mirror of https://github.com/grafana/grafana
Plugins: Forward user header (X-Grafana-User) in backend plugin requests (#58646)
Grafana would forward the X-Grafana-User header to backend plugin request when dataproxy.send_user_header is enabled. In addition, X-Grafana-User will be automatically forwarded in outgoing HTTP requests for core/builtin HTTP datasources. Use grafana-plugin-sdk-go v0.147.0. Fixes #47734 Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>pull/60372/head^2
Marcus Efraimsson
3 years ago
committed by
GitHub
parent
ecf83a6df9
commit
6478d0a5ef
@ -0,0 +1,103 @@ |
||||
package clientmiddleware |
||||
|
||||
import ( |
||||
"context" |
||||
"net/http" |
||||
|
||||
"github.com/grafana/grafana-plugin-sdk-go/backend" |
||||
sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient" |
||||
"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider" |
||||
"github.com/grafana/grafana/pkg/plugins" |
||||
"github.com/grafana/grafana/pkg/services/contexthandler" |
||||
"github.com/grafana/grafana/pkg/util/proxyutil" |
||||
) |
||||
|
||||
// NewUserHeaderMiddleware creates a new plugins.ClientMiddleware that will
|
||||
// populate the X-Grafana-User header on outgoing plugins.Client and HTTP
|
||||
// requests.
|
||||
func NewUserHeaderMiddleware() plugins.ClientMiddleware { |
||||
return plugins.ClientMiddlewareFunc(func(next plugins.Client) plugins.Client { |
||||
return &UserHeaderMiddleware{ |
||||
next: next, |
||||
} |
||||
}) |
||||
} |
||||
|
||||
type UserHeaderMiddleware struct { |
||||
next plugins.Client |
||||
} |
||||
|
||||
func (m *UserHeaderMiddleware) applyToken(ctx context.Context, pCtx backend.PluginContext, h backend.ForwardHTTPHeaders) context.Context { |
||||
reqCtx := contexthandler.FromContext(ctx) |
||||
// if no HTTP request context skip middleware
|
||||
if h == nil || reqCtx == nil || reqCtx.Req == nil || reqCtx.SignedInUser == nil { |
||||
return ctx |
||||
} |
||||
|
||||
h.DeleteHTTPHeader(proxyutil.UserHeaderName) |
||||
if !reqCtx.IsAnonymous { |
||||
h.SetHTTPHeader(proxyutil.UserHeaderName, reqCtx.Login) |
||||
} |
||||
|
||||
middlewares := []sdkhttpclient.Middleware{} |
||||
|
||||
if !reqCtx.IsAnonymous { |
||||
httpHeaders := http.Header{ |
||||
proxyutil.UserHeaderName: []string{reqCtx.Login}, |
||||
} |
||||
|
||||
middlewares = append(middlewares, httpclientprovider.SetHeadersMiddleware(httpHeaders)) |
||||
} else { |
||||
middlewares = append(middlewares, httpclientprovider.DeleteHeadersMiddleware(proxyutil.UserHeaderName)) |
||||
} |
||||
|
||||
ctx = sdkhttpclient.WithContextualMiddleware(ctx, middlewares...) |
||||
|
||||
return ctx |
||||
} |
||||
|
||||
func (m *UserHeaderMiddleware) QueryData(ctx context.Context, req *backend.QueryDataRequest) (*backend.QueryDataResponse, error) { |
||||
if req == nil { |
||||
return m.next.QueryData(ctx, req) |
||||
} |
||||
|
||||
ctx = m.applyToken(ctx, req.PluginContext, req) |
||||
|
||||
return m.next.QueryData(ctx, req) |
||||
} |
||||
|
||||
func (m *UserHeaderMiddleware) CallResource(ctx context.Context, req *backend.CallResourceRequest, sender backend.CallResourceResponseSender) error { |
||||
if req == nil { |
||||
return m.next.CallResource(ctx, req, sender) |
||||
} |
||||
|
||||
ctx = m.applyToken(ctx, req.PluginContext, req) |
||||
|
||||
return m.next.CallResource(ctx, req, sender) |
||||
} |
||||
|
||||
func (m *UserHeaderMiddleware) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) { |
||||
if req == nil { |
||||
return m.next.CheckHealth(ctx, req) |
||||
} |
||||
|
||||
ctx = m.applyToken(ctx, req.PluginContext, req) |
||||
|
||||
return m.next.CheckHealth(ctx, req) |
||||
} |
||||
|
||||
func (m *UserHeaderMiddleware) CollectMetrics(ctx context.Context, req *backend.CollectMetricsRequest) (*backend.CollectMetricsResult, error) { |
||||
return m.next.CollectMetrics(ctx, req) |
||||
} |
||||
|
||||
func (m *UserHeaderMiddleware) SubscribeStream(ctx context.Context, req *backend.SubscribeStreamRequest) (*backend.SubscribeStreamResponse, error) { |
||||
return m.next.SubscribeStream(ctx, req) |
||||
} |
||||
|
||||
