig.InsecureSkipVerify)
-		require.Len(t, tr.TLSClientConfig.RootCAs.Subjects(), 1)
-		require.Equal(t, "server-name", tr.TLSClientConfig.ServerName)
-	})
-
-	t.Run("Should set skip TLS verification if configured in JsonData", func(t *testing.T) {
-		var configuredTransport *http.Transport
-		provider := httpclient.NewProvider(sdkhttpclient.ProviderOptions{
-			ConfigureTransport: func(opts sdkhttpclient.Options, transport *http.Transport) {
-				configuredTransport = transport
-			},
-		})
-		clearDSProxyCache(t)
-
-		json := simplejson.New()
-		json.Set("tlsSkipVerify", true)
-
-		ds := DataSource{
-			Id:       1,
-			Url:      "http://k8s:8001",
-			Type:     "Kubernetes",
-			JsonData: json,
-		}
-
-		rt1, err := ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, rt1)
-		tr1 := configuredTransport
-
-		rt2, err := ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, rt2)
-		tr2 := configuredTransport
-
-		require.Same(t, tr1, tr2)
-		require.True(t, tr1.TLSClientConfig.InsecureSkipVerify)
-	})
-
-	t.Run("Should set custom headers if configured in JsonData", func(t *testing.T) {
-		provider := httpclient.NewProvider()
-		clearDSProxyCache(t)
-		ClearDSDecryptionCache()
-
-		json := simplejson.NewFromAny(map[string]interface{}{
-			"httpHeaderName1": "Authorization",
-		})
-		encryptedData, err := util.Encrypt([]byte(`Bearer xf5yhfkpsnmgo`), setting.SecretKey)
-		if err != nil {
-			log.Fatal(err.Error())
-		}
-
-		ds := DataSource{
-			Id:             1,
-			Url:            "http://k8s:8001",
-			Type:           "Kubernetes",
-			JsonData:       json,
-			SecureJsonData: map[string][]byte{"httpHeaderValue1": encryptedData},
-		}
-
-		headers := getCustomHeaders(json, map[string]string{"httpHeaderValue1": "Bearer xf5yhfkpsnmgo"})
-		require.Equal(t, "Bearer xf5yhfkpsnmgo", headers["Authorization"])
-
-		// 1. Start HTTP test server which checks the request headers
-		backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if r.Header.Get("Authorization") == "Bearer xf5yhfkpsnmgo" {
-				w.WriteHeader(200)
-				_, err := w.Write([]byte("Ok"))
-				require.NoError(t, err)
-				return
-			}
-
-			w.WriteHeader(403)
-			_, err := w.Write([]byte("Invalid bearer token provided"))
-			require.NoError(t, err)
-		}))
-		defer backend.Close()
-
-		// 2. Get HTTP transport from datasource which uses the test server as backend
-		ds.Url = backend.URL
-		rt, err := ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, rt)
-
-		// 3. Send test request which should have the Authorization header set
-		req := httptest.NewRequest("GET", backend.URL+"/test-headers", nil)
-		res, err := rt.RoundTrip(req)
-		require.NoError(t, err)
-		t.Cleanup(func() {
-			err := res.Body.Close()
-			require.NoError(t, err)
-		})
-		body, err := ioutil.ReadAll(res.Body)
-		require.NoError(t, err)
-		bodyStr := string(body)
-		require.Equal(t, "Ok", bodyStr)
-	})
-
