Alerting: handle folder permissions when fine-grained access enabled (#47035)

* Use alert:create action for folder search with edit permissions. This matches the action that is used to query dashboards (the update will be addressed later)
* Update rule store to use FindDashboards instead of folder service to list folders the user has access to view alerts. Folder service does not support query type and additional filters. 
* Do not check whether the user can save to folder if FGAC is enabled because it is checked on API level.

pkg/services/sqlstore/permissions/dashboard.go

@@ -91,7 +91,7 @@ func NewAccessControlDashboardPermissionFilter(user *models.SignedInUser, permis
 	if queryType == searchstore.TypeAlertFolder {
 		folderActions = append(folderActions, accesscontrol.ActionAlertingRuleRead)
 		if needEdit {
-			folderActions = append(folderActions, accesscontrol.ActionAlertingRuleUpdate)
+			folderActions = append(folderActions, accesscontrol.ActionAlertingRuleCreate)
 		}
 	} else {
 		dashboardActions = append(dashboardActions, accesscontrol.ActionDashboardsRead)

pkg/services/sqlstore/permissions/dashboard_test.go

@@ -29,7 +29,7 @@ func TestNewAccessControlDashboardPermissionFilter(t *testing.T) {
 			expectedFolderActions: []string{
 				dashboards.ActionFoldersRead,
 				accesscontrol.ActionAlertingRuleRead,
-				accesscontrol.ActionAlertingRuleUpdate,
+				accesscontrol.ActionAlertingRuleCreate,
 			},
 		},
 		{
@@ -39,7 +39,7 @@ func TestNewAccessControlDashboardPermissionFilter(t *testing.T) {
 			expectedFolderActions: []string{
 				dashboards.ActionFoldersRead,
 				accesscontrol.ActionAlertingRuleRead,
-				accesscontrol.ActionAlertingRuleUpdate,
+				accesscontrol.ActionAlertingRuleCreate,
 			},
 		},
 		{

pkg/services/sqlstore/searchstore/filters.go

@@ -149,3 +149,13 @@ func sqlIDin(column string, ids []int64) (string, []interface{}) {
 	}
 	return fmt.Sprintf("%s IN %s", column, sqlArray), params
 }
+
+// FolderWithAlertsFilter applies a filter that makes the result contain only folders that contain alert rules
+type FolderWithAlertsFilter struct {
+}
+
+var _ FilterWhere = &FolderWithAlertsFilter{}
+
+func (f FolderWithAlertsFilter) Where() (string, []interface{}) {
+	return "EXISTS (SELECT 1 FROM alert_rule WHERE alert_rule.namespace_uid = dashboard.uid)", nil
+}