[Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors

x-pack/platform/plugins/shared/osquery/server/routes/pack/delete_pack_route.ts

@@ -8,7 +8,7 @@
 import { filter, unset } from 'lodash';
 import { produce } from 'immer';
 import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
-import type { IRouter } from '@kbn/core/server';
+import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
 
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-utils';
 import type { DeletePacksRequestParamsSchema } from '../../../common/api';
@@ -60,10 +60,21 @@ export const deletePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte
           ? (await osqueryContext.service.getActiveSpace(request))?.id || DEFAULT_SPACE_ID
           : DEFAULT_SPACE_ID;
 
-        const currentPackSO = await spaceScopedClient.get<{ name: string }>(
-          packSavedObjectType,
-          request.params.id
-        );
+        let currentPackSO;
+        try {
+          currentPackSO = await spaceScopedClient.get<{ name: string }>(
+            packSavedObjectType,
+            request.params.id
+          );
+        } catch (err) {
+          if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
+            return response.notFound({
+              body: { message: `Pack ${request.params.id} not found` },
+            });
+          }
+
+          throw err;
+        }
 
         await spaceScopedClient.delete(packSavedObjectType, request.params.id, {
           refresh: 'wait_for',

x-pack/platform/plugins/shared/osquery/server/routes/pack/read_pack_route.ts

@@ -7,7 +7,7 @@
 
 import { filter, map, mapValues } from 'lodash';
 import { LEGACY_AGENT_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
-import type { IRouter } from '@kbn/core/server';
+import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
 
 import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
 import type { ReadPacksRequestParamsSchema } from '../../../common/api';
@@ -52,8 +52,23 @@ export const readPackRoute = (router: IRouter, osqueryContext: OsqueryAppContext
           request
         );
 
-        const { attributes, references, id, ...rest } =
-          await spaceScopedClient.get<PackSavedObject>(packSavedObjectType, request.params.id);
+        let packSO;
+        try {
+          packSO = await spaceScopedClient.get<PackSavedObject>(
+            packSavedObjectType,
+            request.params.id
+          );
+        } catch (err) {
+          if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
+            return response.notFound({
+              body: { message: `Pack ${request.params.id} not found` },
+            });
+          }
+
+          throw err;
+        }
+
+        const { attributes, references, id, ...rest } = packSO;
 
         const policyIds = map(
           filter(references, ['type', LEGACY_AGENT_POLICY_SAVED_OBJECT_TYPE]),

x-pack/platform/plugins/shared/osquery/server/routes/pack/update_pack_route.ts

@@ -27,7 +27,7 @@ import {
   LEGACY_AGENT_POLICY_SAVED_OBJECT_TYPE,
   PACKAGE_POLICY_SAVED_OBJECT_TYPE,
 } from '@kbn/fleet-plugin/common';
-import type { IRouter } from '@kbn/core/server';
+import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
 
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-utils';
 import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
@@ -122,10 +122,21 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte
           shards = {},
         } = request.body;
 
-        const currentPackSO = await spaceScopedClient.get<PackSavedObject>(
-          packSavedObjectType,
-          request.params.id
-        );
+        let currentPackSO;
+        try {
+          currentPackSO = await spaceScopedClient.get<PackSavedObject>(
+            packSavedObjectType,
+            request.params.id
+          );
+        } catch (err) {
+          if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
+            return response.notFound({
+              body: { message: `Pack ${request.params.id} not found` },
+            });
+          }
+
+          throw err;
+        }
 
         const existingScheduleIds = keyBy(
           (currentPackSO.attributes.queries ?? []).filter(

x-pack/platform/plugins/shared/osquery/server/routes/saved_query/delete_saved_query_route.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { IRouter } from '@kbn/core/server';
+import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-utils';
 import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
 import { buildRouteValidation } from '../../utils/build_validation/route_validation';
@@ -59,9 +59,19 @@ export const deleteSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
           return response.conflict({ body: `Elastic prebuilt Saved query cannot be deleted.` });
         }
 
-        await spaceScopedClient.delete(savedQuerySavedObjectType, request.params.id, {
-          refresh: 'wait_for',
-        });
+        try {
+          await spaceScopedClient.delete(savedQuerySavedObjectType, request.params.id, {
+            refresh: 'wait_for',
+          });
+        } catch (err) {
+          if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
+            return response.notFound({
+              body: { message: `Saved query ${request.params.id} not found` },
+            });
+          }
+
+          throw err;
+        }
 
         return response.ok({
           body: {},

x-pack/platform/plugins/shared/osquery/server/routes/saved_query/read_saved_query_route.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { IRouter } from '@kbn/core/server';
+import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-utils';
 import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
 import { buildRouteValidation } from '../../utils/build_validation/route_validation';
@@ -52,10 +52,21 @@ export const readSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
         const space = await osqueryContext.service.getActiveSpace(request);
         const spaceId = space?.id ?? DEFAULT_SPACE_ID;
 