-	t.Run("Should use request timeout if configured in JsonData", func(t *testing.T) {
-		provider := httpclient.NewProvider()
-		clearDSProxyCache(t)
-
-		json := simplejson.NewFromAny(map[string]interface{}{
-			"timeout": 19,
-		})
-		ds := DataSource{
-			Id:       1,
-			Url:      "http://k8s:8001",
-			Type:     "Kubernetes",
-			JsonData: json,
-		}
-
-		client, err := ds.GetHTTPClient(provider)
-		require.NoError(t, err)
-		require.NotNil(t, client)
-		require.Equal(t, 19*time.Second, client.Timeout)
-	})
-
-	t.Run("Should populate SigV4 options if configured in JsonData", func(t *testing.T) {
-		var configuredOpts sdkhttpclient.Options
-		provider := httpclient.NewProvider(sdkhttpclient.ProviderOptions{
-			ConfigureTransport: func(opts sdkhttpclient.Options, transport *http.Transport) {
-				configuredOpts = opts
-			},
-		})
-		clearDSProxyCache(t)
-
-		origSigV4Enabled := setting.SigV4AuthEnabled
-		setting.SigV4AuthEnabled = true
-		t.Cleanup(func() {
-			setting.SigV4AuthEnabled = origSigV4Enabled
-		})
-
-		json, err := simplejson.NewJson([]byte(`{ "sigV4Auth": true }`))
-		require.NoError(t, err)
-
-		ds := DataSource{
-			Type:     DS_ES,
-			JsonData: json,
-		}
-
-		_, err = ds.GetHTTPTransport(provider)
-		require.NoError(t, err)
-		require.NotNil(t, configuredOpts)
-		require.NotNil(t, configuredOpts.SigV4)
-		require.Equal(t, "es", configuredOpts.SigV4.Service)
-	})
-}
-
-func TestDataSource_getTimeout(t *testing.T) {
-	originalTimeout := sdkhttpclient.DefaultTimeoutOptions.Timeout
-	sdkhttpclient.DefaultTimeoutOptions.Timeout = 60 * time.Second
-	t.Cleanup(func() {
-		sdkhttpclient.DefaultTimeoutOptions.Timeout = originalTimeout
-	})
-
-	testCases := []struct {
-		jsonData        *simplejson.Json
-		expectedTimeout time.Duration
-	}{
-		{jsonData: simplejson.New(), expectedTimeout: 60 * time.Second},
-		{jsonData: simplejson.NewFromAny(map[string]interface{}{"timeout": nil}), expectedTimeout: 60 * time.Second},
-		{jsonData: simplejson.NewFromAny(map[string]interface{}{"timeout": 0}), expectedTimeout: 60 * time.Second},
-		{jsonData: simplejson.NewFromAny(map[string]interface{}{"timeout": 1}), expectedTimeout: time.Second},
-		{jsonData: simplejson.NewFromAny(map[string]interface{}{"timeout": "2"}), expectedTimeout: 2 * time.Second},
-	}
-
-	for _, tc := range testCases {
-		ds := &DataSource{
-			JsonData: tc.jsonData,
-		}
-		assert.Equal(t, tc.expectedTimeout, ds.getTimeout())
-	}
-}
-
-func TestDataSource_DecryptedValue(t *testing.T) {
-	t.Run("When datasource hasn't been updated, encrypted JSON should be fetched from cache", func(t *testing.T) {
-		ClearDSDecryptionCache()
-
-		ds := DataSource{
-			Id:       1,
-			Type:     DS_INFLUXDB_08,
-			JsonData: simplejson.New(),
-			User:     "user",
-			SecureJsonData: securejsondata.GetEncryptedJsonData(map[string]string{
-				"password": "password",
-			}),
-		}
-
-		// Populate cache
-		password, ok := ds.DecryptedValue("password")
