Alerting: Rule api to fail update if provisioned rules are affected (#50835)

* add function that checks whether changes mention provisioned rules
* update API that updates group of rules to fail if check does not pass

pkg/services/ngalert/api/api_ruler_test.go

@@ -659,6 +659,67 @@ func TestRouteGetNamespaceRulesConfig(t *testing.T) {
 	})
 }
 
+func TestVerifyProvisionedRulesNotAffected(t *testing.T) {
+	orgID := rand.Int63()
+	group := models.GenerateGroupKey(orgID)
+	affectedGroups := make(map[models.AlertRuleGroupKey][]*models.AlertRule)
+	var allRules []*models.AlertRule
+	{
+		rules := models.GenerateAlertRules(rand.Intn(3)+1, models.AlertRuleGen(withGroupKey(group)))
+		allRules = append(allRules, rules...)
+		affectedGroups[group] = rules
+		for i := 0; i < rand.Intn(3)+1; i++ {
+			g := models.GenerateGroupKey(orgID)
+			rules := models.GenerateAlertRules(rand.Intn(3)+1, models.AlertRuleGen(withGroupKey(g)))
+			allRules = append(allRules, rules...)
+			affectedGroups[g] = rules
+		}
+	}
+	ch := &changes{
+		GroupKey:       group,
+		AffectedGroups: affectedGroups,
+	}
+
+	t.Run("should return error if at least one rule in affected groups is provisioned", func(t *testing.T) {
+		rand.Shuffle(len(allRules), func(i, j int) {
+			allRules[j], allRules[i] = allRules[i], allRules[j]
+		})
+		storeResult := make(map[string]models.Provenance, len(allRules))
+		storeResult[allRules[0].UID] = models.ProvenanceAPI
+		storeResult[allRules[1].UID] = models.ProvenanceFile
+
+		provenanceStore := &provisioning.MockProvisioningStore{}
+		provenanceStore.EXPECT().GetProvenances(mock.Anything, orgID, "alertRule").Return(storeResult, nil)
+
+		result := verifyProvisionedRulesNotAffected(context.Background(), provenanceStore, orgID, ch)
+		require.Error(t, result)
+		require.ErrorIs(t, result, errProvisionedResource)
+		assert.Contains(t, result.Error(), allRules[0].GetGroupKey().String())
+		assert.Contains(t, result.Error(), allRules[1].GetGroupKey().String())
+	})
+
+	t.Run("should return nil if all have ProvenanceNone", func(t *testing.T) {
+		storeResult := make(map[string]models.Provenance, len(allRules))
+		for _, rule := range allRules {
+			storeResult[rule.UID] = models.ProvenanceNone
+		}
+
+		provenanceStore := &provisioning.MockProvisioningStore{}
+		provenanceStore.EXPECT().GetProvenances(mock.Anything, orgID, "alertRule").Return(storeResult, nil)
+
+		result := verifyProvisionedRulesNotAffected(context.Background(), provenanceStore, orgID, ch)
+		require.NoError(t, result)
+	})
+
+	t.Run("should return nil if no alerts have provisioning status", func(t *testing.T) {
+		provenanceStore := &provisioning.MockProvisioningStore{}
+		provenanceStore.EXPECT().GetProvenances(mock.Anything, orgID, "alertRule").Return(make(map[string]models.Provenance, len(allRules)), nil)
+
+		result := verifyProvisionedRulesNotAffected(context.Background(), provenanceStore, orgID, ch)
+		require.NoError(t, result)
+	})
+}
+
 func createService(ac *acMock.Mock, store *store.FakeRuleStore, scheduler schedule.ScheduleService) *RulerSrv {
 	return &RulerSrv{
 		xactManager:     store,