Alerting: Refactor receiver_svc and provisioning config store into legacy_storage package (#90856)

* Add more receivers api tests * Move provisioning config store to new legacy_storage package
2024-07-26 17:45:33 -04:00
parent 0edb0c5c4f
commit a1f0b599a7
29 changed files with 1013 additions and 687 deletions
@@ -3,18 +3,24 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strconv"
+	"strings"
 	"testing"

 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/log/logtest"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
+	ac "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
 	"github.com/grafana/grafana/pkg/services/ngalert/models"
 	"github.com/grafana/grafana/pkg/services/ngalert/notifier"
+	"github.com/grafana/grafana/pkg/services/ngalert/notifier/legacy_storage"
 	"github.com/grafana/grafana/pkg/services/ngalert/tests/fakes"
 	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/web"
@@ -75,7 +81,7 @@ func TestRouteGetReceiver(t *testing.T) {

 	t.Run("should pass along not found response", func(t *testing.T) {
 		fakeReceiverSvc.GetReceiverFn = func(ctx context.Context, q models.GetReceiverQuery, u identity.Requester) (definitions.GettableApiReceiver, error) {
-			return definitions.GettableApiReceiver{}, notifier.ErrNotFound
+			return definitions.GettableApiReceiver{}, notifier.ErrReceiverNotFound.Errorf("")
 		}
 		handler := NewNotificationsApi(newNotificationSrv(fakeReceiverSvc))
 		rc := testReqCtx("GET")
@@ -85,7 +91,7 @@ func TestRouteGetReceiver(t *testing.T) {

 	t.Run("should pass along permission denied response", func(t *testing.T) {
 		fakeReceiverSvc.GetReceiverFn = func(ctx context.Context, q models.GetReceiverQuery, u identity.Requester) (definitions.GettableApiReceiver, error) {
-			return definitions.GettableApiReceiver{}, notifier.ErrPermissionDenied
+			return definitions.GettableApiReceiver{}, ac.ErrAuthorizationBase.Errorf("")
 		}
 		handler := NewNotificationsApi(newNotificationSrv(fakeReceiverSvc))
 		rc := testReqCtx("GET")
@@ -155,7 +161,7 @@ func TestRouteGetReceivers(t *testing.T) {

 	t.Run("should pass along permission denied response", func(t *testing.T) {
 		fakeReceiverSvc.GetReceiversFn = func(ctx context.Context, q models.GetReceiversQuery, u identity.Requester) ([]definitions.GettableApiReceiver, error) {
-			return nil, notifier.ErrPermissionDenied
+			return nil, ac.ErrAuthorizationBase.Errorf("")
 		}
 		handler := NewNotificationsApi(newNotificationSrv(fakeReceiverSvc))
 		rc := testReqCtx("GET")
@@ -164,6 +170,246 @@ func TestRouteGetReceivers(t *testing.T) {
 	})
 }

+func TestRouteGetReceiversResponses(t *testing.T) {
+	createTestEnv := func(t *testing.T, testConfig string) testEnvironment {
+		env := createTestEnv(t, testConfig)
+		env.ac = &recordingAccessControlFake{
+			Callback: func(user *user.SignedInUser, evaluator accesscontrol.Evaluator) (bool, error) {
+				if strings.Contains(evaluator.String(), accesscontrol.ActionAlertingNotificationsRead) {
+					return true, nil
+				}
+				if strings.Contains(evaluator.String(), accesscontrol.ActionAlertingReceiversList) {
+					return true, nil
+				}
+				return false, nil
+			},
+		}
+		return env
+	}
+
+	t.Run("list receivers", func(t *testing.T) {
+		t.Run("GET returns 200", func(t *testing.T) {
+			env := createTestEnv(t, testConfig)
+			sut := createNotificationSrvSutFromEnv(t, &env)
+			rc := createTestRequestCtx()
+
+			response := sut.RouteGetReceivers(&rc)
+
+			require.Equal(t, 200, response.Status())
+		})
+		t.Run("decrypt true without alert.provisioning.secrets:read permissions returns 403", func(t *testing.T) {
+			recPermCheck := false
+			env := createTestEnv(t, testConfig)
+			env.ac = &recordingAccessControlFake{
+				Callback: func(user *user.SignedInUser, evaluator accesscontrol.Evaluator) (bool, error) {
+					if strings.Contains(evaluator.String(), accesscontrol.ActionAlertingProvisioningReadSecrets) {
+						recPermCheck = true
+					}
+					return false, nil
+				},
+			}
+
