Alerting: Add file provisioning for alert rules (#51635)

pkg/api/accesscontrol.go

@@ -31,6 +31,7 @@ var (
 	ScopeProvisionersPlugins       = ac.Scope("provisioners", "plugins")
 	ScopeProvisionersDatasources   = ac.Scope("provisioners", "datasources")
 	ScopeProvisionersNotifications = ac.Scope("provisioners", "notifications")
+	ScopeProvisionersAlertRules    = ac.Scope("provisioners", "alerting")
 )
 
 // declareFixedRoles declares to the AccessControl service fixed roles and their

pkg/api/admin_provisioning.go

@@ -39,3 +39,11 @@ func (hs *HTTPServer) AdminProvisioningReloadNotifications(c *models.ReqContext)
 	}
 	return response.Success("Notifications config reloaded")
 }
+
+func (hs *HTTPServer) AdminProvisioningReloadAlerting(c *models.ReqContext) response.Response {
+	err := hs.ProvisioningService.ProvisionAlertRules(c.Req.Context())
+	if err != nil {
+		return response.Error(500, "", err)
+	}
+	return response.Success("Alerting config reloaded")
+}

pkg/api/admin_provisioning_test.go

@@ -135,6 +135,33 @@ func TestAPI_AdminProvisioningReload_AccessControl(t *testing.T) {
 			url:          "/api/admin/provisioning/plugins/reload",
 			exit:         true,
 		},
+		{
+			desc:         "should fail for alerting with no permission",
+			expectedCode: http.StatusForbidden,
+			url:          "/api/admin/provisioning/alerting/reload",
+			exit:         true,
+		},
+		{
+			desc:         "should work for alert rules with specific scope",
+			expectedCode: http.StatusOK,
+			expectedBody: `{"message":"Alerting config reloaded"}`,
+			permissions: []accesscontrol.Permission{
+				{
+					Action: ActionProvisioningReload,
+					Scope:  ScopeProvisionersAlertRules,
+				},
+			},
+			url: "/api/admin/provisioning/alerting/reload",
+			checkCall: func(mock provisioning.ProvisioningServiceMock) {
+				assert.Len(t, mock.Calls.ProvisionAlertRules, 1)
+			},
+		},
+		{
+			desc:         "should fail for alerting with no permission",
+			expectedCode: http.StatusForbidden,
+			url:          "/api/admin/provisioning/alerting/reload",
+			exit:         true,
+		},
 	}
 
 	cfg := setting.NewCfg()

pkg/api/api.go

@@ -576,6 +576,7 @@ func (hs *HTTPServer) registerRoutes() {
 		adminRoute.Post("/provisioning/plugins/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ActionProvisioningReload, ScopeProvisionersPlugins)), routing.Wrap(hs.AdminProvisioningReloadPlugins))
 		adminRoute.Post("/provisioning/datasources/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ActionProvisioningReload, ScopeProvisionersDatasources)), routing.Wrap(hs.AdminProvisioningReloadDatasources))
 		adminRoute.Post("/provisioning/notifications/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ActionProvisioningReload, ScopeProvisionersNotifications)), routing.Wrap(hs.AdminProvisioningReloadNotifications))
+		adminRoute.Post("/provisioning/alerting/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ActionProvisioningReload, ScopeProvisionersAlertRules)), routing.Wrap(hs.AdminProvisioningReloadAlerting))
 
 		adminRoute.Post("/ldap/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionLDAPConfigReload)), routing.Wrap(hs.ReloadLDAPCfg))
 		adminRoute.Post("/ldap/sync/:id", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionLDAPUsersSync)), routing.Wrap(hs.PostSyncUserWithLDAP))