Snapshots: Store dashboard data encrypted in the database (#28129)

* end 2 end

* fix import

* refactor

* introduce securedata

* check err

* use testify instead of convey

* cleanup test

* cleanup test

* blob time

* rename funcs

pkg/api/api.go

@@ -438,7 +438,7 @@ func (hs *HTTPServer) registerRoutes() {
 	// Snapshots
 	r.Post("/api/snapshots/", reqSnapshotPublicModeOrSignedIn, bind(models.CreateDashboardSnapshotCommand{}), CreateDashboardSnapshot)
 	r.Get("/api/snapshot/shared-options/", reqSignedIn, GetSharingOptions)
-	r.Get("/api/snapshots/:key", GetDashboardSnapshot)
+	r.Get("/api/snapshots/:key", Wrap(GetDashboardSnapshot))
 	r.Get("/api/snapshots-delete/:deleteKey", reqSnapshotPublicModeOrSignedIn, Wrap(DeleteDashboardSnapshotByDeleteKey))
 	r.Delete("/api/snapshots/:key", reqEditorRole, Wrap(DeleteDashboardSnapshot))
 

pkg/api/dashboard_snapshot.go

@@ -86,7 +86,7 @@ func CreateDashboardSnapshot(c *models.ReqContext, cmd models.CreateDashboardSna
 
 		response, err := createExternalDashboardSnapshot(cmd)
 		if err != nil {
-			c.JsonApiErr(500, "Failed to create external snaphost", err)
+			c.JsonApiErr(500, "Failed to create external snapshot", err)
 			return
 		}
 
@@ -123,7 +123,7 @@ func CreateDashboardSnapshot(c *models.ReqContext, cmd models.CreateDashboardSna
 	}
 
 	if err := bus.Dispatch(&cmd); err != nil {
-		c.JsonApiErr(500, "Failed to create snaphost", err)
+		c.JsonApiErr(500, "Failed to create snapshot", err)
 		return
 	}
 
@@ -136,26 +136,29 @@ func CreateDashboardSnapshot(c *models.ReqContext, cmd models.CreateDashboardSna
 }
 
 // GET /api/snapshots/:key
-func GetDashboardSnapshot(c *models.ReqContext) {
+func GetDashboardSnapshot(c *models.ReqContext) Response {
 	key := c.Params(":key")
 	query := &models.GetDashboardSnapshotQuery{Key: key}
 
 	err := bus.Dispatch(query)
 	if err != nil {
-		c.JsonApiErr(500, "Failed to get dashboard snapshot", err)
-		return
+		return Error(500, "Failed to get dashboard snapshot", err)
 	}
 
 	snapshot := query.Result
 
 	// expired snapshots should also be removed from db
 	if snapshot.Expires.Before(time.Now()) {
-		c.JsonApiErr(404, "Dashboard snapshot not found", err)
-		return
+		return Error(404, "Dashboard snapshot not found", err)
+	}
+
+	dashboard, err := snapshot.DashboardJSON()
+	if err != nil {
+		return Error(500, "Failed to get dashboard data for dashboard snapshot", err)
 	}
 
 	dto := dtos.DashboardFullWithMeta{
-		Dashboard: snapshot.Dashboard,
+		Dashboard: dashboard,
 		Meta: dtos.DashboardMeta{
 			Type:       models.DashTypeSnapshot,
 			IsSnapshot: true,
@@ -166,8 +169,7 @@ func GetDashboardSnapshot(c *models.ReqContext) {
 
 	metrics.MApiDashboardSnapshotGet.Inc()
 
-	c.Resp.Header().Set("Cache-Control", "public, max-age=3600")
-	c.JSON(200, dto)
+	return JSON(200, dto).Header("Cache-Control", "public, max-age=3600")
 }
 
 func deleteExternalDashboardSnapshot(externalUrl string) error {
@@ -238,7 +240,10 @@ func DeleteDashboardSnapshot(c *models.ReqContext) Response {
 	if query.Result == nil {
 		return Error(404, "Failed to get dashboard snapshot", nil)
 	}
-	dashboard := query.Result.Dashboard
+	dashboard, err := query.Result.DashboardJSON()
+	if err != nil {
+		return Error(500, "Failed to get dashboard data for dashboard snapshot", err)
+	}
 	dashboardID := dashboard.Get("id").MustInt64()
 
 	guardian := guardian.New(dashboardID, c.OrgId, c.SignedInUser)

pkg/api/dashboard_snapshot_test.go

@@ -7,9 +7,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/grafana/grafana/pkg/components/securedata"
+
 	"github.com/grafana/grafana/pkg/bus"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 	"github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/setting"
 
 	. "github.com/smartystreets/goconvey/convey"
 )
@@ -198,6 +201,62 @@ func TestDashboardSnapshotApiEndpoint(t *testing.T) {
 					So(sc.resp.Code, ShouldEqual, 500)
 				})
 			})
+
+			Convey("Should be able to read a snapshot's un-encrypted data", func() {
+				loggedInUserScenarioWithRole("When calling GET on", "GET", "/api/snapshots/12345", "/api/snapshots/:key", models.ROLE_EDITOR, func(sc *scenarioContext) {
+					sc.handlerFunc = GetDashboardSnapshot
+					sc.fakeReqWithParams("GET", sc.url, map[string]string{"key": "12345"}).exec()
+
+					So(sc.resp.Code, ShouldEqual, 200)
+					respJSON, err := simplejson.NewJson(sc.resp.Body.Bytes())
+					So(err, ShouldBeNil)
+
+					dashboard := respJSON.Get("dashboard")
+					id := dashboard.Get("id")
+
+					So(id.MustInt64(), ShouldEqual, 100)
+				})
+			})
+
+			Convey("Should be able to read a snapshot's encrypted data", func() {
+				origSecret := setting.SecretKey
+				setting.SecretKey = "dashboard_snapshot_api_test"
+				t.Cleanup(func() {
+					setting.SecretKey = origSecret
+				})
+
+				dashboardId := 123
+				jsonModel, err := simplejson.NewJson([]byte(fmt.Sprintf(`{"id":%d}`, dashboardId)))
+				So(err, ShouldBeNil)
+
+				jsonModelEncoded, err := jsonModel.Encode()
+				So(err, ShouldBeNil)
+
+				encrypted, err := securedata.Encrypt(jsonModelEncoded)
+				So(err, ShouldBeNil)
+
+				// mock snapshot with encrypted dashboard info
+				mockSnapshotResult := &models.DashboardSnapshot{
+					Key:                "12345",
+					DashboardEncrypted: encrypted,
+					Expires:            time.Now().Add(time.Duration(1000) * time.Second),
+				}
+
+				bus.AddHandler("test", func(query *models.GetDashboardSnapshotQuery) error {
+					query.Result = mockSnapshotResult
+					return nil
+				})
+
+				loggedInUserScenarioWithRole("When calling GET on", "GET", "/api/snapshots/12345", "/api/snapshots/:key", models.ROLE_EDITOR, func(sc *scenarioContext) {
+					sc.handlerFunc = GetDashboardSnapshot
+					sc.fakeReqWithParams("GET", sc.url, map[string]string{"key": "12345"}).exec()
+
+					So(sc.resp.Code, ShouldEqual, 200)
+					respJSON, err := simplejson.NewJson(sc.resp.Body.Bytes())
+					So(err, ShouldBeNil)
+					So(respJSON.Get("dashboard").Get("id").MustInt64(), ShouldEqual, dashboardId)
+				})
+			})
 		})
 	})
 }