Alerting: Reject receiver update in config API when FlagAlertingApiServer enabled (#93300)

* Reject receiver update in config API when FlagAlertingApiServer enabled

pkg/services/ngalert/api/api_alertmanager.go

@@ -15,6 +15,7 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	apimodels "github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
 	"github.com/grafana/grafana/pkg/services/ngalert/notifier"
 	"github.com/grafana/grafana/pkg/services/ngalert/store"
@@ -28,11 +29,12 @@ const (
 )
 
 type AlertmanagerSrv struct {
-	log        log.Logger
-	ac         accesscontrol.AccessControl
-	mam        *notifier.MultiOrgAlertmanager
-	crypto     notifier.Crypto
-	silenceSvc SilenceService
+	log            log.Logger
+	ac             accesscontrol.AccessControl
+	mam            *notifier.MultiOrgAlertmanager
+	crypto         notifier.Crypto
+	silenceSvc     SilenceService
+	featureManager featuremgmt.FeatureToggles
 }
 
 type UnknownReceiverError struct {
@@ -195,6 +197,18 @@ func (srv AlertmanagerSrv) RoutePostAlertingConfig(c *contextmodel.ReqContext, b
 			return ErrResp(http.StatusBadRequest, err, "")
 		}
 	}
+	if srv.featureManager.IsEnabled(c.Req.Context(), featuremgmt.FlagAlertingApiServer) {
+		if err != nil {
+			// Unclear if returning an error here is the right thing to do, preventing the user from posting a new config
+			// when the current one is legitimately invalid is not optimal, but we need to ensure receiver
+			// permissions are maintained and prevent potential access control bypasses. The workaround is to use the
+			// various new k8s API endpoints to fix the configuration.
+			return ErrResp(http.StatusInternalServerError, err, "")
+		}
+		if err := srv.k8sApiServiceGuard(currentConfig, body); err != nil {
+			return ErrResp(http.StatusBadRequest, err, "")
+		}
+	}
 	err = srv.mam.SaveAndApplyAlertmanagerConfiguration(c.Req.Context(), c.SignedInUser.GetOrgID(), body)
 	if err == nil {
 		return response.JSON(http.StatusAccepted, util.DynMap{"message": "configuration created"})