Move ApplyTeamSpec to ee (#4011)

* Move ApplyTeamSpec to ee

* Update test now that apply team specs is behind premium

* Check all auth first

* Change auth call for team creation

server/service/integration_core_test.go

@@ -2326,10 +2326,10 @@ func (s *integrationTestSuite) TestTeamsEndpointsWithoutLicense() {
 	var delResp deleteTeamResponse
 	s.DoJSON("DELETE", "/api/v1/fleet/teams/123", nil, http.StatusPaymentRequired, &delResp)
 
-	// apply team specs - does succeed unlike others, no license required for this one
+	// apply team specs
 	var specResp applyTeamSpecsResponse
 	teamSpecs := applyTeamSpecsRequest{Specs: []*fleet.TeamSpec{{Name: "newteam", Secrets: []fleet.EnrollSecret{{Secret: "ABC"}}}}}
-	s.DoJSON("POST", "/api/v1/fleet/spec/teams", teamSpecs, http.StatusOK, &specResp)
+	s.DoJSON("POST", "/api/v1/fleet/spec/teams", teamSpecs, http.StatusPaymentRequired, &specResp)
 
 	// modify team agent options
 	s.DoJSON("POST", "/api/v1/fleet/teams/123/agent_options", nil, http.StatusPaymentRequired, &tmResp)

server/service/teams.go

@@ -2,12 +2,9 @@ package service
 
 import (
 	"context"
-	"database/sql"
 	"encoding/json"
 
-	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
-	"github.com/fleetdm/fleet/v4/server/ptr"
 )
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -163,59 +160,11 @@ func applyTeamSpecsEndpoint(ctx context.Context, request interface{}, svc fleet.
 }
 
 func (svc Service) ApplyTeamSpecs(ctx context.Context, specs []*fleet.TeamSpec) error {
-	if err := svc.authz.Authorize(ctx, &fleet.Team{}, fleet.ActionWrite); err != nil {
-		return err
-	}
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
 
-	config, err := svc.AppConfig(ctx)
-	if err != nil {
-		return err
-	}
-
-	for _, spec := range specs {
-		var secrets []*fleet.EnrollSecret
-		for _, secret := range spec.Secrets {
-			secrets = append(secrets, &fleet.EnrollSecret{
-				Secret: secret.Secret,
-			})
-		}
-
-		team, err := svc.ds.TeamByName(ctx, spec.Name)
-		if err != nil {
-			if err := ctxerr.Cause(err); err == sql.ErrNoRows {
-				agentOptions := spec.AgentOptions
-				if agentOptions == nil {
-					agentOptions = config.AgentOptions
-				}
-				_, err = svc.ds.NewTeam(ctx, &fleet.Team{
-					Name:         spec.Name,
-					AgentOptions: agentOptions,
-					Secrets:      secrets,
-				})
-				if err != nil {
-					return err
-				}
-				continue
-			}
-
-			return err
-		}
-		team.Name = spec.Name
-		team.AgentOptions = spec.AgentOptions
-		team.Secrets = secrets
-
-		_, err = svc.ds.SaveTeam(ctx, team)
-		if err != nil {
-			return err
-		}
-
-		err = svc.ds.ApplyEnrollSecrets(ctx, ptr.Uint(team.ID), secrets)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
+	return fleet.ErrMissingLicense
 }
 
 ////////////////////////////////////////////////////////////////////////////////

server/service/teams_test.go

@@ -46,6 +46,14 @@ func TestTeamAuth(t *testing.T) {
 	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
 		return nil
 	}
+	ds.TeamByNameFunc = func(ctx context.Context, name string) (*fleet.Team, error) {
+		switch name {
+		case "team1":
+			return &fleet.Team{ID: 1}, nil
+		default:
+			return &fleet.Team{ID: 2}, nil
+		}
+	}
 
 	testCases := []struct {
 		name                       string
@@ -161,6 +169,9 @@ func TestTeamAuth(t *testing.T) {
 
 			_, err = svc.ModifyTeamEnrollSecrets(ctx, 1, []fleet.EnrollSecret{{Secret: "newteamsecret", CreatedAt: time.Now()}})
 			checkAuthErr(t, tt.shouldFailTeamSecretsWrite, err)
+
+			err = svc.ApplyTeamSpecs(ctx, []*fleet.TeamSpec{{Name: "team1"}})
+			checkAuthErr(t, tt.shouldFailTeamWrite, err)
 		})
 	}
 }