Alerting: Update rule access control to return errutil errors

[yuri-tceretian]

What is this feature?
This PR updates the rule access control service to return errutil.Error errors that are used throughout the Grafana code.
Notable changes:

• The methods AuthorizeDatasourceAccessForRule and AuthorizeAccessToRuleGroup now collect all data source scopes and evaluate permissions once.
• The method AuthorizeRuleChanges changed to evaluate permissions on its own using a new method HasAccessOrError. This opens the possibility for better messaging.
• All authorization methods are updated to return a new error that includes a list of permissions required to access the resource.
• API logic changed to treat errutil.Error specially.

Now the authorization error response will look like

{
  "statusCode": 401,
  "messageId": "ngalert.unauthorized",
  "message": "user is not authorized to access rule group NO-ACCESS in folder a1309456-f4a8-4a20-8eab-b2dcdf5ef115",
  "extra": {
    "permissions": "all(action:datasources:query scopes:datasources:uid:b4aac448-430c-4c7d-a9e3-5724d1deb0a9 action:datasources:query scopes:datasources:uid:aa09159d-7e2f-4d20-a043-7e87f8634f3d)"
  }
}

Why do we need this feature?

• This gets us closer to Grafana API conventions
• This will let users see what permissions are missing
• Refactoring of AuthorizeRuleChanges will let me add checks for more permissions to AuthorizeAccessToRuleGroup

Special notes for your reviewer:

Please check that:

• It works as expected from a user's perspective.
• If this is a pre-GA feature, it is behind a feature toggle.
• The docs are updated, and if this is a notable improvement, it's added to our What's New doc.

[yuri-tceretian]

I will add more in a follow-up PR.

[JacobsonMT]

Looks good so far, going to do some manual testing but I'll post my code comments for now.

[JacobsonMT]

Missing some text in the comment

[JacobsonMT]

NIT: Should this be errorToResponse(err) as well to be inline with the rest of the api?

[yuri-tceretian]

oh, I think it is better to do the opposite because ErrOrFallback lets us return some meaningful message in the response if error does not happen to be errutils' one.
This could be useful if authz happen to return some generic errors (eg from db or other service).

WDYT?

[JacobsonMT]

Let's quote the rule group name and folder to avoid this odd double space in

grafana/pkg/services/ngalert/accesscontrol/rules.go

Line 102 in e656aeb

return fmt.Sprintf("access rule group %s in folder %s", groupName, folderUID)

[JacobsonMT]

I know this wasn't technically changed in this PR, but could consider using query.IsExpression() here. Could even do a very small refactor to remove the unused error return so it can be inlined.

[yuri-tceretian]

I would rather get rid of the query.IsExpression because it makes a dependency on expr package, and keep the logic that binds expr and ng.models packages in 3rd package.

This check is not necessary, though, and can be replaced by similar logic as

grafana/pkg/services/ngalert/eval/eval.go

Lines 298 to 307 in 580477b

	switch nodeType := expr.NodeTypeFromDatasourceUID(q.DatasourceUID); nodeType {
	case expr.TypeDatasourceNode:
	ds, err = dsCacheService.GetDatasourceByUID(ctx.Ctx, q.DatasourceUID, ctx.User, false /*skipCache*/)
	default:
	ds, err = expr.DataSourceModelFromNodeType(nodeType)
	}
	if err != nil {
	return nil, fmt.Errorf("failed to build query '%s': %w", q.RefID, err)
	}
	datasources[q.DatasourceUID] = ds

to facilitate checks for MLNode in the future.

I would like to keep it as is to reduce the diff, and address in a follow-up

[JacobsonMT]

LGTM 🚀