diff --git a/pkg/registry/apis/secret/contracts/decrypt.go b/pkg/registry/apis/secret/contracts/decrypt.go index bb2ad3cffdc..a90d4047015 100644 --- a/pkg/registry/apis/secret/contracts/decrypt.go +++ b/pkg/registry/apis/secret/contracts/decrypt.go @@ -4,6 +4,8 @@ import ( "context" "errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" "github.com/grafana/grafana/pkg/registry/apis/secret/xkube" ) @@ -24,5 +26,5 @@ type DecryptStorage interface { // DecryptAuthorizer is the interface for authorizing decryption requests. type DecryptAuthorizer interface { - Authorize(ctx context.Context, namespace xkube.Namespace, secureValueName string, secureValueDecrypters []string) (identity string, allowed bool) + Authorize(ctx context.Context, namespace xkube.Namespace, secureValueName string, secureValueDecrypters []string, owner []metav1.OwnerReference) (identity string, allowed bool) } diff --git a/pkg/registry/apis/secret/decrypt/authorizer.go b/pkg/registry/apis/secret/decrypt/authorizer.go index ca112302e63..d307c005af5 100644 --- a/pkg/registry/apis/secret/decrypt/authorizer.go +++ b/pkg/registry/apis/secret/decrypt/authorizer.go @@ -4,11 +4,12 @@ import ( "context" "strings" - "github.com/grafana/authlib/authn" - claims "github.com/grafana/authlib/types" "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/trace" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "github.com/grafana/authlib/authn" + claims "github.com/grafana/authlib/types" secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" "github.com/grafana/grafana/pkg/registry/apis/secret/xkube" @@ -17,16 +18,26 @@ import ( // decryptAuthorizer is the authorizer implementation for decrypt operations. type decryptAuthorizer struct { tracer trace.Tracer + extra []ExtraOwnerDecrypter } -func ProvideDecryptAuthorizer(tracer trace.Tracer) contracts.DecryptAuthorizer { +type ExtraOwnerDecrypter struct { + Identity string + Group string +} + +func ProvideDecryptAuthorizer( + tracer trace.Tracer, + extra []ExtraOwnerDecrypter, +) contracts.DecryptAuthorizer { return &decryptAuthorizer{ tracer: tracer, + extra: extra, } } -// authorize checks whether the auth info token has the right permissions to decrypt the secure value. -func (a *decryptAuthorizer) Authorize(ctx context.Context, ns xkube.Namespace, secureValueName string, secureValueDecrypters []string) (id string, isAllowed bool) { +// Authorize checks whether the auth info token has the right permissions to decrypt the secure value. +func (a *decryptAuthorizer) Authorize(ctx context.Context, ns xkube.Namespace, secureValueName string, secureValueDecrypters []string, owners []metav1.OwnerReference) (id string, isAllowed bool) { ctx, span := a.tracer.Start(ctx, "DecryptAuthorizer.Authorize", trace.WithAttributes( attribute.String("name", secureValueName), attribute.StringSlice("decrypters", secureValueDecrypters), @@ -69,16 +80,27 @@ func (a *decryptAuthorizer) Authorize(ctx context.Context, ns xkube.Namespace, s return serviceIdentity, false } - // Finally check whether the service identity is allowed to decrypt this secure value. - allowed := false + // Check whether the service identity is allowed to decrypt this secure value. for _, decrypter := range secureValueDecrypters { if decrypter == serviceIdentity { - allowed = true - break + return serviceIdentity, true } } - return serviceIdentity, allowed + // finally check if the owner matches any hardcoded service identities + if owners != nil && a.extra != nil { + for _, extra := range a.extra { + if extra.Identity == serviceIdentity { + for _, owner := range owners { + if strings.HasPrefix(owner.APIVersion, extra.Group) { + return serviceIdentity, true + } + } + } + } + } + + return serviceIdentity, false } // Adapted from https://github.com/grafana/authlib/blob/1492b99410603ca15730a1805a9220ce48232bc3/authz/client.go#L138 diff --git a/pkg/registry/apis/secret/decrypt/authorizer_test.go b/pkg/registry/apis/secret/decrypt/authorizer_test.go index 61008b9faf8..fd52958e100 100644 --- a/pkg/registry/apis/secret/decrypt/authorizer_test.go +++ b/pkg/registry/apis/secret/decrypt/authorizer_test.go @@ -4,10 +4,12 @@ import ( "context" "testing" - "github.com/grafana/authlib/authn" - "github.com/grafana/authlib/types" "github.com/stretchr/testify/require" "go.opentelemetry.io/otel/trace/noop" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + "github.com/grafana/authlib/authn" + "github.com/grafana/authlib/types" "github.com/grafana/grafana/pkg/apimachinery/identity" "github.com/grafana/grafana/pkg/registry/apis/secret/xkube" @@ -19,143 +21,143 @@ func TestDecryptAuthorizer(t *testing.T) { t.Run("when no auth info is present, it returns false", func(t *testing.T) { ctx := context.Background() - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.Empty(t, identity) require.False(t, allowed) }) t.Run("when token permissions are empty, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) }) t.Run("when service identity is empty, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "", []string{}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.Empty(t, identity) require.False(t, allowed) }) t.Run("when service identity is