[release-11.0.12] Alerting: Provisioning API returns 403 on quota exceeded for rule group PUT (#106480)

* Alerting: Provisioning API returns 403 on quota exceeded for rule group PUT (#106409)

(cherry picked from commit 1df888c517)

* fix test

pkg/services/ngalert/api/api_provisioning.go

@@ -492,6 +492,9 @@ func (srv *ProvisioningSrv) RoutePutAlertRuleGroup(c *contextmodel.ReqContext, a
 		if errors.Is(err, store.ErrOptimisticLock) {
 			return ErrResp(http.StatusConflict, err, "")
 		}
+		if errors.Is(err, alerting_models.ErrQuotaReached) {
+			return ErrResp(http.StatusForbidden, err, "")
+		}
 		return response.ErrOrFallback(http.StatusInternalServerError, "", err)
 	}
 	return response.JSON(http.StatusOK, ag)

pkg/services/ngalert/api/api_provisioning_test.go

@@ -447,6 +447,27 @@ func TestProvisioningApi(t *testing.T) {
 		})
 	})
 
+	t.Run("have reached the rule quota, PUT returns 403", func(t *testing.T) {
+		env := createTestEnv(t, testConfig)
+		quotas := provisioning.MockQuotaChecker{}
+		quotas.EXPECT().LimitExceeded()
+		env.quotas = &quotas
+		sut := createProvisioningSrvSutFromEnv(t, &env)
+		group := definitions.AlertRuleGroup{
+			Title:    "test rule group",
+			Interval: 60,
+			Rules: []definitions.ProvisionedAlertRule{
+				createTestAlertRule("test-alert-rule", 1),
+			},
+		}
+		group.Rules[0].UID = "" // The rule is only created if UID is empty.
+		rc := createTestRequestCtx()
+
+		response := sut.RoutePutAlertRuleGroup(&rc, group, "folder-uid", group.Title)
+
+		require.Equal(t, 403, response.Status())
+	})
+
 	t.Run("exports", func(t *testing.T) {
 		t.Run("alert rule group", func(t *testing.T) {
 			t.Run("are present, GET returns 200", func(t *testing.T) {