When authorizing users on the PolicySpec endpoint, return proper status code if team not found (#12335)

Return proper status code on policy spec endpoint if team not found.

changes/bug-2790-return-proper-status-code

@@ -0,0 +1 @@
+- When creating a PolicySpec, return the proper HTTP status code if the Team is not found.

server/service/global_policies.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"database/sql"
 	"errors"
 	"fmt"
 
@@ -439,6 +440,13 @@ func (svc *Service) checkPolicySpecAuthorization(ctx context.Context, policies [
 		if policy.Team != "" {
 			team, err := svc.ds.TeamByName(ctx, policy.Team)
 			if err != nil {
+				// This is so that the proper HTTP status code is returned
+				svc.authz.SkipAuthorization(ctx)
+
+				if errors.Is(err, sql.ErrNoRows) {
+					return newNotFoundError()
+				}
+
 				return ctxerr.Wrap(ctx, err, "getting team by name")
 			}
 			if err := svc.authz.Authorize(ctx, &fleet.Policy{

server/service/global_policies_test.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"database/sql"
 	"testing"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
@@ -11,6 +12,31 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestCheckPolicySpecAuthorization(t *testing.T) {
+	t.Run("when team not found", func(t *testing.T) {
+		ds := new(mock.Store)
+		ds.TeamByNameFunc = func(ctx context.Context, name string) (*fleet.Team, error) {
+			return nil, sql.ErrNoRows
+		}
+
+		svc, ctx := newTestService(t, ds, nil, nil)
+
+		req := []*fleet.PolicySpec{
+			{
+				Team: "some_team",
+			},
+		}
+
+		user := &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}
+		ctx = viewer.NewContext(ctx, viewer.Viewer{User: user})
+
+		actual := svc.ApplyPolicySpecs(ctx, req)
+		var expected *notFoundError
+
+		require.ErrorAs(t, actual, &expected)
+	})
+}
+
 func TestGlobalPoliciesAuth(t *testing.T) {
 	ds := new(mock.Store)
 	svc, ctx := newTestService(t, ds, nil, nil)