[v8.5.x] Alerting: Fix access to alerts for viewer with editor permissions when RBAC is disabled (#49427)

* Alerting: Fix access to alerts for viewer with editor permissions when RBAC is disabled (#49270)

* Add folder edit permission for users with Viewer role
* relax permissions required to create an alert when RBAC is disabled

(cherry picked from commit 3dfafbadef)

* fix backend conflict

* fixup

Co-authored-by: Yuriy Tseretyan <yuriy.tseretyan@grafana.com>

pkg/services/ngalert/CHANGELOG.md

@@ -57,6 +57,7 @@ Scopes must have an order to ensure consistency and ease of search, this helps u
 - [BUGFIX] Migration: ignore alerts that do not belong to any existing organization\dashboard #49192
 - [BUGFIX] Allow anonymous access to alerts #49203 
 - [BUGFIX] RBAC: replace create\update\delete actions for notification policies by alert.notifications:write #49185
+- [BUGFIX] Fix access to alerts for Viewer role with editor permissions in folder #49270
 
 ## 8.5.3
 

pkg/services/ngalert/api/api_ruler.go

@@ -386,20 +386,21 @@ func (srv RulerSrv) updateAlertRulesInGroup(c *models.ReqContext, namespace *mod
 			return nil
 		}
 
-		authorizedChanges, err := authorizeRuleChanges(namespace, groupChanges, func(evaluator accesscontrol.Evaluator) bool {
-			return hasAccess(accesscontrol.ReqOrgAdminOrEditor, evaluator)
-		})
-		if err != nil {
-			return err
-		}
-
-		if authorizedChanges.isEmpty() {
-			logger.Info("no authorized changes detected in the request. Do nothing", "not_authorized_add", len(groupChanges.New), "not_authorized_update", len(groupChanges.Update), "not_authorized_delete", len(groupChanges.Delete))
-			return nil
-		}
-
-		if len(groupChanges.Delete) > len(authorizedChanges.Delete) {
-			logger.Info("user is not authorized to delete one or many rules in the group. those rules will be skipped", "expected", len(groupChanges.Delete), "authorized", len(authorizedChanges.Delete))
+		authorizedChanges := groupChanges // if RBAC is disabled the permission are limited to folder access that is done upstream
+		if !srv.ac.IsDisabled() {
+			authorizedChanges, err = authorizeRuleChanges(namespace, groupChanges, func(evaluator accesscontrol.Evaluator) bool {
+				return hasAccess(accesscontrol.ReqOrgAdminOrEditor, evaluator)
+			})
+			if err != nil {
+				return err
+			}
+			if authorizedChanges.isEmpty() {
+				logger.Info("no authorized changes detected in the request. Do nothing", "not_authorized_add", len(groupChanges.New), "not_authorized_update", len(groupChanges.Update), "not_authorized_delete", len(groupChanges.Delete))
+				return nil
+			}
+			if len(groupChanges.Delete) > len(authorizedChanges.Delete) {
+				logger.Info("user is not authorized to delete one or many rules in the group. those rules will be skipped", "expected", len(groupChanges.Delete), "authorized", len(authorizedChanges.Delete))
+			}
 		}
 
 		provenances, err := srv.provenanceStore.GetProvenances(c.Req.Context(), c.OrgId, (&ngmodels.AlertRule{}).ResourceType())

pkg/services/ngalert/api/authorization.go

@@ -52,6 +52,7 @@ func (api *API) authorize(method, path string) web.Handler {
 	case http.MethodGet + "/api/ruler/grafana/api/v1/rules":
 		eval = ac.EvalPermission(ac.ActionAlertingRuleRead)
 	case http.MethodPost + "/api/ruler/grafana/api/v1/rules/{Namespace}":
+		fallback = middleware.ReqSignedIn // if RBAC is disabled then we need to delegate permission check to folder because its permissions can allow editing for Viewer role
 		scope := dashboards.ScopeFoldersProvider.GetResourceScopeName(ac.Parameter(":Namespace"))
 		// more granular permissions are enforced by the handler via "authorizeRuleChanges"
 		eval = ac.EvalAny(

pkg/tests/api/alerting/api_alertmanager_test.go

@@ -611,7 +611,7 @@ func TestRulerAccess(t *testing.T) {
 			desc:             "viewer request should fail",
 			url:              "http://viewer:viewer@%s/api/ruler/grafana/api/v1/rules/default",
 			expStatus:        http.StatusForbidden,
-			expectedResponse: `{"message": "Permission denied"}`,
+			expectedResponse: `{"message":"user does not have permissions to edit the namespace: user does not have permissions to edit the namespace", "traceID":"00000000000000000000000000000000"}`,
 		},
 		{
 			desc:             "editor request should succeed",