Encryption: Add support for data keys re-encryption (#43548) (#44814)

* Encryption: Add support for data keys re-encryption

* Add tests for data keys re-encryption

* Update code after refactorings

Co-authored-by: Leonard Gram <leo@xlson.com>
(cherry picked from commit b2655750e8)

Co-authored-by: Joan López de la Franca Beltran <5459617+joanlopez@users.noreply.github.com>

pkg/services/secrets/manager/manager.go

@@ -353,6 +353,17 @@ func (s *SecretsService) GetProviders() map[secrets.ProviderID]secrets.Provider
 	return s.providers
 }
 
+func (s *SecretsService) ReEncryptDataKeys(ctx context.Context) error {
+	err := s.store.ReEncryptDataKeys(ctx, s.providers, s.currentProviderID)
+	if err != nil {
+		return nil
+	}
+
+	// Invalidate cache
+	s.dataKeyCache = make(map[string]dataKeyCacheItem)
+	return err
+}
+
 // These variables are used to test the code
 // responsible for periodically cleaning up
 // data encryption keys cache.

pkg/services/secrets/manager/manager_test.go

@@ -319,3 +319,42 @@ func TestSecretsService_Run(t *testing.T) {
 		assert.True(t, svc.dataKeyCache[dataKeyID].expiry.After(time.Now().Add(dekTTL)))
 	})
 }
+
+func TestSecretsService_ReEncryptDataKeys(t *testing.T) {
+	ctx := context.Background()
+	sql := sqlstore.InitTestDB(t)
+	store := database.ProvideSecretsStore(sql)
+	svc := SetupTestService(t, store)
+
+	// Encrypt to generate data encryption key
+	withoutScope := secrets.WithoutScope()
+	ciphertext, err := svc.Encrypt(ctx, []byte("grafana"), withoutScope)
+	require.NoError(t, err)
+
+	t.Run("existing key should be re-encrypted", func(t *testing.T) {
+		prevDataKeys, err := store.GetAllDataKeys(ctx)
+		require.NoError(t, err)
+		require.Len(t, prevDataKeys, 1)
+
+		err = svc.ReEncryptDataKeys(ctx)
+		require.NoError(t, err)
+
+		reEncryptedDataKeys, err := store.GetAllDataKeys(ctx)
+		require.NoError(t, err)
+		require.Len(t, reEncryptedDataKeys, 1)
+
+		assert.NotEqual(t, prevDataKeys[0].EncryptedData, reEncryptedDataKeys[0].EncryptedData)
+	})
+
+	t.Run("data keys cache should be invalidated", func(t *testing.T) {
+		// Decrypt to ensure data key is cached
+		_, err := svc.Decrypt(ctx, ciphertext)
+		require.NoError(t, err)
+		require.NotEmpty(t, svc.dataKeyCache)
+
+		err = svc.ReEncryptDataKeys(ctx)
+		require.NoError(t, err)
+
+		assert.Empty(t, svc.dataKeyCache)
+	})
+}