Encryption: Add support for multiple data keys per day (#47765)

* Add database migrations

* Use short uids as data key ids

* Add support for manual data key rotation

* Fix duplicated mutex unlocks

* Fix migration

* Manage current data keys per name

* Adjust key re-encryption and test

* Modify rename column migration for MySQL compatibility

* Refactor secrets manager and data keys cache

* Multiple o11y adjustments

* Fix stats query

* Apply suggestions from code review

Co-authored-by: Tania <yalyna.ts@gmail.com>

* Fix linter

* Docs: Rotate data encryption keys API endpoint

Co-authored-by: Tania <yalyna.ts@gmail.com>

pkg/services/secrets/fakes/fake_service.go

@@ -40,6 +40,10 @@ func (f FakeSecretsService) GetDecryptedValue(_ context.Context, sjd map[string]
 	return fallback
 }
 
+func (f FakeSecretsService) RotateDataKeys(_ context.Context) error {
+	return nil
+}
+
 func (f FakeSecretsService) ReEncryptDataKeys(_ context.Context) error {
 	return nil
 }

pkg/services/secrets/fakes/fake_store.go

@@ -15,14 +15,25 @@ func NewFakeSecretsStore() FakeSecretsStore {
 	return FakeSecretsStore{store: make(map[string]*secrets.DataKey)}
 }
 
-func (f FakeSecretsStore) GetDataKey(_ context.Context, name string) (*secrets.DataKey, error) {
-	key, ok := f.store[name]
+func (f FakeSecretsStore) GetDataKey(_ context.Context, id string) (*secrets.DataKey, error) {
+	key, ok := f.store[id]
 	if !ok {
 		return nil, secrets.ErrDataKeyNotFound
 	}
+
 	return key, nil
 }
 
+func (f FakeSecretsStore) GetCurrentDataKey(_ context.Context, name string) (*secrets.DataKey, error) {
+	for _, key := range f.store {
+		if key.Name == name && key.Active {
+			return key, nil
+		}
+	}
+
+	return nil, secrets.ErrDataKeyNotFound
+}
+
 func (f FakeSecretsStore) GetAllDataKeys(_ context.Context) ([]*secrets.DataKey, error) {
 	result := make([]*secrets.DataKey, 0)
 	for _, key := range f.store {
@@ -31,18 +42,25 @@ func (f FakeSecretsStore) GetAllDataKeys(_ context.Context) ([]*secrets.DataKey,
 	return result, nil
 }
 
-func (f FakeSecretsStore) CreateDataKey(_ context.Context, dataKey secrets.DataKey) error {
-	f.store[dataKey.Name] = &dataKey
+func (f FakeSecretsStore) CreateDataKey(_ context.Context, dataKey *secrets.DataKey) error {
+	f.store[dataKey.Id] = dataKey
 	return nil
 }
 
-func (f FakeSecretsStore) CreateDataKeyWithDBSession(_ context.Context, dataKey secrets.DataKey, _ *xorm.Session) error {
-	f.store[dataKey.Name] = &dataKey
+func (f FakeSecretsStore) CreateDataKeyWithDBSession(_ context.Context, dataKey *secrets.DataKey, _ *xorm.Session) error {
+	f.store[dataKey.Id] = dataKey
 	return nil
 }
 
-func (f FakeSecretsStore) DeleteDataKey(_ context.Context, name string) error {
-	delete(f.store, name)
+func (f FakeSecretsStore) DisableDataKeys(_ context.Context) error {
+	for id := range f.store {
+		f.store[id].Active = false
+	}
+	return nil
+}
+
+func (f FakeSecretsStore) DeleteDataKey(_ context.Context, id string) error {
+	delete(f.store, id)
 	return nil
 }