func (m *UserHeaderMiddleware) PublishStream(ctx context.Context, req *backend.PublishStreamRequest) (*backend.PublishStreamResponse, error) { |
||||
return m.next.PublishStream(ctx, req) |
||||
} |
||||
|
||||
func (m *UserHeaderMiddleware) RunStream(ctx context.Context, req *backend.RunStreamRequest, sender *backend.StreamSender) error { |
||||
return m.next.RunStream(ctx, req, sender) |
||||
} |
||||
@ -0,0 +1,254 @@ |
||||
package clientmiddleware |
||||
|
||||
import ( |
||||
"net/http" |
||||
"testing" |
||||
|
||||
"github.com/grafana/grafana-plugin-sdk-go/backend" |
||||
"github.com/grafana/grafana-plugin-sdk-go/backend/httpclient" |
||||
"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider" |
||||
"github.com/grafana/grafana/pkg/plugins/manager/client/clienttest" |
||||
"github.com/grafana/grafana/pkg/services/user" |
||||
"github.com/grafana/grafana/pkg/util/proxyutil" |
||||
"github.com/stretchr/testify/require" |
||||
) |
||||
|
||||
func TestUserHeaderMiddleware(t *testing.T) { |
||||
t.Run("When anononymous user in reqContext", func(t *testing.T) { |
||||
req, err := http.NewRequest(http.MethodGet, "/some/thing", nil) |
||||
require.NoError(t, err) |
||||
|
||||
t.Run("And requests are for a datasource", func(t *testing.T) { |
||||
cdt := clienttest.NewClientDecoratorTest(t, |
||||
clienttest.WithReqContext(req, &user.SignedInUser{ |
||||
IsAnonymous: true, |
||||
Login: "anonymous"}, |
||||
), |
||||
clienttest.WithMiddlewares(NewUserHeaderMiddleware()), |
||||
) |
||||
|
||||
pluginCtx := backend.PluginContext{ |
||||
DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{}, |
||||
} |
||||
|
||||
t.Run("Should not forward user header when calling QueryData", func(t *testing.T) { |
||||
_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string]string{}, |
||||
}) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.QueryDataReq) |
||||
require.Empty(t, cdt.QueryDataReq.Headers) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
|
||||
t.Run("Should not forward user header when calling CallResource", func(t *testing.T) { |
||||
err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string][]string{}, |
||||
}, nopCallResourceSender) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.CallResourceReq) |
||||
require.Empty(t, cdt.CallResourceReq.Headers) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
|
||||
t.Run("Should not forward user header when calling CheckHealth", func(t *testing.T) { |
||||
_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string]string{}, |
||||
}) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.CheckHealthReq) |
||||
require.Empty(t, cdt.CheckHealthReq.Headers) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
}) |
||||
|
||||
t.Run("And requests are for an app", func(t *testing.T) { |
||||
cdt := clienttest.NewClientDecoratorTest(t, |
||||
clienttest.WithReqContext(req, &user.SignedInUser{ |
||||
IsAnonymous: true, |
||||
Login: "anonymous"}, |
||||
), |
||||
clienttest.WithMiddlewares(NewUserHeaderMiddleware()), |
||||
) |
||||
|
||||
pluginCtx := backend.PluginContext{ |
||||
AppInstanceSettings: &backend.AppInstanceSettings{}, |
||||
} |
||||
|
||||
t.Run("Should not forward user header when calling QueryData", func(t *testing.T) { |
||||
_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string]string{}, |
||||
}) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.QueryDataReq) |
||||
require.Empty(t, cdt.QueryDataReq.Headers) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
|
||||
t.Run("Should not forward user header when calling CallResource", func(t *testing.T) { |
||||
err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string][]string{}, |
||||
}, nopCallResourceSender) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.CallResourceReq) |
||||
require.Empty(t, cdt.CallResourceReq.Headers) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
|
||||
t.Run("Should not forward user header when calling CheckHealth", func(t *testing.T) { |
||||
_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string]string{}, |
||||
}) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.CheckHealthReq) |