empty string, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), " ", []string{}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.Empty(t, identity) require.False(t, allowed) }) t.Run("when permission format is malformed (missing verb), it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) // nameless ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues"}) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) // named ctx = createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues/name"}) - identity, allowed = authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed = authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) }) t.Run("when permission verb is not exactly `decrypt`, it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) // nameless ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues:*"}) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) // named ctx = createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues/name:something"}) - identity, allowed = authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed = authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) }) t.Run("when permission does not have 2 or 3 parts, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) }) t.Run("when permission has group that is not `secret.grafana.app`, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"wrong.group/securevalues/invalid:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) }) t.Run("when permission has resource that is not `securevalues`, it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) // nameless ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/invalid-resource:decrypt"}) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) // named ctx = createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/invalid-resource/name:decrypt"}) - identity, allowed = authorizer.Authorize(ctx, defaultNs, "", nil) + identity, allowed = authorizer.Authorize(ctx, defaultNs, "", nil, nil) require.NotEmpty(t, identity) require.False(t, allowed) }) t.Run("when the allow list is empty, it allows all identities", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}, nil) require.NotEmpty(t, identity) require.True(t, allowed) }) t.Run("when the identity doesn't match any allowed decrypters, it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) // nameless ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"group2"}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"group2"}, nil) require.NotEmpty(t, identity) require.False(t, allowed) // named ctx = createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues/name:decrypt"}) - identity, allowed = authorizer.Authorize(ctx, defaultNs, "", []string{"group2"}) + identity, allowed = authorizer.Authorize(ctx, defaultNs, "", []string{"group2"}, nil) require.NotEmpty(t, identity) require.False(t, allowed) }) t.Run("when the identity matches an allowed decrypter, it returns true", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) // nameless ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}, nil) require.True(t, allowed) require.Equal(t, "identity", identity) // named ctx = createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues/name:decrypt"}) - identity, allowed = authorizer.Authorize(ctx, defaultNs, "name", []string{"identity"}) + identity, allowed = authorizer.Authorize(ctx, defaultNs, "name", []string{"identity"}, nil) require.True(t, allowed) require.Equal(t, "identity", identity) }) @@ -168,77 +170,134 @@ func TestDecryptAuthorizer(t *testing.T) { "wrong.group/securevalues/group2:decrypt", "secret.grafana.app/securevalues/identity:decrypt", // old style of identity+permission }) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "name1", []string{"identity"}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "name1", []string{"identity"}, nil) require.True(t, allowed) require.Equal(t, "identity", identity) - identity, allowed = authorizer.Authorize(ctx, defaultNs, "name2", []string{"identity"}) + identity, allowed = authorizer.Authorize(ctx, defaultNs, "name2", []string{"identity"}, nil) require.True(t, allowed) require.Equal(t, "identity", identity) }) t.Run("when empty secure value name with specific permission, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues/name:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}, nil) require.Equal(t, "identity", identity) require.False(t, allowed) }) t.Run("when permission has an extra / but no name, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues/:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}, nil) require.Equal(t, "identity", identity) require.False(t, allowed) }) t.Run("when the decrypters list is empty, meaning nothing can decrypt the secure value, it returns false", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "name", []string{}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "name", []string{}, nil) require.Equal(t, "identity", identity) require.False(t, allowed) }) t.Run("when one of decrypters matches the identity, it returns true", func(t *testing.T) { ctx := createAuthContext(context.Background(), defaultNs.String(), "identity1", []string{"secret.grafana.app/securevalues:decrypt"}) - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity1", "identity2", "identity3"}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity1", "identity2", "identity3"}, nil) require.Equal(t, "identity1", identity) require.True(t, allowed) }) + t.Run("when one of extra owner decrypters matches the identity, it returns true", func(t *testing.T) { + ctx := createAuthContext(context.Background(), defaultNs.String(), "identity1", []string{"secret.grafana.app/securevalues:decrypt"}) + authorizer := ProvideDecryptAuthorizer(tracer, []ExtraOwnerDecrypter{ + { + Identity: "identity1", + Group: "test.grafana.app", + }, + }) + + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{}, []metav1.OwnerReference{ + { + APIVersion: "test.grafana.app/v1", + Kind: "Test", + Name: "test", + }, + }) + require.Equal(t, "identity1", identity) + require.True(t, allowed) + }) + + t.Run("when there are extra owner decrypters but it does not match the identity, it returns false", func(t *testing.T) { + ctx := createAuthContext(context.Background(), defaultNs.String(), "identity1", []string{"secret.grafana.app/securevalues:decrypt"}) + authorizer := ProvideDecryptAuthorizer(tracer, []ExtraOwnerDecrypter{ + { + Identity: "identity2", + Group: "test.grafana.app", + }, + }) + + _, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{}, []metav1.OwnerReference{ + { + APIVersion: "test.grafana.app/v1", + Kind: "Test", + Name: "test", + }, + }) + require.False(t, allowed) + }) + + t.Run("when one of extra owner decrypters matches the identity but not the group, it returns false", func(t *testing.T) { + ctx := createAuthContext(context.Background(), defaultNs.String(), "identity1", []string{"secret.grafana.app/securevalues:decrypt"}) + authorizer := ProvideDecryptAuthorizer(tracer, []ExtraOwnerDecrypter{ + { + Identity: "identity1", + Group: "wrong.grafana.app", + }, + }) + + _, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{}, []metav1.OwnerReference{ + { + APIVersion: "test.grafana.app/v1", + Kind: "Test", + Name: "test", + }, + }) + require.False(t, allowed) + }) t.Run("permissions must be case-sensitive and return false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) ctx := createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"SECRET.grafana.app/securevalues:decrypt"}) - identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}) + identity, allowed := authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}, nil) require.Equal(t, "identity", identity) require.False(t, allowed) ctx = createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/SECUREVALUES:decrypt"}) - identity, allowed = authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}) + identity, allowed = authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}, nil) require.Equal(t, "identity", identity) require.False(t, allowed) ctx = createAuthContext(context.Background(), defaultNs.String(), "identity", []string{"secret.grafana.app/securevalues:DECRYPT"}) - identity, allowed = authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}) + identity, allowed = authorizer.Authorize(ctx, defaultNs, "", []string{"identity"}, nil) require.Equal(t, "identity", identity) require.False(t, allowed) }) t.Run("when namespace doesn't match the token's, it returns false", func(t *testing.T) { - authorizer := ProvideDecryptAuthorizer(tracer) + authorizer := ProvideDecryptAuthorizer(tracer, nil) ctx := createAuthContext(context.Background(), "namespace1", "identity", []string{"secret.grafana.app/securevalues:decrypt"}) - identity, allowed := authorizer.Authorize(ctx, "namespace2", "", []string{"identity"}) + identity, allowed := authorizer.Authorize(ctx, "namespace2", "", []string{"identity"}, nil) require.Empty(t, identity) require.False(t, allowed) }) diff --git a/pkg/registry/apis/secret/decrypt/noop_authorizer.go b/pkg/registry/apis/secret/decrypt/noop_authorizer.go index f2fe29cbc48..2ab299e32c6 100644 --- a/pkg/registry/apis/secret/decrypt/noop_authorizer.go +++ b/pkg/registry/apis/secret/decrypt/noop_authorizer.go @@ -3,6 +3,8 @@ package decrypt import ( "context" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" "github.com/grafana/grafana/pkg/registry/apis/secret/xkube" ) @@ -12,6 +14,6 @@ type NoopAlwaysAllowedAuthorizer struct{} var _ contracts.DecryptAuthorizer = &NoopAlwaysAllowedAuthorizer{} -func (a *NoopAlwaysAllowedAuthorizer) Authorize(context.Context, xkube.Namespace, string, []string) (string, bool) { +func (a *NoopAlwaysAllowedAuthorizer) Authorize(context.Context, xkube.Namespace, string, []string, []metav1.OwnerReference) (string, bool) { return "", true } diff --git a/pkg/registry/apis/secret/testutils/testutils.go b/pkg/registry/apis/secret/testutils/testutils.go index 2da6a5311ae..50190dbb3ff 100644 --- a/pkg/registry/apis/secret/testutils/testutils.go +++ b/pkg/registry/apis/secret/testutils/testutils.go @@ -139,7 +139,7 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut { secureValueService := service.ProvideSecureValueService(tracer, accessClient, database, secureValueMetadataStorage, secureValueValidator, secureValueMutator, keeperMetadataStorage, keeperService, nil) - decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) + decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer, nil) decryptStorage, err := metadata.ProvideDecryptStorage(tracer, keeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, nil) require.NoError(t, err) diff --git a/pkg/server/wire.go b/pkg/server/wire.go index 32bed9be52f..9ee5cfeaf68 100644 --- a/pkg/server/wire.go +++ b/pkg/server/wire.go @@ -437,6 +437,7 @@ var wireBasicSet = wire.NewSet( secretmetadata.ProvideKeeperMetadataStorage, secretmetadata.ProvideDecryptStorage, secretdecrypt.ProvideDecryptAuthorizer, + wire.Value([]secretdecrypt.ExtraOwnerDecrypter(nil)), secretdecrypt.ProvideDecryptService, secretinline.ProvideInlineSecureValueService, secretencryption.ProvideDataKeyStorage, diff --git a/pkg/server/wire_gen.go b/pkg/server/wire_gen.go index 7db54131e6d..f0f9de53f93 100644 --- a/pkg/server/wire_gen.go +++ b/pkg/server/wire_gen.go @@ -831,7 +831,8 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api v3 := extras.ProvideProvisioningExtraAPIs(webhookExtraBuilder) pullRequestWorker := pullrequest.ProvidePullRequestWorker(cfg, renderingService, resourceClient, eventualRestConfigProvider) v4 := extras.ProvideExtraWorkers(pullRequestWorker) - decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) + v5 := _wireValue + decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer, v5) decryptStorage, err := metadata.ProvideDecryptStorage(tracer, ossKeeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, registerer) if err != nil { return nil, err @@ -841,8 +842,8 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api return nil, err } factory := github.ProvideFactory() - v5 := extras.ProvideProvisioningOSSRepositoryExtras(cfg, decryptService, factory, webhookExtraBuilder) - repositoryFactory, err := extras.ProvideFactoryFromConfig(cfg, v5) + v6 := extras.ProvideProvisioningOSSRepositoryExtras(cfg, decryptService, factory, webhookExtraBuilder) + repositoryFactory, err := extras.ProvideFactoryFromConfig(cfg, v6) if err != nil { return nil, err } @@ -884,6 +885,10 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api return server, nil } +var ( + _wireValue = []decrypt.ExtraOwnerDecrypter(nil) +) + func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interface { Cleanup(func()) mock.TestingT @@ -1431,7 +1436,8 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac v3 := extras.ProvideProvisioningExtraAPIs(webhookExtraBuilder) pullRequestWorker := pullrequest.ProvidePullRequestWorker(cfg, renderingService, resourceClient, eventualRestConfigProvider) v4 := extras.ProvideExtraWorkers(pullRequestWorker) - decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer) + v5 := _wireValue + decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer, v5) decryptStorage, err := metadata.ProvideDecryptStorage(tracer, ossKeeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, registerer) if err != nil { return nil, err @@ -1441,8 +1447,8 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac return nil, err } factory := github.ProvideFactory() - v5 := extras.ProvideProvisioningOSSRepositoryExtras(cfg, decryptService, factory, webhookExtraBuilder) - repositoryFactory, err := extras.ProvideFactoryFromConfig(cfg, v5) + v6 := extras.ProvideProvisioningOSSRepositoryExtras(cfg, decryptService, factory, webhookExtraBuilder) + repositoryFactory, err := extras.ProvideFactoryFromConfig(cfg, v6) if err != nil { return nil, err } @@ -1666,7 +1672,7 @@ var withOTelSet = wire.NewSet( otelTracer, grpcserver.ProvideService, interceptors.ProvideAuthenticator, ) -var wireBasicSet = wire.NewSet(annotationsimpl.ProvideService, wire.Bind(new(annotations.Repository), new(*annotationsimpl.RepositoryImpl)), New, api.ProvideHTTPServer, query.ProvideService, wire.Bind(new(query.Service), new(*query.ServiceImpl)), bus.ProvideBus, wire.Bind(new(bus.Bus), new(*bus.InProcBus)), rendering.ProvideService, wire.Bind(new(rendering.Service), new(*rendering.RenderingService)), routing.ProvideRegister, wire.Bind(new(routing.RouteRegister), new(*routing.RouteRegisterImpl)), hooks.ProvideService, kvstore.ProvideService, localcache.ProvideService, bundleregistry.ProvideService, wire.Bind(new(supportbundles.Service), new(*bundleregistry.Service)), updatemanager.ProvideGrafanaService, updatemanager.ProvidePluginsService, service.ProvideService, wire.Bind(new(usagestats.Service), new(*service.UsageStats)), validator3.ProvideService, legacy.ProvideLegacyMigrator, pluginsintegration.WireSet, dashboards.ProvideFileStoreManager, wire.Bind(new(dashboards.FileStore), new(*dashboards.FileStoreManager)), cloudwatch.ProvideService, cloudmonitoring.ProvideService, azuremonitor.ProvideService, postgres.ProvideService, mysql.ProvideService, mssql.ProvideService, store.ProvideEntityEventsService, dualwrite.ProvideService, httpclientprovider.New, wire.Bind(new(httpclient.Provider), new(*httpclient2.Provider)), serverlock.ProvideService, annotationsimpl.ProvideCleanupService, wire.Bind(new(annotations.Cleaner), new(*annotationsimpl.CleanupServiceImpl)), cleanup.ProvideService, shorturlimpl.ProvideService, wire.Bind(new(shorturls.Service), new(*shorturlimpl.ShortURLService)), queryhistory.ProvideService, wire.Bind(new(queryhistory.Service), new(*queryhistory.QueryHistoryService)), correlations.ProvideService, wire.Bind(new(correlations.Service), new(*correlations.CorrelationsService)), quotaimpl.ProvideService, remotecache.ProvideService, wire.Bind(new(remotecache.CacheStorage), new(*remotecache.RemoteCache)), authinfoimpl.ProvideService, wire.Bind(new(login.AuthInfoService), new(*authinfoimpl.Service)), authinfoimpl.ProvideStore, datasourceproxy.ProvideService, sort.ProvideService, search2.ProvideService, searchV2.ProvideService, searchV2.ProvideSearchHTTPService, store.ProvideService, store.ProvideSystemUsersService, live.ProvideService, pushhttp.ProvideService, contexthandler.ProvideService, service12.ProvideService, wire.Bind(new(service12.LDAP), new(*service12.LDAPImpl)), jwt.ProvideService, wire.Bind(new(jwt.JWTService), new(*jwt.AuthService)), store2.ProvideDBStore, image.ProvideDeleteExpiredService, ngalert.ProvideService, librarypanels.ProvideService, wire.Bind(new(librarypanels.Service), new(*librarypanels.LibraryPanelService)), libraryelements.ProvideService, wire.Bind(new(libraryelements.Service), new(*libraryelements.LibraryElementService)), notifications.ProvideService, notifications.ProvideSmtpService, github.ProvideFactory, tracing.ProvideService, tracing.ProvideTracingConfig, wire.Bind(new(tracing.Tracer), new(*tracing.TracingService)), withOTelSet, testdatasource.ProvideService, api4.ProvideService, opentsdb.ProvideService, socialimpl.ProvideService, influxdb.ProvideService, wire.Bind(new(social.Service), new(*socialimpl.SocialService)), tempo.ProvideService, loki.ProvideService, graphite.ProvideService, prometheus.ProvideService, elasticsearch.ProvideService, pyroscope.ProvideService, parca.ProvideService, zipkin.ProvideService, jaeger.ProvideService, service9.ProvideCacheService, wire.Bind(new(datasources.CacheService), new(*service9.CacheServiceImpl)), service2.ProvideEncryptionService, wire.Bind(new(encryption2.Internal), new(*service2.Service)), manager.ProvideSecretsService, wire.Bind(new(secrets.Service), new(*manager.SecretsService)), database.ProvideSecretsStore, wire.Bind(new(secrets.Store), new(*database.SecretsStoreImpl)), garbagecollectionworker.ProvideWorker, grafanads.ProvideService, wire.Bind(new(dashboardsnapshots.Store), new(*database5.DashboardSnapshotStore)), database5.ProvideStore, wire.Bind(new(dashboardsnapshots.Service), new(*service10.ServiceImpl)), service10.ProvideService, service9.ProvideService, wire.Bind(new(datasources.DataSourceService), new(*service9.Service)), service9.ProvideLegacyDataSourceLookup, retriever.ProvideService, wire.Bind(new(serviceaccounts.ServiceAccountRetriever), new(*retriever.Service)), ossaccesscontrol.ProvideServiceAccountPermissions, wire.Bind(new(accesscontrol.ServiceAccountPermissionsService), new(*ossaccesscontrol.ServiceAccountPermissionsService)), manager3.ProvideServiceAccountsService, proxy.ProvideServiceAccountsProxy, wire.Bind(new(serviceaccounts.Service), new(*proxy.ServiceAccountsProxy)), dsquerierclient.NewNullQSDatasourceClientBuilder, expr.ProvideService, featuremgmt.ProvideManagerService, featuremgmt.ProvideToggles, service7.ProvideDashboardServiceImpl, wire.Bind(new(dashboards2.PermissionsRegistrationService), new(*service7.DashboardServiceImpl)), service7.ProvideDashboardService, service7.ProvideDashboardProvisioningService, service7.ProvideDashboardPluginService, database2.ProvideDashboardStore, folderimpl.ProvideService, wire.Bind(new(folder.Service), new(*folderimpl.Service)), wire.Bind(new(folder.LegacyService), new(*folderimpl.Service)), folderimpl.ProvideStore, wire.Bind(new(folder.Store), new(*folderimpl.FolderStoreImpl)), service11.ProvideService, wire.Bind(new(dashboardimport.Service), new(*service11.ImportDashboardService)), service8.ProvideService, wire.Bind(new(plugindashboards.Service), new(*service8.Service)), service8.ProvideDashboardUpdater, kvstore2.ProvideService, avatar.ProvideAvatarCacheServer, statscollector.ProvideService, csrf.ProvideCSRFFilter, wire.Bind(new(csrf.Service), new(*csrf.CSRF)), ossaccesscontrol.ProvideTeamPermissions, wire.Bind(new(accesscontrol.TeamPermissionsService), new(*ossaccesscontrol.TeamPermissionsService)), ossaccesscontrol.ProvideFolderPermissions, wire.Bind(new(accesscontrol.FolderPermissionsService), new(*ossaccesscontrol.FolderPermissionsService)), ossaccesscontrol.ProvideDashboardPermissions, wire.Bind(new(accesscontrol.DashboardPermissionsService), new(*ossaccesscontrol.DashboardPermissionsService)), ossaccesscontrol.ProvideReceiverPermissionsService, wire.Bind(new(accesscontrol.ReceiverPermissionsService), new(*ossaccesscontrol.ReceiverPermissionsService)), starimpl.ProvideService, playlistimpl.ProvideService, apikeyimpl.ProvideService, dashverimpl.ProvideService, service3.ProvideService, wire.Bind(new(publicdashboards.Service), new(*service3.PublicDashboardServiceImpl)), database3.ProvideStore, wire.Bind(new(publicdashboards.Store), new(*database3.PublicDashboardStoreImpl)), metric.ProvideService, api2.ProvideApi, api3.ProvideApi, userimpl.ProvideService, orgimpl.ProvideService, orgimpl.ProvideDeletionService, statsimpl