From a58c2f5a5b503633acfeae2eb9c692493b967000 Mon Sep 17 00:00:00 2001
From: Ashley Harrison <ashley.harrison@grafana.com>
Date: Wed, 1 Mar 2023 11:17:17 +0000
Subject: [PATCH] expose and retrieve intercom secret from config

---
 conf/defaults.ini                                          | 3 +++
 conf/sample.ini                                            | 3 +++
 packages/grafana-data/src/types/config.ts                  | 2 +-
 pkg/api/dtos/models.go                                     | 4 ++--
 pkg/api/index.go                                           | 4 ++--
 pkg/services/user/model.go                                 | 4 ++--
 pkg/services/user/userimpl/store.go                        | 2 +-
 pkg/services/user/userimpl/user.go                         | 7 +++----
 pkg/setting/setting.go                                     | 2 ++
 .../services/echo/backends/analytics/RudderstackBackend.ts | 6 +++---
 10 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/conf/defaults.ini b/conf/defaults.ini
index 61605321c8e..9892caf0a1a 100644
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -265,6 +265,9 @@ rudderstack_sdk_url =
 # Rudderstack Config url, optional, used by Rudderstack SDK to fetch source config
 rudderstack_config_url =
 
+# Intercom secret, optional, used to hash user_id before passing to Intercom via Rudderstack
+intercom_secret =
+
 # Application Insights connection string. Specify an URL string to enable this feature.
 application_insights_connection_string =
 
diff --git a/conf/sample.ini b/conf/sample.ini
index 55542a10321..9e2a808a041 100644
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -272,6 +272,9 @@
 # Rudderstack Config url, optional, used by Rudderstack SDK to fetch source config
 ;rudderstack_config_url =
 
+# Intercom secret, optional, used to hash user_id before passing to Intercom via Rudderstack
+;intercom_secret =
+
 # Controls if the UI contains any links to user feedback forms
 ;feedback_links_enabled = true
 
diff --git a/packages/grafana-data/src/types/config.ts b/packages/grafana-data/src/types/config.ts
index bb7d85061d7..042c94ce2e3 100644
--- a/packages/grafana-data/src/types/config.ts
+++ b/packages/grafana-data/src/types/config.ts
@@ -98,7 +98,7 @@ export type OAuthSettings = Partial<Record<OAuth, { name: string; icon?: IconNam
 
 export interface AnalyticsSettings {
   identifier: string;
-  hashedIdentifier?: string;
+  intercomIdentifier?: string;
 }
 
 /** Current user info included in bootData
diff --git a/pkg/api/dtos/models.go b/pkg/api/dtos/models.go
index 5c92a25e5e2..8339940ac78 100644
--- a/pkg/api/dtos/models.go
+++ b/pkg/api/dtos/models.go
@@ -52,8 +52,8 @@ type CurrentUser struct {
 }
 
 type AnalyticsSettings struct {
-	Identifier       string `json:"identifier"`
-	HashedIdentifier string `json:"hashedIdentifier,omitempty"`
+	Identifier         string `json:"identifier"`
+	IntercomIdentifier string `json:"intercomIdentifier,omitempty"`
 }
 
 type UserPermissionsMap map[string]bool
diff --git a/pkg/api/index.go b/pkg/api/index.go
index af63660b31d..469655292f4 100644
--- a/pkg/api/index.go
+++ b/pkg/api/index.go
@@ -113,8 +113,8 @@ func (hs *HTTPServer) setIndexViewData(c *contextmodel.ReqContext) (*dtos.IndexV
 			HelpFlags1:                 c.HelpFlags1,
 			HasEditPermissionInFolders: hasEditPerm,
 			Analytics: dtos.AnalyticsSettings{
-				Identifier:       c.SignedInUser.Analytics.Identifier,
-				HashedIdentifier: c.SignedInUser.Analytics.HashedIdentifier,
+				Identifier:         c.SignedInUser.Analytics.Identifier,
+				IntercomIdentifier: c.SignedInUser.Analytics.IntercomIdentifier,
 			},
 		},
 		Settings:                            settings,
diff --git a/pkg/services/user/model.go b/pkg/services/user/model.go
index 502fe5dacfa..989b2ecc7b4 100644
--- a/pkg/services/user/model.go
+++ b/pkg/services/user/model.go
@@ -194,8 +194,8 @@ type GetSignedInUserQuery struct {
 }
 
 type AnalyticsSettings struct {
-	Identifier       string
-	HashedIdentifier string
+	Identifier         string
+	IntercomIdentifier string
 }
 
 type SignedInUser struct {
diff --git a/pkg/services/user/userimpl/store.go b/pkg/services/user/userimpl/store.go
index c3b30286023..f2f9355ddfe 100644
--- a/pkg/services/user/userimpl/store.go
+++ b/pkg/services/user/userimpl/store.go
@@ -433,7 +433,7 @@ func (ss *sqlStore) GetSignedInUser(ctx context.Context, query *user.GetSignedIn
 			signedInUser.ExternalAuthID = ""
 		}
 
