mirror of
https://github.com/grafana/grafana.git
synced 2025-07-29 12:22:15 +08:00
edb0865caa
* fix helper + amend tests * fix import + remove unused var * remove more users * remove unused code * update test comment
95 lines
2.3 KiB
Go
95 lines
2.3 KiB
Go
//go:build enterprise
|
|
// +build enterprise
|
|
|
|
package encryption
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"fmt"
|
|
"hash/fnv"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/grafana/grafana/pkg/infra/db"
|
|
"github.com/grafana/grafana/pkg/server"
|
|
)
|
|
|
|
func TestIntegration_AdminApiReencrypt_Enterprise(t *testing.T) {
|
|
getSecretsFunctions := map[string]func(*testing.T, *server.TestEnv) map[int]secret{}
|
|
getSecretsFunctions["settings"] = func(t *testing.T, env *server.TestEnv) map[int]secret {
|
|
return getSettingSecrets(t, env.SQLStore)
|
|
}
|
|
|
|
setup := func(t *testing.T, env *server.TestEnv, grafanaListenAddr string) {
|
|
addSetting(t, grafanaListenAddr)
|
|
}
|
|
|
|
RunAdminApiReencryptTest(t, setup, getSecretsFunctions)
|
|
}
|
|
|
|
func addSetting(t *testing.T, grafanaListenAddr string) {
|
|
body := `
|
|
{
|
|
"updates": {
|
|
"auth.saml": {
|
|
"enabled": "true",
|
|
"single_logout": "false"
|
|
}
|
|
}
|
|
}
|
|
`
|
|
|
|
url := fmt.Sprintf("http://admin:admin@%s/api/admin/settings", grafanaListenAddr)
|
|
|
|
req, err := http.NewRequest("PUT", url, strings.NewReader(body))
|
|
require.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
resp, err := http.DefaultClient.Do(req)
|
|
require.NoError(t, err)
|
|
require.NoError(t, resp.Body.Close())
|
|
require.Equal(t, http.StatusOK, resp.StatusCode)
|
|
}
|
|
|
|
func getSettingSecrets(t *testing.T, store db.DB) map[int]secret {
|
|
var rows []struct {
|
|
Section string
|
|
Key string
|
|
EncryptedValue string
|
|
}
|
|
|
|
err := store.WithDbSession(t.Context(), func(sess *db.Session) error {
|
|
cols := []string{
|
|
store.GetDialect().Quote("section"),
|
|
store.GetDialect().Quote("key"),
|
|
store.GetDialect().Quote("encrypted_value"),
|
|
}
|
|
// Quote all column names. In practice, only `key` needs to be quoted in MySQL, but we quote all to be safe.
|
|
return sess.Table("setting").Select(strings.Join(cols, ", ")).Find(&rows)
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
result := map[int]secret{}
|
|
for _, r := range rows {
|
|
d, err := base64.StdEncoding.DecodeString(r.EncryptedValue)
|
|
require.NoError(t, err)
|
|
|
|
// we don't care about hash collisions, as long as we use the same ordering, we check the same values.
|
|
id := int(hash(r.Section + ":" + r.Key))
|
|
result[id] = secret{
|
|
id: id,
|
|
secret: d,
|
|
// no update time
|
|
}
|
|
}
|
|
return result
|
|
}
|
|
|
|
func hash(s string) uint32 {
|
|
h := fnv.New32a()
|
|
_, _ = h.Write([]byte(s))
|
|
return h.Sum32()
|
|
}
|