Provisioning: Block Library Panel creation in provisioned folders (#114933)

* WIP: Block Library Panel creation in provisioned folders

* blocking patch - adding integration tests

* checking code in tests

* addressing comments, adding one more test

pkg/services/libraryelements/database.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/metrics"
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
@@ -125,6 +126,20 @@ func (l *LibraryElementService) CreateElement(c context.Context, signedInUser id
 		}
 	}
 
+	if cmd.FolderUID != nil {
+		f, err := l.folderService.Get(c, &folder.GetFolderQuery{
+			OrgID:        signedInUser.GetOrgID(),
+			UID:          cmd.FolderUID,
+			SignedInUser: signedInUser,
+		})
+		if err != nil {
+			return model.LibraryElementDTO{}, err
+		}
+		if f.ManagedBy == utils.ManagerKindRepo {
+			return model.LibraryElementDTO{}, model.ErrLibraryElementProvisionedFolder
+		}
+	}
+
 	updatedModel := cmd.Model
 	var err error
 	if cmd.Kind == int64(model.PanelElement) {
@@ -601,6 +616,21 @@ func (l *LibraryElementService) PatchLibraryElement(c context.Context, signedInU
 	if err := l.requireSupportedElementKind(cmd.Kind); err != nil {
 		return model.LibraryElementDTO{}, err
 	}
+
+	if cmd.FolderUID != nil {
+		f, err := l.folderService.Get(c, &folder.GetFolderQuery{
+			OrgID:        signedInUser.GetOrgID(),
+			UID:          cmd.FolderUID,
+			SignedInUser: signedInUser,
+		})
+		if err != nil {
+			return model.LibraryElementDTO{}, err
+		}
+		if f.ManagedBy == utils.ManagerKindRepo {
+			return model.LibraryElementDTO{}, model.ErrLibraryElementProvisionedFolder
+		}
+	}
+
 	err := l.SQLStore.WithTransactionalDbSession(c, func(session *db.Session) error {
 		elementInDB, err := l.GetLibraryElement(c, signedInUser, session, uid)
 		if err != nil {