.ProvideService, grpccontext.ProvideContextHandler, grpcserver.ProvideHealthService, grpcserver.ProvideReflectionService, resolver.ProvideEntityReferenceResolver, teamimpl.ProvideService, teamapi.ProvideTeamAPI, tempuserimpl.ProvideService, loginattemptimpl.ProvideService, wire.Bind(new(loginattempt.Service), new(*loginattemptimpl.Service)), migrations2.ProvideDataSourceMigrationService, migrations2.ProvideSecretMigrationProvider, wire.Bind(new(migrations2.SecretMigrationProvider), new(*migrations2.SecretMigrationProviderImpl)), promtypemigration.ProvideAzurePromMigrationService, promtypemigration.ProvideAmazonPromMigrationService, promtypemigration.ProvidePromTypeMigrationProvider, wire.Bind(new(promtypemigration.PromTypeMigrationProvider), new(*promtypemigration.PromTypeMigrationProviderImpl)), resourcepermissions.NewActionSetService, wire.Bind(new(accesscontrol.ActionResolver), new(resourcepermissions.ActionSetService)), wire.Bind(new(pluginaccesscontrol.ActionSetRegistry), new(resourcepermissions.ActionSetService)), permreg.ProvidePermissionRegistry, acimpl.ProvideAccessControl, dualwrite2.ProvideZanzanaReconciler, navtreeimpl.ProvideService, wire.Bind(new(accesscontrol.AccessControl), new(*acimpl.AccessControl)), wire.Bind(new(notifications.TempUserStore), new(tempuser.Service)), tagimpl.ProvideService, wire.Bind(new(tag.Service), new(*tagimpl.Service)), authnimpl.ProvideService, authnimpl.ProvideIdentitySynchronizer, authnimpl.ProvideAuthnService, authnimpl.ProvideAuthnServiceAuthenticateOnly, authnimpl.ProvideRegistration, supportbundlesimpl.ProvideService, extsvcaccounts.ProvideExtSvcAccountsService, wire.Bind(new(serviceaccounts.ExtSvcAccountsService), new(*extsvcaccounts.ExtSvcAccountsService)), registry2.ProvideExtSvcRegistry, wire.Bind(new(extsvcauth.ExternalServiceRegistry), new(*registry2.Registry)), anonstore.ProvideAnonDBStore, wire.Bind(new(anonstore.AnonStore), new(*anonstore.AnonDBStore)), loggermw.Provide, slogadapter.Provide, signingkeysimpl.ProvideEmbeddedSigningKeysService, wire.Bind(new(signingkeys.Service), new(*signingkeysimpl.Service)), ssosettingsimpl.ProvideService, wire.Bind(new(ssosettings.Service), new(*ssosettingsimpl.Service)), idimpl.ProvideService, wire.Bind(new(auth.IDService), new(*idimpl.Service)), cloudmigrationimpl.ProvideService, userimpl.ProvideVerifier, connectors.ProvideOrgRoleMapper, wire.Bind(new(user.Verifier), new(*userimpl.Verifier)), authz.WireSet, metadata.ProvideSecureValueMetadataStorage, metadata.ProvideKeeperMetadataStorage, metadata.ProvideDecryptStorage, decrypt.ProvideDecryptAuthorizer, decrypt.ProvideDecryptService, inline.ProvideInlineSecureValueService, encryption.ProvideDataKeyStorage, encryption.ProvideGlobalDataKeyStorage, encryption.ProvideEncryptedValueStorage, encryption.ProvideGlobalEncryptedValueStorage, service5.ProvideSecureValueService, validator.ProvideKeeperValidator, validator.ProvideSecureValueValidator, mutator.ProvideKeeperMutator, mutator.ProvideSecureValueMutator, migrator2.NewWithEngine, database4.ProvideDatabase, clock.ProvideClock, wire.Bind(new(contracts.Database), new(*database4.Database)), wire.Bind(new(contracts.Clock), new(*clock.Clock)), manager2.ProvideEncryptionManager, service4.ProvideAESGCMCipherService, resource.ProvideStorageMetrics, resource.ProvideIndexMetrics, apiserver.WireSet, apiregistry.WireSet, appregistry.WireSet, client.ProvideK8sClientWithFallback) +var wireBasicSet = wire.NewSet(annotationsimpl.ProvideService, wire.Bind(new(annotations.Repository), new(*annotationsimpl.RepositoryImpl)), New, api.ProvideHTTPServer, query.ProvideService, wire.Bind(new(query.Service), new(*query.ServiceImpl)), bus.ProvideBus, wire.Bind(new(bus.Bus), new(*bus.InProcBus)), rendering.ProvideService, wire.Bind(new(rendering.Service), new(*rendering.RenderingService)), routing.ProvideRegister, wire.Bind(new(routing.RouteRegister), new(*routing.RouteRegisterImpl)), hooks.ProvideService, kvstore.ProvideService, localcache.ProvideService, bundleregistry.ProvideService, wire.Bind(new(supportbundles.Service), new(*bundleregistry.Service)), updatemanager.ProvideGrafanaService, updatemanager.ProvidePluginsService, service.ProvideService, wire.Bind(new(usagestats.Service), new(*service.UsageStats)), validator3.ProvideService, legacy.ProvideLegacyMigrator, pluginsintegration.WireSet, dashboards.ProvideFileStoreManager, wire.Bind(new(dashboards.FileStore), new(*dashboards.FileStoreManager)), cloudwatch.ProvideService, cloudmonitoring.ProvideService, azuremonitor.ProvideService, postgres.ProvideService, mysql.ProvideService, mssql.ProvideService, store.ProvideEntityEventsService, dualwrite.ProvideService, httpclientprovider.New, wire.Bind(new(httpclient.Provider), new(*httpclient2.Provider)), serverlock.ProvideService, annotationsimpl.ProvideCleanupService, wire.Bind(new(annotations.Cleaner), new(*annotationsimpl.CleanupServiceImpl)), cleanup.ProvideService, shorturlimpl.ProvideService, wire.Bind(new(shorturls.Service), new(*shorturlimpl.ShortURLService)), queryhistory.ProvideService, wire.Bind(new(queryhistory.Service), new(*queryhistory.QueryHistoryService)), correlations.ProvideService, wire.Bind(new(correlations