Plugins: Handle app plugin proxy routes per request (#51835)

Fixes #47530

pkg/api/pluginproxy/pluginproxy_test.go

@@ -2,11 +2,14 @@ package pluginproxy
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
+	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/services/org"
@@ -32,19 +35,19 @@ func TestPluginProxy(t *testing.T) {
 			},
 		}
 
-		store := &mockPluginsSettingsService{}
-		key, _ := secretsService.Encrypt(context.Background(), []byte("123"), secrets.WithoutScope())
-		store.pluginSetting = &pluginsettings.DTO{
-			SecureJSONData: map[string][]byte{
-				"key": key,
-			},
-		}
+		key, err := secretsService.Encrypt(context.Background(), []byte("123"), secrets.WithoutScope())
+		require.NoError(t, err)
 
 		httpReq, err := http.NewRequest(http.MethodGet, "", nil)
 		require.NoError(t, err)
 
 		req := getPluginProxiedRequest(
 			t,
+			&pluginsettings.DTO{
+				SecureJSONData: map[string][]byte{
+					"key": key,
+				},
+			},
 			secretsService,
 			&models.ReqContext{
 				SignedInUser: &user.SignedInUser{
@@ -56,7 +59,6 @@ func TestPluginProxy(t *testing.T) {
 			},
 			&setting.Cfg{SendUserHeader: true},
 			route,
-			store,
 		)
 
 		assert.Equal(t, "my secret 123", req.Header.Get("x-header"))
@@ -66,11 +68,9 @@ func TestPluginProxy(t *testing.T) {
 		httpReq, err := http.NewRequest(http.MethodGet, "", nil)
 		require.NoError(t, err)
 
-		store := &mockPluginsSettingsService{}
-		store.pluginSetting = &pluginsettings.DTO{}
-
 		req := getPluginProxiedRequest(
 			t,
+			&pluginsettings.DTO{},
 			secretsService,
 			&models.ReqContext{
 				SignedInUser: &user.SignedInUser{
@@ -82,7 +82,6 @@ func TestPluginProxy(t *testing.T) {
 			},
 			&setting.Cfg{SendUserHeader: true},
 			nil,
-			store,
 		)
 
 		// Get will return empty string even if header is not set
@@ -93,11 +92,9 @@ func TestPluginProxy(t *testing.T) {
 		httpReq, err := http.NewRequest(http.MethodGet, "", nil)
 		require.NoError(t, err)
 
-		store := &mockPluginsSettingsService{}
-		store.pluginSetting = &pluginsettings.DTO{}
-
 		req := getPluginProxiedRequest(
 			t,
+			&pluginsettings.DTO{},
 			secretsService,
 			&models.ReqContext{
 				SignedInUser: &user.SignedInUser{
@@ -109,7 +106,6 @@ func TestPluginProxy(t *testing.T) {
 			},
 			&setting.Cfg{SendUserHeader: false},
 			nil,
-			store,
 		)
 		// Get will return empty string even if header is not set
 		assert.Equal(t, "", req.Header.Get("X-Grafana-User"))
@@ -119,11 +115,9 @@ func TestPluginProxy(t *testing.T) {
 		httpReq, err := http.NewRequest(http.MethodGet, "", nil)
 		require.NoError(t, err)
 
-		store := &mockPluginsSettingsService{}
-		store.pluginSetting = &pluginsettings.DTO{}
-
 		req := getPluginProxiedRequest(
 			t,
+			&pluginsettings.DTO{},
 			secretsService,
 			&models.ReqContext{
 				SignedInUser: &user.SignedInUser{IsAnonymous: true},
@@ -133,7 +127,6 @@ func TestPluginProxy(t *testing.T) {
 			},
 			&setting.Cfg{SendUserHeader: true},
 			nil,
-			store,
 		)
 
 		// Get will return empty string even if header is not set
@@ -146,18 +139,16 @@ func TestPluginProxy(t *testing.T) {
 			Method: "GET",
 		}
 
