From 9f2386a219a33ed775daeb4153f4356cb4bbf50f Mon Sep 17 00:00:00 2001
From: Will Browne <wbrowne@users.noreply.github.com>
Date: Thu, 20 Aug 2020 16:05:48 +0200
Subject: [PATCH] Alerting: Store sensitive settings encrypted for OpsGenie
 notifier (#27074)

* encrypt OpsGenie API key

* make whitespace consistent

* update docs
---
 docs/sources/administration/provisioning.md | 12 ++--
 pkg/services/alerting/notifiers/opsgenie.go | 69 ++++++++++++---------
 2 files changed, 47 insertions(+), 34 deletions(-)

diff --git a/docs/sources/administration/provisioning.md b/docs/sources/administration/provisioning.md
index 7b2aa6f0323..d35b91297fb 100644
--- a/docs/sources/administration/provisioning.md
+++ b/docs/sources/administration/provisioning.md
@@ -511,12 +511,12 @@ The following sections detail the supported settings and secure settings for eac
 
 #### Alert notification `opsgenie`
 
-| Name             |
-| ---------------- |
-| apiKey           |
-| apiUrl           |
-| autoClose        |
-| overridePriority |
+| Name             | Secure setting |
+| ---------------- | - |
+| apiKey           | yes |
+| apiUrl           | |
+| autoClose        | |
+| overridePriority | |
 
 #### Alert notification `telegram`
 
diff --git a/pkg/services/alerting/notifiers/opsgenie.go b/pkg/services/alerting/notifiers/opsgenie.go
index 177f1c896a9..e7a3158fee9 100644
--- a/pkg/services/alerting/notifiers/opsgenie.go
+++ b/pkg/services/alerting/notifiers/opsgenie.go
@@ -19,33 +19,46 @@ func init() {
 		Heading:     "OpsGenie settings",
 		Factory:     NewOpsGenieNotifier,
 		OptionsTemplate: `
-      <h3 class="page-heading">OpsGenie settings</h3>
-      <div class="gf-form">
-        <span class="gf-form-label width-14">API Key</span>
-        <input type="text" required class="gf-form-input max-width-22" ng-model="ctrl.model.settings.apiKey" placeholder="OpsGenie API Key"></input>
-      </div>
-      <div class="gf-form">
-        <span class="gf-form-label width-14">Alert API Url</span>
-        <input type="text" required class="gf-form-input max-width-22" ng-model="ctrl.model.settings.apiUrl" placeholder="https://api.opsgenie.com/v2/alerts"></input>
-      </div>
-      <div class="gf-form">
-        <gf-form-switch
-           class="gf-form"
-           label="Auto close incidents"
-           label-class="width-14"
-           checked="ctrl.model.settings.autoClose"
-           tooltip="Automatically close alerts in OpsGenie once the alert goes back to ok.">
-        </gf-form-switch>
-      </div>
-      <div class="gf-form">
-        <gf-form-switch
-           class="gf-form"
-           label="Override priority"
-           label-class="width-14"
-           checked="ctrl.model.settings.overridePriority"
-           tooltip="Allow the alert priority to be set using the og_priority tag">
-        </gf-form-switch>
-  </div>
+		<h3 class="page-heading">OpsGenie settings</h3>
+		<div class="gf-form">
+			<label class="gf-form-label max-width-14">API Key</label>
+			<div class="gf-form gf-form--grow" ng-if="!ctrl.model.secureFields.apiKey">
+				<input type="text"
+					required
+					class="gf-form-input max-width-22"
+					ng-init="ctrl.model.secureSettings.apiKey = ctrl.model.settings.apiKey || null; ctrl.model.settings.apiKey = null;"
+					ng-model="ctrl.model.secureSettings.apiKey"
+					placeholder="OpsGenie API Key"
+					data-placement="right">
+				</input>
+			</div>
+			<div class="gf-form" ng-if="ctrl.model.secureFields.apiKey">
+			  <input type="text" class="gf-form-input max-width-18" disabled="disabled" value="configured" />
+			  <a class="btn btn-secondary gf-form-btn" href="#" ng-click="ctrl.model.secureFields.apiKey = false">reset</a>
+			</div>
+		</div>
+		<div class="gf-form">
+			<span class="gf-form-label width-14">Alert API Url</span>
+			<input type="text" required class="gf-form-input max-width-22" ng-model="ctrl.model.settings.apiUrl" placeholder="https://api.opsgenie.com/v2/alerts"></input>
+		</div>
+		<div class="gf-form">
+			<gf-form-switch
+				class="gf-form"
+				label="Auto close incidents"
+				label-class="width-14"
+				checked="ctrl.model.settings.autoClose"
+				tooltip="Automatically close alerts in OpsGenie once the alert goes back to ok.">
+			</gf-form-switch>
+		</div>
+		<div class="gf-form">
+			<gf-form-switch
+				class="gf-form"
+				label="Override priority"
+				label-class="width-14"
+				checked="ctrl.model.settings.overridePriority"
+				tooltip="Allow the alert priority to be set using the og_priority tag">
+			</gf-form-switch>
+  		</div>
 `,
 		Options: []alerting.NotifierOption{
 			{
@@ -87,7 +100,7 @@ var (
 func NewOpsGenieNotifier(model *models.AlertNotification) (alerting.Notifier, error) {
 	autoClose := model.Settings.Get("autoClose").MustBool(true)
 	overridePriority := model.Settings.Get("overridePriority").MustBool(true)
-	apiKey := model.Settings.Get("apiKey").MustString()
+	apiKey := model.DecryptedValue("apiKey", model.Settings.Get("apiKey").MustString())
 	apiURL := model.Settings.Get("apiUrl").MustString()
 	if apiKey == "" {
 		return nil, alerting.ValidationError{Reason: "Could not find api key property in settings"}