-		signedInUser.Analytics = buildUserAnalyticsSettings(signedInUser)
+		signedInUser.Analytics = buildUserAnalyticsSettings(signedInUser, ss.cfg.IntercomSecret)
 		return nil
 	})
 	return &signedInUser, err
diff --git a/pkg/services/user/userimpl/user.go b/pkg/services/user/userimpl/user.go
index 9b810eaa056..90aa50211ce 100644
--- a/pkg/services/user/userimpl/user.go
+++ b/pkg/services/user/userimpl/user.go
@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"os"
 	"strings"
 	"time"
 
@@ -606,7 +605,7 @@ func hashUserIdentifier(identifier string, secret string) string {
 	return hex.EncodeToString(h.Sum(nil))
 }
 
-func buildUserAnalyticsSettings(signedInUser user.SignedInUser) user.AnalyticsSettings {
+func buildUserAnalyticsSettings(signedInUser user.SignedInUser, intercomSecret string) user.AnalyticsSettings {
 	var settings user.AnalyticsSettings
 
 	if signedInUser.ExternalAuthID != "" {
@@ -615,8 +614,8 @@ func buildUserAnalyticsSettings(signedInUser user.SignedInUser) user.AnalyticsSe
 		settings.Identifier = signedInUser.Email
 	}
 
-	if os.Getenv("GF_ANALYTICS_SECRET") != "" {
-		settings.HashedIdentifier = hashUserIdentifier(settings.Identifier, os.Getenv("GF_ANALYTICS_SECRET"))
+	if intercomSecret != "" {
+		settings.IntercomIdentifier = hashUserIdentifier(settings.Identifier, intercomSecret)
 	}
 	return settings
 }
diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go
index e3f95bfbd18..a4aecbe59db 100644
--- a/pkg/setting/setting.go
+++ b/pkg/setting/setting.go
@@ -401,6 +401,7 @@ type Cfg struct {
 	RudderstackWriteKey                 string
 	RudderstackSDKURL                   string
 	RudderstackConfigURL                string
+	IntercomSecret                      string
 
 	// AzureAD
 	AzureADSkipOrgRoleSync bool
@@ -1034,6 +1035,7 @@ func (cfg *Cfg) Load(args CommandLineArgs) error {
 	cfg.RudderstackDataPlaneURL = analytics.Key("rudderstack_data_plane_url").String()
 	cfg.RudderstackSDKURL = analytics.Key("rudderstack_sdk_url").String()
 	cfg.RudderstackConfigURL = analytics.Key("rudderstack_config_url").String()
+	cfg.IntercomSecret = analytics.Key("intercom_secret").String()
 
 	cfg.ReportingEnabled = analytics.Key("reporting_enabled").MustBool(true)
 	cfg.ReportingDistributor = analytics.Key("reporting_distributor").MustString("grafana-labs")
diff --git a/public/app/core/services/echo/backends/analytics/RudderstackBackend.ts b/public/app/core/services/echo/backends/analytics/RudderstackBackend.ts
index d8680a83507..dca07de7929 100644
--- a/public/app/core/services/echo/backends/analytics/RudderstackBackend.ts
+++ b/public/app/core/services/echo/backends/analytics/RudderstackBackend.ts
@@ -70,12 +70,12 @@ export class RudderstackBackend implements EchoBackend<PageviewEchoEvent, Rudder
     window.rudderanalytics?.load?.(options.writeKey, options.dataPlaneUrl, { configUrl: options.configUrl });
 
     if (options.user) {
-      const { identifier, hashedIdentifier } = options.user.analytics;
+      const { identifier, intercomIdentifier } = options.user.analytics;
       const apiOptions: apiOptions = {};
 
-      if (hashedIdentifier) {
+      if (intercomIdentifier) {
         apiOptions.Intercom = {
-          user_hash: hashedIdentifier,
+          user_hash: intercomIdentifier,
         };
       }