-		store := &mockPluginsSettingsService{}
-		store.pluginSetting = &pluginsettings.DTO{
-			JSONData: map[string]interface{}{
-				"dynamicUrl": "https://dynamic.grafana.com",
-			},
-		}
-
 		httpReq, err := http.NewRequest(http.MethodGet, "", nil)
 		require.NoError(t, err)
 
 		req := getPluginProxiedRequest(
 			t,
+			&pluginsettings.DTO{
+				JSONData: map[string]interface{}{
+					"dynamicUrl": "https://dynamic.grafana.com",
+				},
+			},
 			secretsService,
 			&models.ReqContext{
 				SignedInUser: &user.SignedInUser{
@@ -169,7 +160,6 @@ func TestPluginProxy(t *testing.T) {
 			},
 			&setting.Cfg{SendUserHeader: true},
 			route,
-			store,
 		)
 		assert.Equal(t, "https://dynamic.grafana.com", req.URL.String())
 		assert.Equal(t, "{{.JsonData.dynamicUrl}}", route.URL)
@@ -181,14 +171,12 @@ func TestPluginProxy(t *testing.T) {
 			Method: "GET",
 		}
 
-		store := &mockPluginsSettingsService{}
-		store.pluginSetting = &pluginsettings.DTO{}
-
 		httpReq, err := http.NewRequest(http.MethodGet, "", nil)
 		require.NoError(t, err)
 
 		req := getPluginProxiedRequest(
 			t,
+			&pluginsettings.DTO{},
 			secretsService,
 			&models.ReqContext{
 				SignedInUser: &user.SignedInUser{
@@ -200,7 +188,6 @@ func TestPluginProxy(t *testing.T) {
 			},
 			&setting.Cfg{SendUserHeader: true},
 			route,
-			store,
 		)
 		assert.Equal(t, "https://example.com", req.URL.String())
 	})
@@ -212,22 +199,22 @@ func TestPluginProxy(t *testing.T) {
 			Body: []byte(`{ "url": "{{.JsonData.dynamicUrl}}", "secret": "{{.SecureJsonData.key}}"	}`),
 		}
 
-		store := &mockPluginsSettingsService{}
-		encryptedJsonData, _ := secretsService.EncryptJsonData(
+		encryptedJsonData, err := secretsService.EncryptJsonData(
 			context.Background(),
 			map[string]string{"key": "123"},
 			secrets.WithoutScope(),
 		)
-		store.pluginSetting = &pluginsettings.DTO{
-			JSONData:       map[string]interface{}{"dynamicUrl": "https://dynamic.grafana.com"},
-			SecureJSONData: encryptedJsonData,
-		}
+		require.NoError(t, err)
 
 		httpReq, err := http.NewRequest(http.MethodGet, "", nil)
 		require.NoError(t, err)
 
 		req := getPluginProxiedRequest(
 			t,
+			&pluginsettings.DTO{
+				JSONData:       map[string]interface{}{"dynamicUrl": "https://dynamic.grafana.com"},
+				SecureJSONData: encryptedJsonData,
+			},
 			secretsService,
 			&models.ReqContext{
 				SignedInUser: &user.SignedInUser{
@@ -239,7 +226,6 @@ func TestPluginProxy(t *testing.T) {
 			},
 			&setting.Cfg{SendUserHeader: true},
 			route,
-			store,
 		)
 		content, err := io.ReadAll(req.Body)
 		require.NoError(t, err)
@@ -257,9 +243,11 @@ func TestPluginProxy(t *testing.T) {
 
 		responseWriter := web.NewResponseWriter("GET", httptest.NewRecorder())
 
