diff --git a/changes/18993-404-when-no-team-on-delete-team-policies b/changes/18993-404-when-no-team-on-delete-team-policies new file mode 100644 index 0000000000..98a8b3e171 --- /dev/null +++ b/changes/18993-404-when-no-team-on-delete-team-policies @@ -0,0 +1 @@ +* Error with 404 when the user attempts to delete team policies for a non-existent team diff --git a/server/service/integration_core_test.go b/server/service/integration_core_test.go index a5af5c5d36..1f7b1feca3 100644 --- a/server/service/integration_core_test.go +++ b/server/service/integration_core_test.go @@ -6211,6 +6211,9 @@ func (s *integrationTestSuite) TestTeamPoliciesTeamNotExists() { teamPoliciesResponse := listTeamPoliciesResponse{} s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/teams/%d/policies", 9999999), nil, http.StatusNotFound, &teamPoliciesResponse) require.Len(t, teamPoliciesResponse.Policies, 0) + + deleteTeamPoliciesResponse := deleteTeamPoliciesResponse{} + s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/delete", 9999999), deleteTeamPoliciesRequest{IDs: []uint{1, 1000}}, http.StatusNotFound, &deleteTeamPoliciesResponse) } func (s *integrationTestSuite) TestSessionInfo() { diff --git a/server/service/team_policies.go b/server/service/team_policies.go index 62540aef94..81ebee7d40 100644 --- a/server/service/team_policies.go +++ b/server/service/team_policies.go @@ -269,6 +269,18 @@ func deleteTeamPoliciesEndpoint(ctx context.Context, request interface{}, svc fl } func (svc Service) DeleteTeamPolicies(ctx context.Context, teamID uint, ids []uint) ([]uint, error) { + if err := svc.authz.Authorize(ctx, &fleet.Policy{ + PolicyData: fleet.PolicyData{ + TeamID: ptr.Uint(teamID), + }, + }, fleet.ActionWrite); err != nil { + return nil, err + } + + if _, err := svc.ds.Team(ctx, teamID); err != nil { + return nil, ctxerr.Wrapf(ctx, err, "loading team %d", teamID) + } + if len(ids) == 0 { return nil, nil } @@ -277,13 +289,6 @@ func (svc Service) DeleteTeamPolicies(ctx context.Context, teamID uint, ids []ui return nil, ctxerr.Wrap(ctx, err, "getting policies by ID") } - if err := svc.authz.Authorize(ctx, &fleet.Policy{ - PolicyData: fleet.PolicyData{ - TeamID: ptr.Uint(teamID), - }, - }, fleet.ActionWrite); err != nil { - return nil, err - } for _, policy := range policiesByID { if t := policy.PolicyData.TeamID; t == nil || *t != teamID { return nil, authz.ForbiddenWithInternal(