-        const savedQuery = await spaceScopedClient.get<SavedQuerySavedObject>(
-          savedQuerySavedObjectType,
-          request.params.id
-        );
+        let savedQuery;
+        try {
+          savedQuery = await spaceScopedClient.get<SavedQuerySavedObject>(
+            savedQuerySavedObjectType,
+            request.params.id
+          );
+        } catch (err) {
+          if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
+            return response.notFound({
+              body: { message: `Saved query ${request.params.id} not found` },
+            });
+          }
+
+          throw err;
+        }
 
         if (savedQuery.attributes.ecs_mapping) {
           // @ts-expect-error update types

x-pack/platform/plugins/shared/osquery/server/routes/saved_query/update_saved_query_route.ts

@@ -7,7 +7,7 @@
 
 import { filter, some } from 'lodash';
 
-import type { IRouter } from '@kbn/core/server';
+import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-utils';
 import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
 import { buildRouteValidation } from '../../utils/build_validation/route_validation';
@@ -115,28 +115,39 @@ export const updateSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
           return response.conflict({ body: `Saved query with id "${id}" already exists.` });
         }
 
-        const updatedSavedQuerySO = await spaceScopedClient.update(
-          savedQuerySavedObjectType,
-          request.params.id,
-          {
-            id,
-            description: description || '',
-            platform,
-            query,
-            version,
-            interval,
-            timeout,
-            snapshot,
-            removed,
-            ecs_mapping: convertECSMappingToArray(ecs_mapping),
-            updated_by: username,
-            updated_by_profile_uid: profileUid,
-            updated_at: new Date().toISOString(),
-          },
-          {
-            refresh: 'wait_for',
+        let updatedSavedQuerySO;
+        try {
+          updatedSavedQuerySO = await spaceScopedClient.update(
+            savedQuerySavedObjectType,
+            request.params.id,
+            {
+              id,
+              description: description || '',
+              platform,
+              query,
+              version,
+              interval,
+              timeout,
+              snapshot,
+              removed,
+              ecs_mapping: convertECSMappingToArray(ecs_mapping),
+              updated_by: username,
+              updated_by_profile_uid: profileUid,
+              updated_at: new Date().toISOString(),
+            },
+            {
+              refresh: 'wait_for',
+            }
+          );
+        } catch (err) {
+          if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
+            return response.notFound({
+              body: { message: `Saved query ${request.params.id} not found` },
+            });
           }
-        );
+
+          throw err;
+        }
 
         if (ecs_mapping || updatedSavedQuerySO.attributes.ecs_mapping) {
           // @ts-expect-error update types

x-pack/platform/test/api_integration/apis/osquery/packs.ts

@@ -280,5 +280,28 @@ export default function ({ getService }: FtrProviderContext) {
         inputs[0].config.osquery.value.packs['default--TestPack'].queries.testQuery.query
       ).to.be(singleLineQuery);
     });
+
+    describe('404 for non-existent resources', () => {
+      it('returns 404 when reading a non-existent pack', async () => {
+        await withOsqueryHeaders(supertest.get('/api/osquery/packs/non-existent-id')).expect(404);
+      });
+
+      it('returns 404 when updating a non-existent pack', async () => {
+        await withOsqueryHeaders(supertest.put('/api/osquery/packs/non-existent-id'))
+          .send({
+            name: 'Updated Pack',
+            description: 'Updated',
+            enabled: true,
+            queries: { q1: { query: 'select 1;', interval: 3600 } },
+          })
+          .expect(404);
+      });
+
+      it('returns 404 when deleting a non-existent pack', async () => {
+        await withOsqueryHeaders(supertest.delete('/api/osquery/packs/non-existent-id')).expect(
+          404
+        );
+      });
+    });
   });
 }

x-pack/platform/test/api_integration/apis/osquery/saved_queries.ts

@@ -175,5 +175,19 @@ export default function ({ getService }: FtrProviderContext) {
         expect(response.body.total).to.be(0);
       });
     });
+
+    describe('404 for non-existent resources', () => {
+      it('returns 404 when reading a non-existent saved query', async () => {
+        await getSavedQuery('non-existent-id').expect(404);
+      });
+
+      it('returns 404 when updating a non-existent saved query', async () => {
+        await updateSavedQuery('non-existent-id', 'updated-name').expect(404);
+      });
+
+      it('returns 404 when deleting a non-existent saved query', async () => {
+        await deleteSavedQuery('non-existent-id').expect(404);
+      });
+    });
   });
 }