-		route := &plugins.Route{
-			Path: "/",
-			URL:  backendServer.URL,
+		routes := []*plugins.Route{
+			{
+				Path: "/",
+				URL:  backendServer.URL,
+			},
 		}
 
 		ctx := &models.ReqContext{
@@ -269,13 +257,12 @@ func TestPluginProxy(t *testing.T) {
 				Resp: responseWriter,
 			},
 		}
-		pluginSettingsService := &mockPluginsSettingsService{
-			pluginSetting: &pluginsettings.DTO{
-				SecureJSONData: map[string][]byte{},
-			},
+		ps := &pluginsettings.DTO{
+			SecureJSONData: map[string][]byte{},
 		}
-		proxy := NewApiPluginProxy(ctx, "", route, "", &setting.Cfg{}, pluginSettingsService, secretsService)
-		proxy.ServeHTTP(ctx.Resp, ctx.Req)
+		proxy, err := NewPluginProxy(ps, routes, ctx, "", &setting.Cfg{}, secretsService, tracing.InitializeTracerForTest(), &http.Transport{})
+		require.NoError(t, err)
+		proxy.HandleRequest()
 
 		for {
 			if requestHandled {
@@ -287,8 +274,153 @@ func TestPluginProxy(t *testing.T) {
 	})
 }
 
+func TestPluginProxyRoutes(t *testing.T) {
+	routes := []*plugins.Route{
+		{
+			Path:   "",
+			Method: "GET",
+			URL:    "http://localhost",
+		},
+		{
+			Path:   "some-api",
+			Method: "GET",
+			URL:    "http://localhost/api",
+		},
+		{
+			Path:   "some-api/instances",
+			Method: "GET",
+			URL:    "http://localhost/api/instances/",
+		},
+		{
+			Path:   "some-api/*",
+			Method: "GET",
+			URL:    "http://localhost/api",
+		},
+		{
+			Path:   "some-api/instances/*",
+			Method: "GET",
+			URL:    "http://localhost/api/instances",
+		},
+		{
+			Path:   "some-other-api/*",
+			Method: "GET",
+			URL:    "http://localhost/api/v2",
+		},
+		{
+			Path:   "some-other-api/instances/*",
+			Method: "GET",
+			URL:    "http://localhost/api/v2/instances",
+		},
+	}
+
+	tcs := []struct {
+		proxyPath       string
+		expectedURLPath string
+		expectedStatus  int
+	}{
+		{
+			proxyPath:      "/notexists",
+			expectedStatus: http.StatusNotFound,
+		},
+		{
+			proxyPath:       "/",
+			expectedURLPath: "/",
+			expectedStatus:  http.StatusOK,
+		},
+		{
+			proxyPath:       "/some-api",
+			expectedURLPath: "/api",
+			expectedStatus:  http.StatusOK,
+		},
+		{
+			proxyPath:       "/some-api/instances",
+			expectedURLPath: "/api/instances/",
+			expectedStatus:  http.StatusOK,
+		},
+		{
+			proxyPath:       "/some-api/some/thing",
+			expectedURLPath: "/api/some/thing",
+			expectedStatus:  http.StatusOK,
+		},
+		{
+			proxyPath:       "/some-api/instances/instance-one",
+			expectedURLPath: "/api/instances/instance-one",
+			expectedStatus:  http.StatusOK,
+		},
+		{
+			proxyPath:       "/some-other-api/some/thing",
+			expectedURLPath: "/api/v2/some/thing",
+			expectedStatus:  http.StatusOK,
+		},
+		{
+			proxyPath:       "/some-other-api/instances/instance-one",
+			expectedURLPath: "/api/v2/instances/instance-one",
+			expectedStatus:  http.StatusOK,
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(fmt.Sprintf("When proxying path %q should call expected URL", tc.proxyPath), func(t *testing.T) {
+			secretsService := secretsManager.SetupTestService(t, fakes.NewFakeSecretsStore())
+			requestHandled := false
+			requestURL := ""
+			backendServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				requestURL = r.URL.RequestURI()
+				w.WriteHeader(200)
+				_, _ = w.Write([]byte("I am the backend"))
+				requestHandled = true
+			}))
+			t.Cleanup(backendServer.Close)
+
+			backendURL, err := url.Parse(backendServer.URL)
+			require.NoError(t, err)
+
+			testRoutes := make([]*plugins.Route, len(routes))
+			for i, r := range routes {
+				u, err := url.Parse(r.URL)
+				require.NoError(t, err)
+				u.Scheme = backendURL.Scheme
+				u.Host = backendURL.Host
+				testRoute := *r
+				testRoute.URL = u.String()
+				testRoutes[i] = &testRoute
+			}
+
+			responseWriter := web.NewResponseWriter("GET", httptest.NewRecorder())
+
+			ctx := &models.ReqContext{
+				SignedInUser: &user.SignedInUser{},
+				Context: &web.Context{
+					Req:  httptest.NewRequest("GET", tc.proxyPath, nil),
+					Resp: responseWriter,
+				},
+			}
+			ps := &pluginsettings.DTO{
+				SecureJSONData: map[string][]byte{},
+			}
+			proxy, err := NewPluginProxy(ps, testRoutes, ctx, tc.proxyPath, &setting.Cfg{}, secretsService, tracing.InitializeTracerForTest(), &http.Transport{})
+			require.NoError(t, err)
+			proxy.HandleRequest()
+
+			for {
+				if requestHandled || ctx.Resp.Written() {
+					break
+				}
+			}
+
+			require.Equal(t, tc.expectedStatus, ctx.Resp.Status())
+
+			if tc.expectedStatus == http.StatusNotFound {
+				return
+			}
+
+			require.Equal(t, tc.expectedURLPath, requestURL)
+		})
+	}
+}
+
 // getPluginProxiedRequest is a helper for easier setup of tests based on global config and ReqContext.
-func getPluginProxiedRequest(t *testing.T, secretsService secrets.Service, ctx *models.ReqContext, cfg *setting.Cfg, route *plugins.Route, pluginSettingsService pluginsettings.Service) *http.Request {
+func getPluginProxiedRequest(t *testing.T, ps *pluginsettings.DTO, secretsService secrets.Service, ctx *models.ReqContext, cfg *setting.Cfg, route *plugins.Route) *http.Request {
 	// insert dummy route if none is specified
 	if route == nil {
 		route = &plugins.Route{
@@ -297,35 +429,12 @@ func getPluginProxiedRequest(t *testing.T, secretsService secrets.Service, ctx *
 			ReqRole: org.RoleEditor,
 		}
 	}
-	proxy := NewApiPluginProxy(ctx, "", route, "", cfg, pluginSettingsService, secretsService)
+	proxy, err := NewPluginProxy(ps, []*plugins.Route{}, ctx, "", cfg, secretsService, tracing.InitializeTracerForTest(), &http.Transport{})
+	require.NoError(t, err)
 