+			sut := createNotificationSrvSutFromEnv(t, &env)
+			rc := createTestRequestCtx()
+
+			rc.Context.Req.Form.Set("decrypt", "true")
+
+			response := sut.RouteGetReceivers(&rc)
+
+			require.True(t, recPermCheck)
+			require.Equal(t, 403, response.Status())
+		})
+
+		t.Run("json body content is as expected", func(t *testing.T) {
+			expectedDecryptedResponse := `[{"name":"grafana-default-email","grafana_managed_receiver_configs":[{"uid":"ad95bd8a-49ed-4adc-bf89-1b444fa1aa5b","name":"grafana-default-email","type":"email","disableResolveMessage":false,"settings":{"addresses":"\u003cexample@email.com\u003e"},"secureFields":{}}]},{"name":"multiple integrations","grafana_managed_receiver_configs":[{"uid":"c2090fda-f824-4add-b545-5a4d5c2ef082","name":"multiple integrations","type":"prometheus-alertmanager","disableResolveMessage":true,"settings":{"basicAuthPassword":"testpass","basicAuthUser":"test","url":"http://localhost:9093"},"secureFields":{"basicAuthPassword":true}},{"uid":"c84539ec-f87e-4fc5-9a91-7a687d34bbd1","name":"multiple integrations","type":"discord","disableResolveMessage":false,"settings":{"avatar_url":"some avatar","url":"some url","use_discord_username":true},"secureFields":{}}]},{"name":"pagerduty test","grafana_managed_receiver_configs":[{"uid":"b9bf06f8-bde2-4438-9d4a-bba0522dcd4d","name":"pagerduty test","type":"pagerduty","disableResolveMessage":false,"settings":{"client":"some client","integrationKey":"some key","severity":"criticalish"},"secureFields":{"integrationKey":true}}]},{"name":"slack test","grafana_managed_receiver_configs":[{"uid":"cbfd0976-8228-4126-b672-4419f30a9e50","name":"slack test","type":"slack","disableResolveMessage":true,"settings":{"text":"title body test","title":"title test","url":"some secure slack webhook"},"secureFields":{"url":true}}]}]`
+			expectedRedactedResponse := `[{"name":"grafana-default-email","grafana_managed_receiver_configs":[{"uid":"ad95bd8a-49ed-4adc-bf89-1b444fa1aa5b","name":"grafana-default-email","type":"email","disableResolveMessage":false,"settings":{"addresses":"\u003cexample@email.com\u003e"},"secureFields":{}}]},{"name":"multiple integrations","grafana_managed_receiver_configs":[{"uid":"c2090fda-f824-4add-b545-5a4d5c2ef082","name":"multiple integrations","type":"prometheus-alertmanager","disableResolveMessage":true,"settings":{"basicAuthPassword":"[REDACTED]","basicAuthUser":"test","url":"http://localhost:9093"},"secureFields":{"basicAuthPassword":true}},{"uid":"c84539ec-f87e-4fc5-9a91-7a687d34bbd1","name":"multiple integrations","type":"discord","disableResolveMessage":false,"settings":{"avatar_url":"some avatar","url":"some url","use_discord_username":true},"secureFields":{}}]},{"name":"pagerduty test","grafana_managed_receiver_configs":[{"uid":"b9bf06f8-bde2-4438-9d4a-bba0522dcd4d","name":"pagerduty test","type":"pagerduty","disableResolveMessage":false,"settings":{"client":"some client","integrationKey":"[REDACTED]","severity":"criticalish"},"secureFields":{"integrationKey":true}}]},{"name":"slack test","grafana_managed_receiver_configs":[{"uid":"cbfd0976-8228-4126-b672-4419f30a9e50","name":"slack test","type":"slack","disableResolveMessage":true,"settings":{"text":"title body test","title":"title test","url":"[REDACTED]"},"secureFields":{"url":true}}]}]`
+			expectedListResponse := `[{"name":"grafana-default-email","grafana_managed_receiver_configs":[{"uid":"ad95bd8a-49ed-4adc-bf89-1b444fa1aa5b","name":"grafana-default-email","type":"email","disableResolveMessage":false,"secureFields":null}]},{"name":"multiple integrations","grafana_managed_receiver_configs":[{"uid":"c2090fda-f824-4add-b545-5a4d5c2ef082","name":"multiple integrations","type":"prometheus-alertmanager","disableResolveMessage":false,"secureFields":null},{"uid":"c84539ec-f87e-4fc5-9a91-7a687d34bbd1","name":"multiple integrations","type":"discord","disableResolveMessage":false,"secureFields":null}]},{"name":"pagerduty test","grafana_managed_receiver_configs":[{"uid":"b9bf06f8-bde2-4438-9d4a-bba0522dcd4d","name":"pagerduty test","type":"pagerduty","disableResolveMessage":false,"secureFields":null}]},{"name":"slack test","grafana_managed_receiver_configs":[{"uid":"cbfd0976-8228-4126-b672-4419f30a9e50","name":"slack test","type":"slack","disableResolveMessage":false,"secureFields":null}]}]`
