Alerting: Fix fine-grained rule access control to use 403 for authorization error (#79239)

* use 403 for authorization error
* update silences API
* add ForbiddenError to rule API responses

pkg/services/ngalert/api/api_alertmanager.go

@@ -16,6 +16,7 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
+	authz "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
 	apimodels "github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
 	"github.com/grafana/grafana/pkg/services/ngalert/notifier"
 	"github.com/grafana/grafana/pkg/services/ngalert/store"
@@ -67,12 +68,13 @@ func (srv AlertmanagerSrv) RouteCreateSilence(c *contextmodel.ReqContext, postab
 	if postableSilence.ID == "" {
 		action = accesscontrol.ActionAlertingInstanceCreate
 	}
-	if !accesscontrol.HasAccess(srv.ac, c)(accesscontrol.EvalPermission(action)) {
+	evaluator := accesscontrol.EvalPermission(action)
+	if !accesscontrol.HasAccess(srv.ac, c)(evaluator) {
 		errAction := "update"
 		if postableSilence.ID == "" {
 			errAction = "create"
 		}
-		return ErrResp(http.StatusUnauthorized, fmt.Errorf("user is not authorized to %s silences", errAction), "")
+		return response.Err(authz.NewAuthorizationErrorWithPermissions(fmt.Sprintf("%s silences", errAction), evaluator))
 	}
 
 	silenceID, err := am.CreateSilence(c.Req.Context(), &postableSilence)