From 003dc7763721f09c7daa6001e39be89ddcbfc2a5 Mon Sep 17 00:00:00 2001
From: Vadim Stepanov <vstpme@gmail.com>
Date: Tue, 10 Jun 2025 15:21:38 +0100
Subject: [PATCH] [release-11.3.8] Alerting: Provisioning API returns 403 on
 quota exceeded for rule group PUT (#106483)

Alerting: Provisioning API returns 403 on quota exceeded for rule group PUT (#106409)

(cherry picked from commit 1df888c51778ad3c02497d98d521435d990516ea)
---
 pkg/services/ngalert/api/api_provisioning.go  |  3 +++
 .../ngalert/api/api_provisioning_test.go      | 21 +++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/pkg/services/ngalert/api/api_provisioning.go b/pkg/services/ngalert/api/api_provisioning.go
index f22cf445ce5..8e19bbce87b 100644
--- a/pkg/services/ngalert/api/api_provisioning.go
+++ b/pkg/services/ngalert/api/api_provisioning.go
@@ -513,6 +513,9 @@ func (srv *ProvisioningSrv) RoutePutAlertRuleGroup(c *contextmodel.ReqContext, a
 	if errors.Is(err, store.ErrOptimisticLock) {
 		return ErrResp(http.StatusConflict, err, "")
 	}
+	if errors.Is(err, alerting_models.ErrQuotaReached) {
+		return ErrResp(http.StatusForbidden, err, "")
+	}
 	if err != nil {
 		return response.ErrOrFallback(http.StatusInternalServerError, "", err)
 	}
diff --git a/pkg/services/ngalert/api/api_provisioning_test.go b/pkg/services/ngalert/api/api_provisioning_test.go
index e6747915ae6..603e7222835 100644
--- a/pkg/services/ngalert/api/api_provisioning_test.go
+++ b/pkg/services/ngalert/api/api_provisioning_test.go
@@ -573,6 +573,27 @@ func TestProvisioningApi(t *testing.T) {
 		})
 	})
 
+	t.Run("have reached the rule quota, PUT returns 403", func(t *testing.T) {
+		env := createTestEnv(t, testConfig)
+		quotas := provisioning.MockQuotaChecker{}
+		quotas.EXPECT().LimitExceeded()
+		env.quotas = &quotas
+		sut := createProvisioningSrvSutFromEnv(t, &env)
+		group := definitions.AlertRuleGroup{
+			Title:    "test rule group",
+			Interval: 60,
+			Rules: []definitions.ProvisionedAlertRule{
+				createTestAlertRule("test-alert-rule", 1),
+			},
+		}
+		group.Rules[0].UID = "" // The rule is only created if UID is empty.
+		rc := createTestRequestCtx()
+
+		response := sut.RoutePutAlertRuleGroup(&rc, group, "folder-uid", group.Title)
+
+		require.Equal(t, 403, response.Status())
+	})
+
 	t.Run("exports", func(t *testing.T) {
 		t.Run("alert rule group", func(t *testing.T) {
 			t.Run("are present, GET returns 200", func(t *testing.T) {