.Service), new(*correlations.CorrelationsService)), quotaimpl.ProvideService, remotecache.ProvideService, wire.Bind(new(remotecache.CacheStorage), new(*remotecache.RemoteCache)), authinfoimpl.ProvideService, wire.Bind(new(login.AuthInfoService), new(*authinfoimpl.Service)), authinfoimpl.ProvideStore, datasourceproxy.ProvideService, sort.ProvideService, search2.ProvideService, searchV2.ProvideService, searchV2.ProvideSearchHTTPService, store.ProvideService, store.ProvideSystemUsersService, live.ProvideService, pushhttp.ProvideService, contexthandler.ProvideService, service12.ProvideService, wire.Bind(new(service12.LDAP), new(*service12.LDAPImpl)), jwt.ProvideService, wire.Bind(new(jwt.JWTService), new(*jwt.AuthService)), store2.ProvideDBStore, image.ProvideDeleteExpiredService, ngalert.ProvideService, librarypanels.ProvideService, wire.Bind(new(librarypanels.Service), new(*librarypanels.LibraryPanelService)), libraryelements.ProvideService, wire.Bind(new(libraryelements.Service), new(*libraryelements.LibraryElementService)), notifications.ProvideService, notifications.ProvideSmtpService, github.ProvideFactory, tracing.ProvideService, tracing.ProvideTracingConfig, wire.Bind(new(tracing.Tracer), new(*tracing.TracingService)), withOTelSet, testdatasource.ProvideService, api4.ProvideService, opentsdb.ProvideService, socialimpl.ProvideService, influxdb.ProvideService, wire.Bind(new(social.Service), new(*socialimpl.SocialService)), tempo.ProvideService, loki.ProvideService, graphite.ProvideService, prometheus.ProvideService, elasticsearch.ProvideService, pyroscope.ProvideService, parca.ProvideService, zipkin.ProvideService, jaeger.ProvideService, service9.ProvideCacheService, wire.Bind(new(datasources.CacheService), new(*service9.CacheServiceImpl)), service2.ProvideEncryptionService, wire.Bind(new(encryption2.Internal), new(*service2.Service)), manager.ProvideSecretsService, wire.Bind(new(secrets.Service), new(*manager.SecretsService)), database.ProvideSecretsStore, wire.Bind(new(secrets.Store), new(*database.SecretsStoreImpl)), garbagecollectionworker.ProvideWorker, grafanads.ProvideService, wire.Bind(new(dashboardsnapshots.Store), new(*database5.DashboardSnapshotStore)), database5.ProvideStore, wire.Bind(new(dashboardsnapshots.Service), new(*service10.ServiceImpl)), service10.ProvideService, service9.ProvideService, wire.Bind(new(datasources.DataSourceService), new(*service9.Service)), service9.ProvideLegacyDataSourceLookup, retriever.ProvideService, wire.Bind(new(serviceaccounts.ServiceAccountRetriever), new(*retriever.Service)), ossaccesscontrol.ProvideServiceAccountPermissions, wire.Bind(new(accesscontrol.ServiceAccountPermissionsService), new(*ossaccesscontrol.ServiceAccountPermissionsService)), manager3.ProvideServiceAccountsService, proxy.ProvideServiceAccountsProxy, wire.Bind(new(serviceaccounts.Service), new(*proxy.ServiceAccountsProxy)), dsquerierclient.NewNullQSDatasourceClientBuilder, expr.ProvideService, featuremgmt.ProvideManagerService, featuremgmt.ProvideToggles, service7.ProvideDashboardServiceImpl, wire.Bind(new(dashboards2.PermissionsRegistrationService), new(*service7.DashboardServiceImpl)), service7.ProvideDashboardService, service7.ProvideDashboardProvisioningService, service7.ProvideDashboardPluginService, database2.ProvideDashboardStore, folderimpl.ProvideService, wire.Bind(new(folder.Service), new(*folderimpl.Service)), wire.Bind(new(folder.LegacyService), new(*folderimpl.Service)), folderimpl.ProvideStore, wire.Bind(new(folder.Store), new(*folderimpl.FolderStoreImpl)), service11.ProvideService, wire.Bind(new(dashboardimport.Service), new(*service11.ImportDashboardService)), service8.ProvideService, wire.Bind(new(plugindashboards.Service), new(*service8.Service)), service8.ProvideDashboardUpdater, kvstore2.ProvideService, avatar.ProvideAvatarCacheServer, statscollector.ProvideService, csrf.ProvideCSRFFilter, wire.Bind(new(csrf.Service), new(*csrf.CSRF)), ossaccesscontrol.ProvideTeamPermissions, wire.Bind(new(accesscontrol.TeamPermissionsService), new(*ossaccesscontrol.TeamPermissionsService)), ossaccesscontrol.ProvideFolderPermissions, wire.Bind(new(accesscontrol.FolderPermissionsService), new(*ossaccesscontrol.FolderPermissionsService)), ossaccesscontrol.ProvideDashboardPermissions, wire.Bind(new(accesscontrol.DashboardPermissionsService), new(*ossaccesscontrol.DashboardPermissionsService)), ossaccesscontrol.ProvideReceiverPermissionsService, wire.Bind(new(accesscontrol.ReceiverPermissionsService), new(*ossaccesscontrol.ReceiverPermissionsService)), starimpl.ProvideService, playlistimpl.ProvideService, apikeyimpl.ProvideService, dashverimpl.ProvideService, service3.ProvideService, wire.Bind(new(publicdashboards.Service), new(*service3.PublicDashboardServiceImpl)), database3.ProvideStore, wire.Bind(new(publicdashboards.Store), new(*database3.PublicDashboardStoreImpl)), metric.ProvideService, api2.ProvideApi, api3.ProvideApi, userimpl.ProvideService, orgimpl.ProvideService, orgimpl.ProvideDeletionService, statsimpl.ProvideService, grpccontext.ProvideContextHandler, grpcserver.ProvideHealthService, grpcserver.ProvideReflectionService, resolver.ProvideEntityReferenceResolver, teamimpl.ProvideService, teamapi.ProvideTeamAPI, tempuserimpl.ProvideService, loginattemptimpl.ProvideService, wire.Bind(new(loginattempt.Service), new(*loginattemptimpl.Service)), migrations2.ProvideDataSourceMigrationService, migrations2.ProvideSecretMigrationProvider, wire.Bind(new(migrations2.SecretMigrationProvider), new(*migrations2.SecretMigrationProviderImpl)), promtypemigration.ProvideAzurePromMigrationService, promtypemigration.ProvideAmazonPromMigrationService, promtypemigration.ProvidePromTypeMigrationProvider, wire.Bind(new(promtypemigration.PromTypeMigrationProvider), new(*promtypemigration.PromTypeMigrationProviderImpl)), resourcepermissions.NewActionSetService, wire.Bind(new(accesscontrol.ActionResolver), new(resourcepermissions.ActionSetService)), wire.Bind(new(pluginaccesscontrol.ActionSetRegistry), new(resourcepermissions.ActionSetService)), permreg.ProvidePermissionRegistry, acimpl.ProvideAccessControl, dualwrite2.ProvideZanzanaReconciler, navtreeimpl.ProvideService, wire.Bind(new(accesscontrol.AccessControl), new(*acimpl.AccessControl)), wire.Bind(new(notifications.TempUserStore), new(tempuser.Service)), tagimpl.ProvideService, wire.Bind(new(tag.Service), new(*tagimpl.Service)), authnimpl.ProvideService, authnimpl.ProvideIdentitySynchronizer, authnimpl.ProvideAuthnService, authnimpl.ProvideAuthnServiceAuthenticateOnly, authnimpl.ProvideRegistration, supportbundlesimpl.ProvideService, extsvcaccounts.ProvideExtSvcAccountsService, wire.Bind(new(serviceaccounts.ExtSvcAccountsService), new(*extsvcaccounts.ExtSvcAccountsService)), registry2.ProvideExtSvcRegistry, wire.Bind(new(extsvcauth.ExternalServiceRegistry), new(*registry2.Registry)), anonstore.ProvideAnonDBStore, wire.Bind(new(anonstore.AnonStore), new(*anonstore.AnonDBStore)), loggermw.Provide, slogadapter.Provide, signingkeysimpl.ProvideEmbeddedSigningKeysService, wire.Bind(new(signingkeys.Service), new(*signingkeysimpl.Service)), ssosettingsimpl.ProvideService, wire.Bind(new(ssosettings.Service), new(*ssosettingsimpl.Service)), idimpl.ProvideService, wire.Bind(new(auth.IDService), new(*idimpl.Service)), cloudmigrationimpl.ProvideService, userimpl.ProvideVerifier, connectors.ProvideOrgRoleMapper, wire.Bind(new(user.Verifier), new(*userimpl.Verifier)), authz.WireSet, metadata.ProvideSecureValueMetadataStorage, metadata.ProvideKeeperMetadataStorage, metadata.ProvideDecryptStorage, decrypt.ProvideDecryptAuthorizer, wire.Value([]decrypt.ExtraOwnerDecrypter(nil)), decrypt.ProvideDecryptService, inline.ProvideInlineSecureValueService, encryption.ProvideDataKeyStorage, encryption.ProvideGlobalDataKeyStorage, encryption.ProvideEncryptedValueStorage, encryption.ProvideGlobalEncryptedValueStorage, service5.ProvideSecureValueService, validator.ProvideKeeperValidator, validator.ProvideSecureValueValidator, mutator.ProvideKeeperMutator, mutator.ProvideSecureValueMutator, migrator2.NewWithEngine, database4.ProvideDatabase, clock.ProvideClock, wire.Bind(new(contracts.Database), new(*database4.Database)), wire.Bind(new(contracts.Clock), new(*clock.Clock)), manager2.ProvideEncryptionManager, service4.ProvideAESGCMCipherService, resource.ProvideStorageMetrics, resource.ProvideIndexMetrics, apiserver.WireSet, apiregistry.WireSet, appregistry.WireSet, client.ProvideK8sClientWithFallback) var wireSet = wire.NewSet( wireBasicSet, metrics.WireSet, sqlstore.ProvideService, metrics2.ProvideService, wire.Bind(new(notifications.Service), new(*notifications.NotificationService)), wire.Bind(new(notifications.WebhookSender), new(*notifications.NotificationService)), wire.Bind(new(notifications.EmailSender), new(*notifications.NotificationService)), wire.Bind(new(db.DB), new(*sqlstore.SQLStore)), prefimpl.ProvideService, oauthtoken.ProvideService, wire.Bind(new(oauthtoken.OAuthTokenService), new(*oauthtoken.Service)), wire.Bind(new(cleanup.AlertRuleService), new(*store2.DBstore)), diff --git a/pkg/storage/secret/metadata/decrypt_store.go b/pkg/storage/secret/metadata/decrypt_store.go index 7a314ab27cd..b7a06c99e0e 100644 --- a/pkg/storage/secret/metadata/decrypt_store.go +++ b/pkg/storage/secret/metadata/decrypt_store.go @@ -5,14 +5,15 @@ import ( "fmt" "time" - claims "github.com/grafana/authlib/types" - "github.com/grafana/grafana-app-sdk/logging" "github.com/prometheus/client_golang/prometheus" "go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/codes" "go.opentelemetry.io/otel/trace" "google.golang.org/grpc/metadata" + claims "github.com/grafana/authlib/types" + "github.com/grafana/grafana-app-sdk/logging" + secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" "github.com/grafana/grafana/pkg/registry/apis/secret/contracts" "github.com/grafana/grafana/pkg/registry/apis/secret/xkube" @@ -108,7 +109,7 @@ func (s *decryptStorage) Decrypt(ctx context.Context, namespace xkube.Namespace, return "", contracts.ErrDecryptNotFound } - decrypterIdentity, authorized := s.decryptAuthorizer.Authorize(ctx, namespace, name, sv.Spec.Decrypters) + decrypterIdentity, authorized := s.decryptAuthorizer.Authorize(ctx, namespace, name, sv.Spec.Decrypters, sv.OwnerReferences) if !authorized { return "", contracts.ErrDecryptNotAuthorized }