Move ApplyTeamSpec to ee (#4011)

* Move ApplyTeamSpec to ee

* Update test now that apply team specs is behind premium

* Check all auth first

* Change auth call for team creation

ee/server/service/service_teams.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"fmt"
 
@@ -286,3 +287,81 @@ func (svc *Service) ModifyTeamEnrollSecrets(ctx context.Context, teamID uint, se
 
 	return newSecrets, nil
 }
+
+func (svc Service) ApplyTeamSpecs(ctx context.Context, specs []*fleet.TeamSpec) error {
+	if err := svc.authz.Authorize(ctx, &fleet.Team{}, fleet.ActionRead); err != nil {
+		return err
+	}
+
+	// check auth for all teams specified first
+	for _, spec := range specs {
+		team, err := svc.ds.TeamByName(ctx, spec.Name)
+		if err != nil {
+			if err := ctxerr.Cause(err); err == sql.ErrNoRows {
+				// can the user create a new team?
+				if err := svc.authz.Authorize(ctx, &fleet.Team{}, fleet.ActionWrite); err != nil {
+					return err
+				}
+				continue
+			}
+
+			return err
+		}
+
+		// can the user modify each team it's trying to modify
+		if err := svc.authz.Authorize(ctx, team, fleet.ActionWrite); err != nil {
+			return err
+		}
+	}
+
+	config, err := svc.AppConfig(ctx)
+	if err != nil {
+		return err
+	}
+
+	for _, spec := range specs {
+		var secrets []*fleet.EnrollSecret
+		for _, secret := range spec.Secrets {
+			secrets = append(secrets, &fleet.EnrollSecret{
+				Secret: secret.Secret,
+			})
+		}
+
+		team, err := svc.ds.TeamByName(ctx, spec.Name)
+		if err != nil {
+			if err := ctxerr.Cause(err); err == sql.ErrNoRows {
+				agentOptions := spec.AgentOptions
+				if agentOptions == nil {
+					agentOptions = config.AgentOptions
+				}
+				_, err = svc.ds.NewTeam(ctx, &fleet.Team{
+					Name:         spec.Name,
+					AgentOptions: agentOptions,
+					Secrets:      secrets,
+				})
+				if err != nil {
+					return err
+				}
+				continue
+			}
+
+			return err
+		}
+
+		team.Name = spec.Name
+		team.AgentOptions = spec.AgentOptions
+		team.Secrets = secrets
+
+		_, err = svc.ds.SaveTeam(ctx, team)
+		if err != nil {
+			return err
+		}
+
+		err = svc.ds.ApplyEnrollSecrets(ctx, ptr.Uint(team.ID), secrets)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}