public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Snapshots: Store dashboard data encrypted in the database (#28129)

Browse Source 
* end 2 end

* fix import

* refactor

* introduce securedata

* check err

* use testify instead of convey

* cleanup test

* cleanup test

* blob time

* rename funcs
This commit is contained in:
Will Browne
2020-10-13 10:19:42 +02:00
committed by GitHub
parent 87d6f90acb
commit ef22ff7315
8 changed files with 249 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/sqlstore/dashboard_snapshot.go
+26 -14
View File
@@ -4,6 +4,8 @@ import (
"time"
"github.com/grafana/grafana/pkg/bus"
"github.com/grafana/grafana/pkg/components/securedata"
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/setting"
)
@@ -45,22 +47,32 @@ func CreateDashboardSnapshot(cmd *models.CreateDashboardSnapshotCommand) error {
expires = time.Now().Add(time.Second * time.Duration(cmd.Expires))
}
snapshot := &models.DashboardSnapshot{
Name: cmd.Name,
Key: cmd.Key,
DeleteKey: cmd.DeleteKey,
OrgId: cmd.OrgId,
UserId: cmd.UserId,
External: cmd.External,
ExternalUrl: cmd.ExternalUrl,
ExternalDeleteUrl: cmd.ExternalDeleteUrl,
Dashboard: cmd.Dashboard,
Expires: expires,
Created: time.Now(),
Updated: time.Now(),
marshalledData, err := cmd.Dashboard.Encode()
if err != nil {
return err
}
_, err := sess.Insert(snapshot)
encryptedDashboard, err := securedata.Encrypt(marshalledData)
if err != nil {
return err
}
snapshot := &models.DashboardSnapshot{
Name: cmd.Name,
Key: cmd.Key,
DeleteKey: cmd.DeleteKey,
OrgId: cmd.OrgId,
UserId: cmd.UserId,
External: cmd.External,
ExternalUrl: cmd.ExternalUrl,
ExternalDeleteUrl: cmd.ExternalDeleteUrl,
Dashboard: simplejson.New(),
DashboardEncrypted: encryptedDashboard,
Expires: expires,
Created: time.Now(),
Updated: time.Now(),
}
_, err = sess.Insert(snapshot)
cmd.Result = snapshot
return err
pkg/services/sqlstore/dashboard_snapshot_test.go
+113 -95
View File
@@ -4,7 +4,8 @@ import (
"testing"
"time"
. "github.com/smartystreets/goconvey/convey"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/models"
@@ -12,140 +13,157 @@ import (
)
func TestDashboardSnapshotDBAccess(t *testing.T) {
Convey("Testing DashboardSnapshot data access", t, func() {
InitTestDB(t)
InitTestDB(t)
Convey("Given saved snapshot", func() {
origSecret := setting.SecretKey
setting.SecretKey = "dashboard_snapshot_testing"
t.Cleanup(func() {
setting.SecretKey = origSecret
})
t.Run("Given saved snapshot", func(t *testing.T) {
cmd := models.CreateDashboardSnapshotCommand{
Key: "hej",
Dashboard: simplejson.NewFromAny(map[string]interface{}{
"hello": "mupp",
}),
UserId: 1000,
OrgId: 1,
}
err := CreateDashboardSnapshot(&cmd)
require.NoError(t, err)
t.Run("Should be able to get snapshot by key", func(t *testing.T) {
query := models.GetDashboardSnapshotQuery{Key: "hej"}
err := GetDashboardSnapshot(&query)
require.NoError(t, err)
assert.NotNil(t, query.Result)
dashboard, err := query.Result.DashboardJSON()
require.NoError(t, err)
assert.Equal(t, "mupp", dashboard.Get("hello").MustString())
})
t.Run("And the user has the admin role", func(t *testing.T) {
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_ADMIN},
}
err := SearchDashboardSnapshots(&query)
require.NoError(t, err)
t.Run("Should return all the snapshots", func(t *testing.T) {
assert.NotNil(t, query.Result)
assert.Len(t, query.Result, 1)
})
})
t.Run("And the user has the editor role and has created a snapshot", func(t *testing.T) {
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, UserId: 1000},
}
err := SearchDashboardSnapshots(&query)
require.NoError(t, err)
t.Run("Should return all the snapshots", func(t *testing.T) {
require.NotNil(t, query.Result)
assert.Len(t, query.Result, 1)
})
})
t.Run("And the user has the editor role and has not created any snapshot", func(t *testing.T) {
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, UserId: 2},
}
err := SearchDashboardSnapshots(&query)
require.NoError(t, err)
t.Run("Should not return any snapshots", func(t *testing.T) {
require.NotNil(t, query.Result)
assert.Empty(t, query.Result)
})
})
t.Run("And the user is anonymous", func(t *testing.T) {
cmd := models.CreateDashboardSnapshotCommand{
Key: "hej",
Key: "strangesnapshotwithuserid0",
DeleteKey: "adeletekey",
Dashboard: simplejson.NewFromAny(map[string]interface{}{
"hello": "mupp",
}),
UserId: 1000,
UserId: 0,
OrgId: 1,
}
err := CreateDashboardSnapshot(&cmd)
So(err, ShouldBeNil)
require.NoError(t, err)
Convey("Should be able to get snapshot by key", func() {
query := models.GetDashboardSnapshotQuery{Key: "hej"}
err = GetDashboardSnapshot(&query)
So(err, ShouldBeNil)
So(query.Result, ShouldNotBeNil)
So(query.Result.Dashboard.Get("hello").MustString(), ShouldEqual, "mupp")
})
Convey("And the user has the admin role", func() {
Convey("Should return all the snapshots", func() {
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_ADMIN},
