Alerting: Add RBAC actions and role for provisioning API routes (#50459)

* add alert provisioning actions and role

* linter

pkg/services/ngalert/accesscontrol.go

@@ -161,6 +161,25 @@ var (
 		},
 		Grants: []string{string(models.ROLE_EDITOR), string(models.ROLE_ADMIN)},
 	}
+
+	alertingProvisioningRole = accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Name:        accesscontrol.FixedRolePrefix + "alerting:provisioning",
+			DisplayName: "Access to alert rules provisioning API",
+			Description: "Can manage all alert rules, contact points, notification policies, silences, etc. in the organization via provisioning API.",
+			Group:       AlertRolesGroup,
+			Version:     1,
+			Permissions: []accesscontrol.Permission{
+				{
+					Action: accesscontrol.ActionAlertingProvisioningRead, // organization scope
+				},
+				{
+					Action: accesscontrol.ActionAlertingProvisioningWrite, // organization scope
+				},
+			},
+		},
+		Grants: []string{string(models.ROLE_ADMIN)},
+	}
 )
 
 func DeclareFixedRoles(ac accesscontrol.AccessControl) error {
@@ -168,6 +187,6 @@ func DeclareFixedRoles(ac accesscontrol.AccessControl) error {
 		rulesReaderRole, rulesEditorRole,
 		instancesReaderRole, instancesEditorRole,
 		notificationsReaderRole, notificationsEditorRole,
-		alertingReaderRole, alertingWriterRole,
+		alertingReaderRole, alertingWriterRole, alertingProvisioningRole,
 	)
 }

pkg/services/ngalert/api/authorization.go

@@ -186,7 +186,8 @@ func (api *API) authorize(method, path string) web.Handler {
 		http.MethodGet + "/api/v1/provisioning/mute-timings",
 		http.MethodGet + "/api/v1/provisioning/mute-timings/{name}",
 		http.MethodGet + "/api/v1/provisioning/alert-rules/{UID}":
-		return middleware.ReqOrgAdmin
+		fallback = middleware.ReqOrgAdmin
+		eval = ac.EvalPermission(ac.ActionAlertingProvisioningRead) // organization scope
 
 	case http.MethodPut + "/api/v1/provisioning/policies",
 		http.MethodPost + "/api/v1/provisioning/contact-points",
@@ -201,7 +202,8 @@ func (api *API) authorize(method, path string) web.Handler {
 		http.MethodPut + "/api/v1/provisioning/alert-rules/{UID}",
 		http.MethodDelete + "/api/v1/provisioning/alert-rules/{UID}",
 		http.MethodPut + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}":
-		return middleware.ReqOrgAdmin
+		fallback = middleware.ReqOrgAdmin
+		eval = ac.EvalPermission(ac.ActionAlertingProvisioningWrite) // organization scope
 	}
 
 	if eval != nil {