Datasource: Propagate datasource secret decryption errors to the frontend (#52068) (#52557)

* update decrypt secrets function signature and add secrets error handling

* remove a couple instances of unnecessary logging since errors are properly handled now

* add unit test

* fix linting issues

(cherry picked from commit 9aa6ce2a50)

Co-authored-by: Michael Mandrus <41969079+mmandrus@users.noreply.github.com>

pkg/plugins/adapters/adapters.go

@@ -3,22 +3,27 @@ package adapters
 
 import (
 	"encoding/json"
+	"fmt"
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 	"github.com/grafana/grafana/pkg/models"
 )
 
-// ModelToInstanceSettings converts a models.DataSource to a backend.DataSourceInstanceSettings.
-func ModelToInstanceSettings(ds *models.DataSource, decryptFn func(ds *models.DataSource) map[string]string,
+// ModelToInstanceSettings converts a datasources.DataSource to a backend.DataSourceInstanceSettings.
+func ModelToInstanceSettings(ds *models.DataSource, decryptFn func(ds *models.DataSource) (map[string]string, error),
 ) (*backend.DataSourceInstanceSettings, error) {
 	var jsonDataBytes json.RawMessage
 	if ds.JsonData != nil {
 		var err error
 		jsonDataBytes, err = ds.JsonData.MarshalJSON()
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to convert data source to instance settings: %w", err)
 		}
 	}
+	decrypted, err := decryptFn(ds)
+	if err != nil {
+		return nil, err
+	}
 
 	return &backend.DataSourceInstanceSettings{
 		ID:                      ds.Id,
@@ -30,9 +35,9 @@ func ModelToInstanceSettings(ds *models.DataSource, decryptFn func(ds *models.Da
 		BasicAuthEnabled:        ds.BasicAuth,
 		BasicAuthUser:           ds.BasicAuthUser,
 		JSONData:                jsonDataBytes,
-		DecryptedSecureJSONData: decryptFn(ds),
+		DecryptedSecureJSONData: decrypted,
 		Updated:                 ds.Updated,
-	}, nil
+	}, err
 }
 
 // BackendUserFromSignedInUser converts Grafana's SignedInUser model

pkg/plugins/plugincontext/plugincontext.go

@@ -127,12 +127,8 @@ func (p *Provider) getCachedPluginSettings(ctx context.Context, pluginID string,
 	return ps, nil
 }
 
-func (p *Provider) decryptSecureJsonDataFn(ctx context.Context) func(ds *models.DataSource) map[string]string {
-	return func(ds *models.DataSource) map[string]string {
-		decryptedJsonData, err := p.dataSourceService.DecryptedValues(ctx, ds)
-		if err != nil {
-			p.logger.Error("Failed to decrypt secure json data", "error", err)
-		}
-		return decryptedJsonData
+func (p *Provider) decryptSecureJsonDataFn(ctx context.Context) func(ds *models.DataSource) (map[string]string, error) {
+	return func(ds *models.DataSource) (map[string]string, error) {
+		return p.dataSourceService.DecryptedValues(ctx, ds)
 	}
 }