-		require.True(t, ok)
-		require.Equal(t, "password", password)
-
-		ds.SecureJsonData = securejsondata.GetEncryptedJsonData(map[string]string{
-			"password": "",
-		})
-
-		password, ok = ds.DecryptedValue("password")
-		require.True(t, ok)
-		require.Equal(t, "password", password)
-	})
-
-	t.Run("When datasource is updated, encrypted JSON should not be fetched from cache", func(t *testing.T) {
-		ClearDSDecryptionCache()
-
-		ds := DataSource{
-			Id:       1,
-			Type:     DS_INFLUXDB_08,
-			JsonData: simplejson.New(),
-			User:     "user",
-			SecureJsonData: securejsondata.GetEncryptedJsonData(map[string]string{
-				"password": "password",
-			}),
-		}
-
-		// Populate cache
-		password, ok := ds.DecryptedValue("password")
-		require.True(t, ok)
-		require.Equal(t, "password", password)
-
-		ds.SecureJsonData = securejsondata.GetEncryptedJsonData(map[string]string{
-			"password": "",
-		})
-		ds.Updated = time.Now()
-
-		password, ok = ds.DecryptedValue("password")
-		require.True(t, ok)
-		require.Empty(t, password)
-	})
-}
-
-func TestDataSource_HTTPClientOptions(t *testing.T) {
-	emptyJsonData := simplejson.New()
-	emptySecureJsonData := map[string][]byte{}
-
-	ds := DataSource{
-		Id:   1,
-		Url:  "https://api.example.com",
-		Type: "prometheus",
-	}
-
-	t.Run("Azure authentication", func(t *testing.T) {
-		t.Run("should be disabled if not enabled in JsonData", func(t *testing.T) {
-			t.Cleanup(func() { ds.JsonData = emptyJsonData; ds.SecureJsonData = emptySecureJsonData })
-
-			opts, err := ds.HTTPClientOptions()
-			require.NoError(t, err)
-
-			assert.NotEqual(t, true, opts.CustomOptions["_azureAuth"])
-			assert.NotContains(t, opts.CustomOptions, "_azureCredentials")
-		})
-
-		t.Run("should be enabled if enabled in JsonData without credentials configured", func(t *testing.T) {
-			t.Cleanup(func() { ds.JsonData = emptyJsonData; ds.SecureJsonData = emptySecureJsonData })
-
-			ds.JsonData = simplejson.NewFromAny(map[string]interface{}{
-				"azureAuth": true,
-			})
-
-			opts, err := ds.HTTPClientOptions()
-			require.NoError(t, err)
-
-			assert.Equal(t, true, opts.CustomOptions["_azureAuth"])
-			assert.NotContains(t, opts.CustomOptions, "_azureCredentials")
-		})
-
-		t.Run("should be enabled if enabled in JsonData with credentials configured", func(t *testing.T) {
-			t.Cleanup(func() { ds.JsonData = emptyJsonData; ds.SecureJsonData = emptySecureJsonData })
-
-			ds.JsonData = simplejson.NewFromAny(map[string]interface{}{
-				"azureAuth": true,
-				"azureCredentials": map[string]interface{}{
-					"authType": "msi",
-				},
-			})
-
-			opts, err := ds.HTTPClientOptions()
-			require.NoError(t, err)
-
-			assert.Equal(t, true, opts.CustomOptions["_azureAuth"])
-
-			require.Contains(t, opts.CustomOptions, "_azureCredentials")
-			credentials := opts.CustomOptions["_azureCredentials"]
-
