Alerting: update authorization logic to use proper legacy roles when fine-grained access is disabled (#46931)

* require legacy Editor for post, put, delete endpoints
* require user to be signed in on group level because handler that checks that user has role Editor does not check it is signed in

pkg/services/ngalert/api/api_alertmanager_test.go

@@ -6,6 +6,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/require"
+
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/models"
 	apimodels "github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
@@ -16,8 +19,6 @@ import (
 	secretsManager "github.com/grafana/grafana/pkg/services/secrets/manager"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/web"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/stretchr/testify/require"
 )
 
 func TestContextWithTimeoutFromRequest(t *testing.T) {
@@ -158,8 +159,7 @@ func TestAlertmanagerConfig(t *testing.T) {
 				Req: &http.Request{},
 			},
 			SignedInUser: &models.SignedInUser{
-				OrgRole: models.ROLE_EDITOR,
-				OrgId:   12,
+				OrgId: 12,
 			},
 		}
 		request := createAmConfigRequest(t)
@@ -170,32 +170,13 @@ func TestAlertmanagerConfig(t *testing.T) {
 		require.Contains(t, string(response.Body()), "Alertmanager does not exist for this organization")
 	})
 
-	t.Run("assert 403 Forbidden when applying config while not Editor", func(t *testing.T) {
-		rc := models.ReqContext{
-			Context: &web.Context{
-				Req: &http.Request{},
-			},
-			SignedInUser: &models.SignedInUser{
-				OrgRole: models.ROLE_VIEWER,
-				OrgId:   1,
-			},
-		}
-		request := createAmConfigRequest(t)
-
-		response := sut.RoutePostAlertingConfig(&rc, request)
-
-		require.Equal(t, 403, response.Status())
-		require.Contains(t, string(response.Body()), "permission denied")
-	})
-
 	t.Run("assert 202 when config successfully applied", func(t *testing.T) {
 		rc := models.ReqContext{
 			Context: &web.Context{
 				Req: &http.Request{},
 			},
 			SignedInUser: &models.SignedInUser{
-				OrgRole: models.ROLE_EDITOR,
-				OrgId:   1,
+				OrgId: 1,
 			},
 		}
 		request := createAmConfigRequest(t)
@@ -212,8 +193,7 @@ func TestAlertmanagerConfig(t *testing.T) {
 				Req: &http.Request{},
 			},
 			SignedInUser: &models.SignedInUser{
-				OrgRole: models.ROLE_EDITOR,
-				OrgId:   3, // Org 3 was initialized with broken config.
+				OrgId: 3, // Org 3 was initialized with broken config.
 			},
 		}
 		request := createAmConfigRequest(t)