+			t.Run("limit offset", func(t *testing.T) {
+				env := createTestEnv(t, testContactPointConfig)
+				sut := createNotificationSrvSutFromEnv(t, &env)
+				rc := createTestRequestCtx()
+
+				rc.Context.Req.Header.Add("Accept", "application/json")
+				rc.Context.Req.Form.Set("decrypt", "false")
+
+				var expected []definitions.GettableApiReceiver
+				err := json.Unmarshal([]byte(expectedRedactedResponse), &expected)
+				require.NoError(t, err)
+				type testcase struct {
+					limit    int
+					offset   int
+					expected []definitions.GettableApiReceiver
+				}
+				testcases := []testcase{
+					{limit: 1, offset: 0, expected: expected[:1]},
+					{limit: 2, offset: 0, expected: expected[:2]},
+					{limit: 4, offset: 0, expected: expected[:4]},
+					{limit: 1, offset: 1, expected: expected[1:2]},
+					{limit: 2, offset: 2, expected: expected[2:4]},
+					{limit: 2, offset: 99, expected: nil},
+					{limit: 0, offset: 0, expected: expected},
+					{limit: 0, offset: 1, expected: expected[1:]},
+				}
+				for _, tc := range testcases {
+					t.Run(fmt.Sprintf("limit %d offset %d", tc.limit, tc.offset), func(t *testing.T) {
+						rc.Context.Req.Form.Set("limit", strconv.Itoa(tc.limit))
+						rc.Context.Req.Form.Set("offset", strconv.Itoa(tc.offset))
+
+						response := sut.RouteGetReceivers(&rc)
+						require.Equal(t, 200, response.Status())
+
+						var configs []definitions.GettableApiReceiver
+						err := json.Unmarshal(response.Body(), &configs)
+						require.NoError(t, err)
+
+						require.Equal(t, configs, tc.expected)
+					})
+				}
+			})
+			t.Run("decrypt false with read permissions is redacted", func(t *testing.T) {
+				env := createTestEnv(t, testContactPointConfig)
+				sut := createNotificationSrvSutFromEnv(t, &env)
+				rc := createTestRequestCtx()
+
+				rc.Context.Req.Header.Add("Accept", "application/json")
+				rc.Context.Req.Form.Set("decrypt", "false")
+
+				response := sut.RouteGetReceivers(&rc)
+
+				require.Equal(t, 200, response.Status())
+				require.Equal(t, expectedRedactedResponse, string(response.Body())) // TODO: Should this endpoint ever return settings?
+			})
+			t.Run("decrypt false with only list permissions, does not have settings", func(t *testing.T) {
+				env := createTestEnv(t, testContactPointConfig)
+				env.ac = &recordingAccessControlFake{
+					Callback: func(user *user.SignedInUser, evaluator accesscontrol.Evaluator) (bool, error) {
+						if strings.Contains(evaluator.String(), accesscontrol.ActionAlertingReceiversList) {
+							return true, nil
+						}
+						return false, nil
+					},
+				}
+				sut := createNotificationSrvSutFromEnv(t, &env)
+				rc := createTestRequestCtx()
+
+				rc.Context.Req.Header.Add("Accept", "application/json")
+				rc.Context.Req.Form.Set("decrypt", "false")
+
+				response := sut.RouteGetReceivers(&rc)
+
+				require.Equal(t, 200, response.Status())
+				require.Equal(t, expectedListResponse, string(response.Body()))
+			})
+			t.Run("decrypt true with all permissions, contains decrypted settings", func(t *testing.T) {
+				env := createTestEnv(t, testContactPointConfig)
+				env.ac = &recordingAccessControlFake{
+					Callback: func(user *user.SignedInUser, evaluator accesscontrol.Evaluator) (bool, error) {
+						return true, nil
+					},
+				}
+				sut := createNotificationSrvSutFromEnv(t, &env)
+				rc := createTestRequestCtx()
+
+				rc.Context.Req.Header.Add("Accept", "application/json")
+				rc.Context.Req.Form.Set("decrypt", "true")
+
+				response := sut.RouteGetReceivers(&rc)
+
+				require.Equal(t, 200, response.Status())
+				require.Equal(t, expectedDecryptedResponse, string(response.Body())) // TODO: Should this endpoint ever return settings?