-			assert.IsType(t, &azcredentials.AzureManagedIdentityCredentials{}, credentials)
-		})
-
-		t.Run("should be disabled if disabled in JsonData even with credentials configured", func(t *testing.T) {
-			t.Cleanup(func() { ds.JsonData = emptyJsonData; ds.SecureJsonData = emptySecureJsonData })
-
-			ds.JsonData = simplejson.NewFromAny(map[string]interface{}{
-				"azureAuth": false,
-				"azureCredentials": map[string]interface{}{
-					"authType": "msi",
-				},
-			})
-
-			opts, err := ds.HTTPClientOptions()
-			require.NoError(t, err)
-
-			assert.NotEqual(t, true, opts.CustomOptions["_azureAuth"])
-			assert.NotContains(t, opts.CustomOptions, "_azureCredentials")
-		})
-
-		t.Run("should fail if credentials are invalid", func(t *testing.T) {
-			t.Cleanup(func() { ds.JsonData = emptyJsonData; ds.SecureJsonData = emptySecureJsonData })
-
-			ds.JsonData = simplejson.NewFromAny(map[string]interface{}{
-				"azureAuth":        true,
-				"azureCredentials": "invalid",
-			})
-
-			_, err := ds.HTTPClientOptions()
-			assert.Error(t, err)
-		})
-
-		t.Run("should pass resourceId from JsonData", func(t *testing.T) {
-			t.Cleanup(func() { ds.JsonData = emptyJsonData; ds.SecureJsonData = emptySecureJsonData })
-
-			ds.JsonData = simplejson.NewFromAny(map[string]interface{}{
-				"azureEndpointResourceId": "https://api.example.com/abd5c4ce-ca73-41e9-9cb2-bed39aa2adb5",
-			})
-
-			opts, err := ds.HTTPClientOptions()
-			require.NoError(t, err)
-
-			require.Contains(t, opts.CustomOptions, "azureEndpointResourceId")
-			azureEndpointResourceId := opts.CustomOptions["azureEndpointResourceId"]
-
-			assert.Equal(t, "https://api.example.com/abd5c4ce-ca73-41e9-9cb2-bed39aa2adb5", azureEndpointResourceId)
-		})
-	})
-}
-
-func clearDSProxyCache(t *testing.T) {
-	t.Helper()
-
-	ptc.Lock()
-	defer ptc.Unlock()
-
-	ptc.cache = make(map[int64]cachedRoundTripper)
-}
-
-const caCert string = `-----BEGIN CERTIFICATE-----
-MIIDATCCAemgAwIBAgIJAMQ5hC3CPDTeMA0GCSqGSIb3DQEBCwUAMBcxFTATBgNV
-BAMMDGNhLWs4cy1zdGhsbTAeFw0xNjEwMjcwODQyMjdaFw00NDAzMTQwODQyMjda
-MBcxFTATBgNVBAMMDGNhLWs4cy1zdGhsbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAMLe2AmJ6IleeUt69vgNchOjjmxIIxz5sp1vFu94m1vUip7CqnOg
-QkpUsHeBPrGYv8UGloARCL1xEWS+9FVZeXWQoDmbC0SxXhFwRIESNCET7Q8KMi/4
-4YPvnMLGZi3Fjwxa8BdUBCN1cx4WEooMVTWXm7RFMtZgDfuOAn3TNXla732sfT/d
-1HNFrh48b0wA+HhmA3nXoBnBEblA665hCeo7lIAdRr0zJxJpnFnWXkyTClsAUTMN
-iL905LdBiiIRenojipfKXvMz88XSaWTI7JjZYU3BvhyXndkT6f12cef3I96NY3WJ
-0uIK4k04WrbzdYXMU3rN6NqlvbHqnI+E7aMCAwEAAaNQME4wHQYDVR0OBBYEFHHx
-2+vSPw9bECHj3O51KNo5VdWOMB8GA1UdIwQYMBaAFHHx2+vSPw9bECHj3O51KNo5
-VdWOMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAH2eV5NcV3LBJHs9
-I+adbiTPg2vyumrGWwy73T0X8Dtchgt8wU7Q9b9Ucg2fOTmSSyS0iMqEu1Yb2ORB
-CknM9mixHC9PwEBbkGCom3VVkqdLwSP6gdILZgyLoH4i8sTUz+S1yGPepi+Vzhs7
-adOXtryjcGnwft6HdfKPNklMOHFnjw6uqpho54oj/z55jUpicY/8glDHdrr1bh3k
-MHuiWLGewHXPvxfG6UoUx1te65IhifVcJGFZDQwfEmhBflfCmtAJlZEsgTLlBBCh