}
err := SearchDashboardSnapshots(&query)
So(err, ShouldBeNil)
So(query.Result, ShouldNotBeNil)
So(len(query.Result), ShouldEqual, 1)
})
})
Convey("And the user has the editor role and has created a snapshot", func() {
Convey("Should return all the snapshots", func() {
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, UserId: 1000},
}
err := SearchDashboardSnapshots(&query)
So(err, ShouldBeNil)
So(query.Result, ShouldNotBeNil)
So(len(query.Result), ShouldEqual, 1)
})
})
Convey("And the user has the editor role and has not created any snapshot", func() {
Convey("Should not return any snapshots", func() {
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, UserId: 2},
}
err := SearchDashboardSnapshots(&query)
So(err, ShouldBeNil)
So(query.Result, ShouldNotBeNil)
So(len(query.Result), ShouldEqual, 0)
})
})
Convey("And the user is anonymous", func() {
cmd := models.CreateDashboardSnapshotCommand{
Key: "strangesnapshotwithuserid0",
DeleteKey: "adeletekey",
Dashboard: simplejson.NewFromAny(map[string]interface{}{
"hello": "mupp",
}),
UserId: 0,
OrgId: 1,
t.Run("Should not return any snapshots", func(t *testing.T) {
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, IsAnonymous: true, UserId: 0},
}
err := CreateDashboardSnapshot(&cmd)
So(err, ShouldBeNil)
err := SearchDashboardSnapshots(&query)
require.NoError(t, err)
Convey("Should not return any snapshots", func() {
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_EDITOR, IsAnonymous: true, UserId: 0},
}
err := SearchDashboardSnapshots(&query)
So(err, ShouldBeNil)
So(query.Result, ShouldNotBeNil)
So(len(query.Result), ShouldEqual, 0)
})
require.NotNil(t, query.Result)
assert.Empty(t, query.Result)
})
})
t.Run("Should have encrypted dashboard data", func(t *testing.T) {
original, err := cmd.Dashboard.Encode()
require.NoError(t, err)
decrypted, err := cmd.Result.DashboardEncrypted.Decrypt()
require.NoError(t, err)
require.Equal(t, decrypted, original)
})
})
}
func TestDeleteExpiredSnapshots(t *testing.T) {
sqlstore := InitTestDB(t)
Convey("Testing dashboard snapshots clean up", t, func() {
t.Run("Testing dashboard snapshots clean up", func(t *testing.T) {
setting.SnapShotRemoveExpired = true
notExpiredsnapshot := createTestSnapshot(sqlstore, "key1", 48000)
createTestSnapshot(sqlstore, "key2", -1200)
createTestSnapshot(sqlstore, "key3", -1200)
nonExpiredSnapshot := createTestSnapshot(t, sqlstore, "key1", 48000)
createTestSnapshot(t, sqlstore, "key2", -1200)
createTestSnapshot(t, sqlstore, "key3", -1200)
err := DeleteExpiredSnapshots(&models.DeleteExpiredSnapshotsCommand{})
So(err, ShouldBeNil)
require.NoError(t, err)
query := models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_ADMIN},
}
err = SearchDashboardSnapshots(&query)
So(err, ShouldBeNil)
require.NoError(t, err)
So(len(query.Result), ShouldEqual, 1)
So(query.Result[0].Key, ShouldEqual, notExpiredsnapshot.Key)
assert.Len(t, query.Result, 1)
assert.Equal(t, nonExpiredSnapshot.Key, query.Result[0].Key)
err = DeleteExpiredSnapshots(&models.DeleteExpiredSnapshotsCommand{})
So(err, ShouldBeNil)
require.NoError(t, err)
query = models.GetDashboardSnapshotsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{OrgRole: models.ROLE_ADMIN},
}
err = SearchDashboardSnapshots(&query)
So(err, ShouldBeNil)
require.NoError(t, err)
So(len(query.Result), ShouldEqual, 1)
So(query.Result[0].Key, ShouldEqual, notExpiredsnapshot.Key)
require.Len(t, query.Result, 1)
require.Equal(t, nonExpiredSnapshot.Key, query.Result[0].Key)
})
}
func createTestSnapshot(sqlstore *SqlStore, key string, expires int64) *models.DashboardSnapshot {
func createTestSnapshot(t *testing.T, sqlstore *SqlStore, key string, expires int64) *models.DashboardSnapshot {
cmd := models.CreateDashboardSnapshotCommand{
Key: key,
DeleteKey: "delete" + key,
@@ -157,13 +175,13 @@ func createTestSnapshot(sqlstore *SqlStore, key string, expires int64) *models.D
Expires: expires,
}
err := CreateDashboardSnapshot(&cmd)
So(err, ShouldBeNil)
require.NoError(t, err)
// Set expiry date manually - to be able to create expired snapshots
if expires < 0 {
expireDate := time.Now().Add(time.Second * time.Duration(expires))
_, err = sqlstore.engine.Exec("UPDATE dashboard_snapshot SET expires = ? WHERE id = ?", expireDate, cmd.Result.Id)
So(err, ShouldBeNil)
require.NoError(t, err)
}
return cmd.Result
pkg/services/sqlstore/migrations/dashboard_snapshot_mig.go
+4
View File
@@ -64,4 +64,8 @@ func addDashboardSnapshotMigrations(mg *Migrator) {
mg.AddMigration("Add column external_delete_url to dashboard_snapshots table", NewAddColumnMigration(snapshotV5, &Column{
Name: "external_delete_url", Type: DB_NVarchar, Length: 255, Nullable: true,
}))
mg.AddMigration("Add encrypted dashboard json column", NewAddColumnMigration(snapshotV5, &Column{
Name: "dashboard_encrypted", Type: DB_Blob, Nullable: true,
}))
}