Alerting: Receiver API complete core implementation (#91738)

* Replace global authz abstraction with one compatible with uid scope

* Replace GettableApiReceiver with models.Receiver in receiver_svc

* GrafanaIntegrationConfig -> models.Integration

* Implement Create/Update methods

* Add optimistic concurrency to receiver API

* Add scope to ReceiversRead & ReceiversReadSecrets

migrates existing permissions to include implicit global scope

* Add receiver create, update, delete actions

* Check if receiver is used by rules before delete

* On receiver name change update in routes and notification settings

* Improve errors

* Linting

* Include read permissions are requirements for create/update/delete

* Alias ngalert/models to ngmodels to differentiate from v0alpha1 model

* Ensure integration UIDs are valid, unique, and generated if empty

* Validate integration settings on create/update

* Leverage UidToName to GetReceiver instead of GetReceivers

* Remove some unnecessary uses of simplejson

* alerting.notifications.receiver -> alerting.notifications.receivers

* validator -> provenanceValidator

* Only validate the modified receiver

stops existing invalid receivers from preventing modification of a valid
receiver.

* Improve error in Integration.Encrypt

* Remove scope from alert.notifications.receivers:create

* Add todos for receiver renaming

* Use receiverAC precondition checks in k8s api

* Linting

* Optional optimistic concurrency for delete

* make update-workspace

* More specific auth checks in k8s authorize.go

* Add debug log when delete optimistic concurrency is skipped

* Improve error message on authorizer.DecisionDeny

* Keep error for non-forbidden errutil errors

pkg/services/sqlstore/migrations/ualert/receiver_scope_mig.go

@@ -0,0 +1,49 @@
+package ualert
+
+import (
+	"xorm.io/xorm"
+
+	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
+)
+
+const (
+	AlertingAddReceiverActionScopes = "Add scope to alert.notifications.receivers:read and alert.notifications.receivers.secrets:read"
+)
+
+// AddReceiverActionScopesMigration is a migration that will add scopes to alert.notifications.receivers:read and
+// alert.notifications.receivers.secrets:read actions.
+// Originally, they were created without any scope, but treated as if all actions were globally scoped.
+// With the introduction of receiver FGAC, we need to scope these actions to UID so any existing roles should be updated
+// to explicitly have the global scope.
+func AddReceiverActionScopesMigration(mg *migrator.Migrator) {
+	mg.AddMigration(AlertingAddReceiverActionScopes, &addReceiverActionScopesMigrator{})
+}
+
+var _ migrator.CodeMigration = (*addReceiverActionScopesMigrator)(nil)
+
+type addReceiverActionScopesMigrator struct {
+	migrator.MigrationBase
+}
+
+func (p addReceiverActionScopesMigrator) SQL(migrator.Dialect) string {
+	return codeMigration
+}
+
+func (p addReceiverActionScopesMigrator) Exec(sess *xorm.Session, migrator *migrator.Migrator) error {
+	// Vendored.
+	actionAlertingReceiversRead := "alert.notifications.receivers:read"
+	actionAlertingReceiversReadSecrets := "alert.notifications.receivers.secrets:read"
+
+	_, err := sess.Exec("UPDATE permission SET `scope` = 'receivers:*', `kind` = 'receivers', `attribute` = '*', `identifier` = '*' WHERE action = ?", actionAlertingReceiversRead)
+	if err != nil {
+		migrator.Logger.Error("Failed to update permissions for action", "action", actionAlertingReceiversRead, "error", err)
+		return err
+	}
+
+	_, err = sess.Exec("UPDATE permission SET `scope` = 'receivers:*', `kind` = 'receivers', `attribute` = '*', `identifier` = '*' WHERE action = ?", actionAlertingReceiversReadSecrets)
+	if err != nil {
+		migrator.Logger.Error("Failed to update permissions for action", "action", actionAlertingReceiversReadSecrets, "error", err)
+		return err
+	}
+	return nil
+}