-FHoXIyGOdq1chmRVocdGBCF8fUoGIbuF14r53rpvcbEKtKnnP8+96luKAZLq0a4n
-3lb92xM=
------END CERTIFICATE-----`
-
-const clientCert string = `
------BEGIN CERTIFICATE-----
-MIICsjCCAZoCCQCcd8sOfstQLzANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxj
-YS1rOHMtc3RobG0wHhcNMTYxMTAyMDkyNTE1WhcNMTcxMTAyMDkyNTE1WjAfMR0w
-GwYDVQQDDBRhZG0tZGFuaWVsLWs4cy1zdGhsbTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAOMliaWyNEUJKM37vWCl5bGub3lMicyRAqGQyY/qxD9yKKM2
-FbucVcmWmg5vvTqQVl5rlQ+c7GI8OD6ptmFl8a26coEki7bFr8bkpSyBSEc5p27b
-Z0ORFSqBHWHQbr9PkxPLYW6T3gZYUtRYv3OQgGxLXlvUh85n/mQfuR3N1FgmShHo
-GtAFi/ht6leXa0Ms+jNSDLCmXpJm1GIEqgyKX7K3+g3vzo9coYqXq4XTa8Efs2v8
-SCwqWfBC3rHfgs/5DLB8WT4Kul8QzxkytzcaBQfRfzhSV6bkgm7oTzt2/1eRRsf4
-YnXzLE9YkCC9sAn+Owzqf+TYC1KRluWDfqqBTJUCAwEAATANBgkqhkiG9w0BAQsF
-AAOCAQEAdMsZg6edWGC+xngizn0uamrUg1ViaDqUsz0vpzY5NWLA4MsBc4EtxWRP
-ueQvjUimZ3U3+AX0YWNLIrH1FCVos2jdij/xkTUmHcwzr8rQy+B17cFi+a8jtpgw
-AU6WWoaAIEhhbWQfth/Diz3mivl1ARB+YqiWca2mjRPLTPcKJEURDVddQ423el0Q
-4JNxS5icu7T2zYTYHAo/cT9zVdLZl0xuLxYm3asK1IONJ/evxyVZima3il6MPvhe
-58Hwz+m+HdqHxi24b/1J/VKYbISG4huOQCdLzeNXgvwFlGPUmHSnnKo1/KbQDAR5
-llG/Sw5+FquFuChaA6l5KWy7F3bQyA==
------END CERTIFICATE-----`
-
-const clientKey string = `-----BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEA4yWJpbI0RQkozfu9YKXlsa5veUyJzJECoZDJj+rEP3IoozYV
-u5xVyZaaDm+9OpBWXmuVD5zsYjw4Pqm2YWXxrbpygSSLtsWvxuSlLIFIRzmnbttn
-Q5EVKoEdYdBuv0+TE8thbpPeBlhS1Fi/c5CAbEteW9SHzmf+ZB+5Hc3UWCZKEega
-0AWL+G3qV5drQyz6M1IMsKZekmbUYgSqDIpfsrf6De/Oj1yhiperhdNrwR+za/xI
-LCpZ8ELesd+Cz/kMsHxZPgq6XxDPGTK3NxoFB9F/OFJXpuSCbuhPO3b/V5FGx/hi
-dfMsT1iQIL2wCf47DOp/5NgLUpGW5YN+qoFMlQIDAQABAoIBAQCzy4u312XeW1Cs
-Mx6EuOwmh59/ESFmBkZh4rxZKYgrfE5EWlQ7i5SwG4BX+wR6rbNfy6JSmHDXlTkk
-CKvvToVNcW6fYHEivDnVojhIERFIJ4+rhQmpBtcNLOQ3/4cZ8X/GxE6b+3lb5l+x
-64mnjPLKRaIr5/+TVuebEy0xNTJmjnJ7yiB2HRz7uXEQaVSk/P7KAkkyl/9J3/LM
-8N9AX1w6qDaNQZ4/P0++1H4SQenosM/b/GqGTomarEk/GE0NcB9rzmR9VCXa7FRh
-WV5jyt9vUrwIEiK/6nUnOkGO8Ei3kB7Y+e+2m6WdaNoU5RAfqXmXa0Q/a0lLRruf
-vTMo2WrBAoGBAPRaK4cx76Q+3SJ/wfznaPsMM06OSR8A3ctKdV+ip/lyKtb1W8Pz
-k8MYQDH7GwPtSu5QD8doL00pPjugZL/ba7X9nAsI+pinyEErfnB9y7ORNEjIYYzs
-DiqDKup7ANgw1gZvznWvb9Ge0WUSXvWS0pFkgootQAf+RmnnbWGH6l6RAoGBAO35
-aGUrLro5u9RD24uSXNU3NmojINIQFK5dHAT3yl0BBYstL43AEsye9lX95uMPTvOQ
-Cqcn42Hjp/bSe3n0ObyOZeXVrWcDFAfE0wwB1BkvL1lpgnFO9+VQORlH4w3Ppnpo
-jcPkR2TFeDaAYtvckhxe/Bk3OnuFmnsQ3VzM75fFAoGBAI6PvS2XeNU+yA3EtA01
-hg5SQ+zlHswz2TMuMeSmJZJnhY78f5mHlwIQOAPxGQXlf/4iP9J7en1uPpzTK3S0
-M9duK4hUqMA/w5oiIhbHjf0qDnMYVbG+V1V+SZ+cPBXmCDihKreGr5qBKnHpkfV8
-v9WL6o1rcRw4wiQvnaV1gsvBAoGBALtzVTczr6gDKCAIn5wuWy+cQSGTsBunjRLX
-xuVm5iEiV+KMYkPvAx/pKzMLP96lRVR3ptyKgAKwl7LFk3u50+zh4gQLr35QH2wL
-Lw7rNc3srAhrItPsFzqrWX6/cGuFoKYVS239l/sZzRppQPXcpb7xVvTp2whHcir0
-Wtnpl+TdAoGAGqKqo2KU3JoY3IuTDUk1dsNAm8jd9EWDh+s1x4aG4N79mwcss5GD
-FF8MbFPneK7xQd8L6HisKUDAUi2NOyynM81LAftPkvN6ZuUVeFDfCL4vCA0HUXLD
-+VrOhtUZkNNJlLMiVRJuQKUOGlg8PpObqYbstQAf/0/yFJMRHG82Tcg=
------END RSA PRIVATE KEY-----`