+			})
+		})
+	})
+
+	t.Run("get receiver", func(t *testing.T) {
+		t.Run("GET returns 200", func(t *testing.T) {
+			env := createTestEnv(t, testConfig)
+			sut := createNotificationSrvSutFromEnv(t, &env)
+			rc := createTestRequestCtx()
+
+			response := sut.RouteGetReceiver(&rc, "grafana-default-email")
+
+			require.Equal(t, 200, response.Status())
+		})
+
+		t.Run("decrypt true without secrets:read permissions returns 403", func(t *testing.T) {
+			recPermCheck := false
+			env := createTestEnv(t, testConfig)
+			env.ac = &recordingAccessControlFake{
+				Callback: func(user *user.SignedInUser, evaluator accesscontrol.Evaluator) (bool, error) {
+					if strings.Contains(evaluator.String(), accesscontrol.ActionAlertingReceiversReadSecrets) {
+						recPermCheck = true
+					}
+					return false, nil
+				},
+			}
+
+			sut := createNotificationSrvSutFromEnv(t, &env)
+			rc := createTestRequestCtx()
+
+			rc.Context.Req.Form.Set("decrypt", "true")
+
+			response := sut.RouteGetReceiver(&rc, "grafana-default-email")
+
+			require.True(t, recPermCheck)
+			require.Equal(t, 403, response.Status())
+		})
+
+		t.Run("json body content is as expected", func(t *testing.T) {
+			expectedRedactedResponse := `{"name":"multiple integrations","grafana_managed_receiver_configs":[{"uid":"c2090fda-f824-4add-b545-5a4d5c2ef082","name":"multiple integrations","type":"prometheus-alertmanager","disableResolveMessage":true,"settings":{"basicAuthPassword":"[REDACTED]","basicAuthUser":"test","url":"http://localhost:9093"},"secureFields":{"basicAuthPassword":true}},{"uid":"c84539ec-f87e-4fc5-9a91-7a687d34bbd1","name":"multiple integrations","type":"discord","disableResolveMessage":false,"settings":{"avatar_url":"some avatar","url":"some url","use_discord_username":true},"secureFields":{}}]}`
+			expectedDecryptedResponse := `{"name":"multiple integrations","grafana_managed_receiver_configs":[{"uid":"c2090fda-f824-4add-b545-5a4d5c2ef082","name":"multiple integrations","type":"prometheus-alertmanager","disableResolveMessage":true,"settings":{"basicAuthPassword":"testpass","basicAuthUser":"test","url":"http://localhost:9093"},"secureFields":{"basicAuthPassword":true}},{"uid":"c84539ec-f87e-4fc5-9a91-7a687d34bbd1","name":"multiple integrations","type":"discord","disableResolveMessage":false,"settings":{"avatar_url":"some avatar","url":"some url","use_discord_username":true},"secureFields":{}}]}`
+			t.Run("decrypt false", func(t *testing.T) {
+				env := createTestEnv(t, testContactPointConfig)
+				sut := createNotificationSrvSutFromEnv(t, &env)
+				rc := createTestRequestCtx()
+
+				rc.Context.Req.Header.Add("Accept", "application/json")
+				rc.Context.Req.Form.Set("decrypt", "false")
+
+				response := sut.RouteGetReceiver(&rc, "multiple integrations")
+
+				require.Equal(t, 200, response.Status())
+				require.Equal(t, expectedRedactedResponse, string(response.Body()))
+			})
+			t.Run("decrypt true", func(t *testing.T) {
+				env := createTestEnv(t, testContactPointConfig)
+				env.ac = &recordingAccessControlFake{
+					Callback: func(user *user.SignedInUser, evaluator accesscontrol.Evaluator) (bool, error) {
+						return true, nil
+					},
+				}
+				sut := createNotificationSrvSutFromEnv(t, &env)
+				rc := createTestRequestCtx()
+
+				rc.Context.Req.Header.Add("Accept", "application/json")
+				rc.Context.Req.Form.Set("decrypt", "true")
+
+				response := sut.RouteGetReceiver(&rc, "multiple integrations")
+
+				require.Equal(t, 200, response.Status())
+				require.Equal(t, expectedDecryptedResponse, string(response.Body()))
+			})
+		})
+	})
+}
+
+func createNotificationSrvSutFromEnv(t *testing.T, env *testEnvironment) NotificationSrv {
+	t.Helper()
+
+	receiverSvc := notifier.NewReceiverService(
+		env.ac,
+		legacy_storage.NewAlertmanagerConfigStore(env.configs),
+		env.prov,
+		env.secrets,
+		env.xact,
+		env.log,
+	)
+	return NotificationSrv{
+		logger:          env.log,
+		receiverService: receiverSvc,
+	}
+}
+
 func newNotificationSrv(receiverService ReceiverService) *NotificationSrv {
 	return &NotificationSrv{
 		logger:          log.NewNopLogger(),