Alerting: validate condition before updating rulegroup (#33367)

* Alerting: validate condition before updating rulegroup

* Apply suggestions from code review

pkg/services/ngalert/api/api_ruler.go

@@ -2,9 +2,11 @@ package api
 
 import (
 	"errors"
+	"fmt"
 	"net/http"
 	"time"
 
+	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/ngalert/store"
 
 	coreapi "github.com/grafana/grafana/pkg/api"
@@ -18,8 +20,9 @@ import (
 )
 
 type RulerSrv struct {
-	store store.RuleStore
-	log   log.Logger
+	store           store.RuleStore
+	DatasourceCache datasources.CacheService
+	log             log.Logger
 }
 
 func (srv RulerSrv) RouteDeleteNamespaceRulesConfig(c *models.ReqContext) response.Response {
@@ -196,6 +199,17 @@ func (srv RulerSrv) RoutePostNameRulesConfig(c *models.ReqContext, ruleGroupConf
 		return response.Error(http.StatusBadRequest, "rule group name is not valid", nil)
 	}
 
+	for _, r := range ruleGroupConfig.Rules {
+		cond := ngmodels.Condition{
+			Condition: r.GrafanaManagedAlert.Condition,
+			OrgID:     c.SignedInUser.OrgId,
+			Data:      r.GrafanaManagedAlert.Data,
+		}
+		if err := validateCondition(cond, c.SignedInUser, c.SkipCache, srv.DatasourceCache); err != nil {
+			return response.Error(http.StatusBadRequest, fmt.Sprintf("failed to validate alert rule %s", r.GrafanaManagedAlert.Title), err)
+		}
+	}
+
 	if err := srv.store.UpdateRuleGroup(store.UpdateRuleGroupCmd{
 		OrgID:           c.SignedInUser.OrgId,
 		NamespaceUID:    namespace.Uid,