pkg/models/plugin_setting_cache.go

@@ -1,23 +0,0 @@
-package models
-
-var pluginSettingDecryptionCache = secureJSONDecryptionCache{
-	cache: make(map[int64]cachedDecryptedJSON),
-}
-
-// DecryptedValues returns cached decrypted values from secureJsonData.
-func (ps *PluginSetting) DecryptedValues() map[string]string {
-	pluginSettingDecryptionCache.Lock()
-	defer pluginSettingDecryptionCache.Unlock()
-
-	if item, present := pluginSettingDecryptionCache.cache[ps.Id]; present && ps.Updated.Equal(item.updated) {
-		return item.json
-	}
-
-	json := ps.SecureJsonData.Decrypt()
-	pluginSettingDecryptionCache.cache[ps.Id] = cachedDecryptedJSON{
-		updated: ps.Updated,
-		json:    json,
-	}
-
-	return json
-}

pkg/models/plugin_setting_cache_test.go

@@ -1,70 +0,0 @@
-package models
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/grafana/grafana/pkg/components/securejsondata"
-)
-
-// clearPluginSettingDecryptionCache clears the datasource decryption cache.
-func clearPluginSettingDecryptionCache() {
-	pluginSettingDecryptionCache.Lock()
-	defer pluginSettingDecryptionCache.Unlock()
-
-	pluginSettingDecryptionCache.cache = make(map[int64]cachedDecryptedJSON)
-}
-
-func TestPluginSettingDecryptionCache(t *testing.T) {
-	t.Run("When plugin settings hasn't been updated, encrypted JSON should be fetched from cache", func(t *testing.T) {
-		clearPluginSettingDecryptionCache()
-
-		ps := PluginSetting{
-			Id:       1,
-			JsonData: map[string]interface{}{},
-			SecureJsonData: securejsondata.GetEncryptedJsonData(map[string]string{
-				"password": "password",
-			}),
-		}
-
-		// Populate cache
-		password, ok := ps.DecryptedValues()["password"]
-		require.Equal(t, "password", password)
-		require.True(t, ok)
-
-		ps.SecureJsonData = securejsondata.GetEncryptedJsonData(map[string]string{
-			"password": "",
-		})
-
-		require.Equal(t, "password", password)
-		require.True(t, ok)
-	})
-
-	t.Run("When plugin settings is updated, encrypted JSON should not be fetched from cache", func(t *testing.T) {
-		clearPluginSettingDecryptionCache()
-
-		ps := PluginSetting{
-			Id:       1,
-			JsonData: map[string]interface{}{},
-			SecureJsonData: securejsondata.GetEncryptedJsonData(map[string]string{
-				"password": "password",
-			}),
-		}
-
-		// Populate cache
-		password, ok := ps.DecryptedValues()["password"]
-		require.Equal(t, "password", password)
-		require.True(t, ok)
-
-		ps.SecureJsonData = securejsondata.GetEncryptedJsonData(map[string]string{
-			"password": "",
-		})
-		ps.Updated = time.Now()
-
-		password, ok = ps.DecryptedValues()["password"]
-		require.Empty(t, password)
-		require.True(t, ok)
-	})
-}

pkg/models/plugin_settings.go

@@ -3,8 +3,6 @@ package models
 import (
 	"errors"
 	"time"
-
-	"github.com/grafana/grafana/pkg/components/securejsondata"
 )
 
 var (
@@ -18,7 +16,7 @@ type PluginSetting struct {
 	Enabled        bool
 	Pinned         bool
 	JsonData       map[string]interface{}
-	SecureJsonData securejsondata.SecureJsonData
+	SecureJsonData map[string][]byte
 	PluginVersion  string
 
 	Created time.Time
@@ -36,8 +34,9 @@ type UpdatePluginSettingCmd struct {
 	SecureJsonData map[string]string      `json:"secureJsonData"`
 	PluginVersion  string                 `json:"version"`
 
-	PluginId string `json:"-"`
-	OrgId    int64  `json:"-"`
+	PluginId                string            `json:"-"`
+	OrgId                   int64             `json:"-"`
+	EncryptedSecureJsonData map[string][]byte `json:"-"`
 }
 
 // specific command, will only update version
@@ -47,10 +46,6 @@ type UpdatePluginSettingVersionCmd struct {
 	OrgId         int64  `json:"-"`
 }
 
-func (cmd *UpdatePluginSettingCmd) GetEncryptedJsonData() securejsondata.SecureJsonData {
-	return securejsondata.GetEncryptedJsonData(cmd.SecureJsonData)
-}
-
 // ---------------------
 // QUERIES