||||
require.Empty(t, cdt.CheckHealthReq.Headers) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
}) |
||||
}) |
||||
|
||||
t.Run("When real user in reqContext", func(t *testing.T) { |
||||
req, err := http.NewRequest(http.MethodGet, "/some/thing", nil) |
||||
require.NoError(t, err) |
||||
|
||||
t.Run("And requests are for a datasource", func(t *testing.T) { |
||||
cdt := clienttest.NewClientDecoratorTest(t, |
||||
clienttest.WithReqContext(req, &user.SignedInUser{ |
||||
Login: "admin", |
||||
}), |
||||
clienttest.WithMiddlewares(NewUserHeaderMiddleware()), |
||||
) |
||||
|
||||
pluginCtx := backend.PluginContext{ |
||||
DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{}, |
||||
} |
||||
|
||||
t.Run("Should forward user header when calling QueryData", func(t *testing.T) { |
||||
_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string]string{}, |
||||
}) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.QueryDataReq) |
||||
require.Len(t, cdt.QueryDataReq.Headers, 1) |
||||
require.Equal(t, "admin", cdt.QueryDataReq.GetHTTPHeader(proxyutil.UserHeaderName)) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
|
||||
t.Run("Should forward user header when calling CallResource", func(t *testing.T) { |
||||
err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string][]string{}, |
||||
}, nopCallResourceSender) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.CallResourceReq) |
||||
require.Len(t, cdt.CallResourceReq.Headers, 1) |
||||
require.Equal(t, "admin", cdt.CallResourceReq.GetHTTPHeader(proxyutil.UserHeaderName)) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
|
||||
t.Run("Should forward user header when calling CheckHealth", func(t *testing.T) { |
||||
_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string]string{}, |
||||
}) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.CheckHealthReq) |
||||
require.Len(t, cdt.CheckHealthReq.Headers, 1) |
||||
require.Equal(t, "admin", cdt.CheckHealthReq.GetHTTPHeader(proxyutil.UserHeaderName)) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
}) |
||||
|
||||
t.Run("And requests are for an app", func(t *testing.T) { |
||||
cdt := clienttest.NewClientDecoratorTest(t, |
||||
clienttest.WithReqContext(req, &user.SignedInUser{ |
||||
Login: "admin", |
||||
}), |
||||
clienttest.WithMiddlewares(NewUserHeaderMiddleware()), |
||||
) |
||||
|
||||
pluginCtx := backend.PluginContext{ |
||||
AppInstanceSettings: &backend.AppInstanceSettings{}, |
||||
} |
||||
|
||||
t.Run("Should forward user header when calling QueryData", func(t *testing.T) { |
||||
_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string]string{}, |
||||
}) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.QueryDataReq) |
||||
require.Len(t, cdt.QueryDataReq.Headers, 1) |
||||
require.Equal(t, "admin", cdt.QueryDataReq.GetHTTPHeader(proxyutil.UserHeaderName)) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
|
||||
t.Run("Should forward user header when calling CallResource", func(t *testing.T) { |
||||
err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string][]string{}, |
||||
}, nopCallResourceSender) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.CallResourceReq) |
||||
require.Len(t, cdt.CallResourceReq.Headers, 1) |
||||
require.Equal(t, "admin", cdt.CallResourceReq.GetHTTPHeader(proxyutil.UserHeaderName)) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
|
||||
t.Run("Should forward user header when calling CheckHealth", func(t *testing.T) { |
||||
_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{ |
||||
PluginContext: pluginCtx, |
||||
Headers: map[string]string{}, |
||||
}) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, cdt.CheckHealthReq) |
||||
require.Len(t, cdt.CheckHealthReq.Headers, 1) |
||||
require.Equal(t, "admin", cdt.CheckHealthReq.GetHTTPHeader(proxyutil.UserHeaderName)) |
||||
|
||||
middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx) |
||||
require.Len(t, middlewares, 1) |
||||
require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName()) |
||||
}) |
||||
}) |
||||
}) |
||||
} |
||||
Loading…
Reference in new issue