 	req, err := http.NewRequest(http.MethodGet, "/api/plugin-proxy/grafana-simple-app/api/v4/alerts", nil)
 	require.NoError(t, err)
-	proxy.Director(req)
+	proxy.matchedRoute = route
+	proxy.director(req)
 	return req
 }
-
-type mockPluginsSettingsService struct {
-	pluginSetting *pluginsettings.DTO
-	err           error
-}
-
-func (s *mockPluginsSettingsService) GetPluginSettings(_ context.Context, _ *pluginsettings.GetArgs) ([]*pluginsettings.DTO, error) {
-	return nil, s.err
-}
-
-func (s *mockPluginsSettingsService) GetPluginSettingByPluginID(_ context.Context, _ *pluginsettings.GetByPluginIDArgs) (*pluginsettings.DTO, error) {
-	return s.pluginSetting, s.err
-}
-
-func (s *mockPluginsSettingsService) UpdatePluginSettingPluginVersion(_ context.Context, _ *pluginsettings.UpdatePluginVersionArgs) error {
-	return s.err
-}
-
-func (s *mockPluginsSettingsService) UpdatePluginSetting(_ context.Context, _ *pluginsettings.UpdateArgs) error {
-	return s.err
-}
-
-func (s *mockPluginsSettingsService) DecryptedValues(_ *pluginsettings.DTO) map[string]string {
-	return nil
-}