[Alerting]: namespace fixes (#34470) (#34489)

* [Alerting]: forbid viewers for updating rules if viewers can edit

check for CanSave instead of CanEdit

* Clear ngalert tables when deleting the folder

* Apply suggestions from code review

* Log failure to check save permission

Co-authored-by: gotjosh <josue@grafana.com>
(cherry picked from commit 23939eab10)

Co-authored-by: Sofia Papagiannaki <papagian@users.noreply.github.com>

pkg/services/ngalert/ngalert.go

@@ -69,6 +69,7 @@ func (ng *AlertNG) Init() error {
 		BaseInterval:           baseInterval,
 		DefaultIntervalSeconds: defaultIntervalSeconds,
 		SQLStore:               ng.SQLStore,
+		Logger:                 ng.Log,
 	}
 
 	var err error

pkg/services/ngalert/notifier/alertmanager_test.go

@@ -9,6 +9,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/grafana/grafana/pkg/infra/log"
+
 	gokit_log "github.com/go-kit/kit/log"
 	"github.com/go-openapi/strfmt"
 	"github.com/prometheus/alertmanager/api/v2/models"
@@ -42,6 +44,7 @@ func setupAMTest(t *testing.T) *Alertmanager {
 		BaseInterval:           10 * time.Second,
 		DefaultIntervalSeconds: 60,
 		SQLStore:               sqlStore,
+		Logger:                 log.New("alertmanager-test"),
 	}
 
 	am, err := New(cfg, store, m)

pkg/services/ngalert/store/alert_rule.go

@@ -368,16 +368,19 @@ func (st DBstore) GetRuleGroupAlertRules(query *ngmodels.ListRuleGroupAlertRules
 }
 
 // GetNamespaceByTitle is a handler for retrieving a namespace by its title. Alerting rules follow a Grafana folder-like structure which we call namespaces.
-func (st DBstore) GetNamespaceByTitle(namespace string, orgID int64, user *models.SignedInUser, withEdit bool) (*models.Folder, error) {
+func (st DBstore) GetNamespaceByTitle(namespace string, orgID int64, user *models.SignedInUser, withCanSave bool) (*models.Folder, error) {
 	s := dashboards.NewFolderService(orgID, user, st.SQLStore)
 	folder, err := s.GetFolderByTitle(namespace)
 	if err != nil {
 		return nil, err
 	}
 
-	if withEdit {
+	if withCanSave {
 		g := guardian.New(folder.Id, orgID, user)
-		if canAdmin, err := g.CanEdit(); err != nil || !canAdmin {
+		if canSave, err := g.CanSave(); err != nil || !canSave {
+			if err != nil {
+				st.Logger.Error("checking can save permission has failed", "userId", user.UserId, "username", user.Login, "namespace", namespace, "orgId", orgID, "error", err)
+			}
 			return nil, ngmodels.ErrCannotEditNamespace
 		}
 	}

pkg/services/ngalert/store/database.go

@@ -3,8 +3,8 @@ package store
 import (
 	"time"
 
+	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/ngalert/models"
-
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 )
 
@@ -28,4 +28,5 @@ type DBstore struct {
 	// default alert definiiton interval
 	DefaultIntervalSeconds int64
 	SQLStore               *sqlstore.SQLStore
+	Logger                 log.Logger
 }

pkg/services/ngalert/tests/util.go

@@ -38,7 +38,11 @@ func SetupTestEnv(t *testing.T, baseIntervalSeconds int64) *store.DBstore {
 
 	err := ng.Init()
 	require.NoError(t, err)
-	return &store.DBstore{SQLStore: ng.SQLStore, BaseInterval: time.Duration(baseIntervalSeconds) * time.Second}
+	return &store.DBstore{
+		SQLStore:     ng.SQLStore,
+		BaseInterval: time.Duration(baseIntervalSeconds) * time.Second,
+		Logger:       log.New("ngalert-test"),
+	}
 }
 
 func overrideAlertNGInRegistry(t *testing.T, cfg *setting.Cfg) ngalert.AlertNG {

pkg/services/sqlstore/dashboard.go

@@ -465,6 +465,19 @@ func deleteDashboard(cmd *models.DeleteDashboardCommand, sess *DBSession) error
 				}
 			}
 		}
+
+		// clean ngalert tables
+		ngalertDeletes := []string{
+			"DELETE FROM alert_rule WHERE namespace_uid = (SELECT uid FROM dashboard WHERE id = ?)",
+			"DELETE FROM alert_rule_version WHERE rule_namespace_uid = (SELECT uid FROM dashboard WHERE id = ?)",
+		}
+
+		for _, sql := range ngalertDeletes {
+			_, err := sess.Exec(sql, dashboard.Id)
+			if err != nil {
+				return err
+			}
+		}
 	}
 
 	if err := deleteAlertDefinition(dashboard.Id, sess); err != nil {