CloudMigrations: Add test case for invalid permissions to fetch contact points (#106143)

pkg/services/cloudmigration/cloudmigrationimpl/snapshot_mgmt_alerts_test.go

@@ -4,15 +4,19 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/http"
 	"testing"
 	"time"
 
+	"github.com/grafana/alerting/definition"
 	"github.com/prometheus/alertmanager/pkg/labels"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/alerting/definition"
+	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/dashboards"
+	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	ac "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
@@ -21,6 +25,15 @@ import (
 	"github.com/grafana/grafana/pkg/setting"
 )
 
+// Read-only.
+var alertRulesPermissions = map[string][]string{
+	accesscontrol.ActionAlertingRuleRead:   {"*"},
+	accesscontrol.ActionAlertingRuleCreate: {"*"},
+	accesscontrol.ActionAlertingRuleUpdate: {"*"},
+	dashboards.ActionFoldersRead:           {"*"},
+	datasources.ActionQuery:                {"*"},
+}
+
 func TestGetAlertMuteTimings(t *testing.T) {
 	t.Parallel()
 
@@ -98,6 +111,28 @@ func TestGetContactPoints(t *testing.T) {
 		require.NotNil(t, contactPoints)
 		require.Len(t, contactPoints, len(createdContactPoints)+defaultEmailContactPointCount)
 	})
+
+	t.Run("it returns an error when user lacks permission to read contact point secrets", func(t *testing.T) {
+		t.Parallel()
+
+		s := setUpServiceTest(t, false).(*Service)
+
+		user := &user.SignedInUser{
+			OrgID: 1,
+			Permissions: map[int64]map[string][]string{
+				1: {
+					accesscontrol.ActionAlertingNotificationsRead: nil,
+				},
+			},
+		}
+
+		contactPoints, err := s.getContactPoints(ctx, user)
+		require.Nil(t, contactPoints)
+
+		gfErr := errutil.Error{}
+		require.ErrorAs(t, err, &gfErr)
+		require.Equal(t, http.StatusForbidden, gfErr.Reason.Status().HTTPStatus())
+	})
 }
 
 func TestGetNotificationPolicies(t *testing.T) {
@@ -139,7 +174,7 @@ func TestGetAlertRules(t *testing.T) {
 
 		s := setUpServiceTest(t, false).(*Service)
 
-		user := &user.SignedInUser{OrgID: 1}
+		user := &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: alertRulesPermissions}}
 
 		alertRule := createAlertRule(t, ctx, s, user, false, "")
 
@@ -158,7 +193,7 @@ func TestGetAlertRules(t *testing.T) {
 
 		s := setUpServiceTest(t, false, alertRulesState).(*Service)
 
-		user := &user.SignedInUser{OrgID: 1}
+		user := &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: alertRulesPermissions}}
 
 		alertRulePaused := createAlertRule(t, ctx, s, user, true, "")
 		require.True(t, alertRulePaused.IsPaused)
@@ -185,7 +220,7 @@ func TestGetAlertRuleGroups(t *testing.T) {
 
 		s := setUpServiceTest(t, false).(*Service)
 
-		user := &user.SignedInUser{OrgID: 1}
+		user := &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: alertRulesPermissions}}
 
 		ruleGroupTitle := "ruleGroupTitle"
 
@@ -224,7 +259,7 @@ func TestGetAlertRuleGroups(t *testing.T) {
 
 		s := setUpServiceTest(t, false, alertRulesState).(*Service)
 
-		user := &user.SignedInUser{OrgID: 1}
+		user := &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: alertRulesPermissions}}
 
 		ruleGroupTitle := "ruleGroupTitle"