Skip to content

[9.3] [Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors (#258883) #259702

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
csr merged 3 commits into from
Apr 1, 2026
Merged

[9.3] [Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors (#258883) #259702

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2b20a72
[Osquery] Fix pack and saved query APIs returning 500 instead of 404 …
csr Mar 23, 2026
c07bd60
Merge branch '9.3' into backport/9.3/pr-258883
csr Mar 31, 2026
4bb92bc
Merge branch '9.3' into backport/9.3/pr-258883
csr Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions x-pack/platform/plugins/shared/osquery/server/routes/pack/delete_pack_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
import { has, filter, unset } from 'lodash';
import { produce } from 'immer';
import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';

import type { DeletePacksRequestParamsSchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
Expand Down Expand Up @@ -54,10 +54,21 @@ export const deletePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte

const packagePolicyService = osqueryContext.service.getPackagePolicyService();

const currentPackSO = await spaceScopedClient.get<{ name: string }>(
packSavedObjectType,
request.params.id
);
let currentPackSO;
try {
currentPackSO = await spaceScopedClient.get<{ name: string }>(
packSavedObjectType,
request.params.id
);
} catch (err) {
if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
return response.notFound({
body: { message: `Pack ${request.params.id} not found` },
});
}

throw err;
}

await spaceScopedClient.delete(packSavedObjectType, request.params.id, {
refresh: 'wait_for',
Expand Down
21 changes: 18 additions & 3 deletions x-pack/platform/plugins/shared/osquery/server/routes/pack/read_pack_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@

import { filter, map } from 'lodash';
import { LEGACY_AGENT_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';

import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
import type { ReadPacksRequestParamsSchema } from '../../../common/api';
Expand Down Expand Up @@ -52,8 +52,23 @@ export const readPackRoute = (router: IRouter, osqueryContext: OsqueryAppContext
request
);

const { attributes, references, id, ...rest } =
await spaceScopedClient.get<PackSavedObject>(packSavedObjectType, request.params.id);
let packSO;
try {
packSO = await spaceScopedClient.get<PackSavedObject>(
packSavedObjectType,
request.params.id
);
} catch (err) {
if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
return response.notFound({
body: { message: `Pack ${request.params.id} not found` },
});
}

throw err;
}

const { attributes, references, id, ...rest } = packSO;

const policyIds = map(
filter(references, ['type', LEGACY_AGENT_POLICY_SAVED_OBJECT_TYPE]),
Expand Down
21 changes: 16 additions & 5 deletions x-pack/platform/plugins/shared/osquery/server/routes/pack/update_pack_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ import {
LEGACY_AGENT_POLICY_SAVED_OBJECT_TYPE,
PACKAGE_POLICY_SAVED_OBJECT_TYPE,
} from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';

import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
import type {
Expand Down Expand Up @@ -89,10 +89,21 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte

const { name, description, queries, enabled, policy_ids, shards = {} } = request.body;

const currentPackSO = await spaceScopedClient.get<{ name: string; enabled: boolean }>(
packSavedObjectType,
request.params.id
);
let currentPackSO;
try {
currentPackSO = await spaceScopedClient.get<PackSavedObject>(
packSavedObjectType,
request.params.id
);
} catch (err) {
if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
return response.notFound({
body: { message: `Pack ${request.params.id} not found` },
});
}

throw err;
}

if (name) {
const conflictingEntries = await spaceScopedClient.find<PackSavedObject>({
Expand Down
18 changes: 14 additions & 4 deletions x-pack/platform/plugins/shared/osquery/server/routes/saved_query/delete_saved_query_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
* 2.0.
*/

import type { IRouter } from '@kbn/core/server';
import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
import { DEFAULT_SPACE_ID } from '@kbn/spaces-utils';
import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
Expand Down Expand Up @@ -59,9 +59,19 @@ export const deleteSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
return response.conflict({ body: `Elastic prebuilt Saved query cannot be deleted.` });
}

await spaceScopedClient.delete(savedQuerySavedObjectType, request.params.id, {
refresh: 'wait_for',
});
try {
await spaceScopedClient.delete(savedQuerySavedObjectType, request.params.id, {
refresh: 'wait_for',
});
} catch (err) {
if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
return response.notFound({
body: { message: `Saved query ${request.params.id} not found` },
});
}

throw err;
}

return response.ok({
body: {},
Expand Down
21 changes: 16 additions & 5 deletions x-pack/platform/plugins/shared/osquery/server/routes/saved_query/read_saved_query_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
* 2.0.
*/

import type { IRouter } from '@kbn/core/server';
import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
import { DEFAULT_SPACE_ID } from '@kbn/spaces-utils';
import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
Expand Down Expand Up @@ -52,10 +52,21 @@ export const readSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
const space = await osqueryContext.service.getActiveSpace(request);
const spaceId = space?.id ?? DEFAULT_SPACE_ID;

const savedQuery = await spaceScopedClient.get<SavedQuerySavedObject>(
savedQuerySavedObjectType,
request.params.id
);
let savedQuery;
try {
savedQuery = await spaceScopedClient.get<SavedQuerySavedObject>(
savedQuerySavedObjectType,
request.params.id
);
} catch (err) {
if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
return response.notFound({
body: { message: `Saved query ${request.params.id} not found` },
});
}

throw err;
}

if (savedQuery.attributes.ecs_mapping) {
// @ts-expect-error update types
Expand Down
53 changes: 32 additions & 21 deletions x-pack/platform/plugins/shared/osquery/server/routes/saved_query/update_saved_query_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@

import { filter, some } from 'lodash';

import type { IRouter } from '@kbn/core/server';
import { type IRouter, SavedObjectsErrorHelpers } from '@kbn/core/server';
import { DEFAULT_SPACE_ID } from '@kbn/spaces-utils';
import { createInternalSavedObjectsClientForSpaceId } from '../../utils/get_internal_saved_object_client';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
Expand Down Expand Up @@ -112,27 +112,38 @@ export const updateSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
return response.conflict({ body: `Saved query with id "${id}" already exists.` });
}

const updatedSavedQuerySO = await spaceScopedClient.update(
savedQuerySavedObjectType,
request.params.id,
{
id,
description: description || '',
platform,
query,
version,
interval,
timeout,
snapshot,
removed,
ecs_mapping: convertECSMappingToArray(ecs_mapping),
updated_by: username,
updated_at: new Date().toISOString(),
},
{
refresh: 'wait_for',
let updatedSavedQuerySO;
try {
updatedSavedQuerySO = await spaceScopedClient.update(
savedQuerySavedObjectType,
request.params.id,
{
id,
description: description || '',
platform,
query,
version,
interval,
timeout,
snapshot,
removed,
ecs_mapping: convertECSMappingToArray(ecs_mapping),
updated_by: username,
updated_at: new Date().toISOString(),
},
{
refresh: 'wait_for',
}
);
} catch (err) {
if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
return response.notFound({
body: { message: `Saved query ${request.params.id} not found` },
});
}
);

throw err;
}

if (ecs_mapping || updatedSavedQuerySO.attributes.ecs_mapping) {
// @ts-expect-error update types
Expand Down
29 changes: 29 additions & 0 deletions x-pack/platform/test/api_integration/apis/osquery/packs.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,5 +151,34 @@ export default function ({ getService }: FtrProviderContext) {
singleLineQuery
);
});

describe('404 for non-existent resources', () => {
it('returns 404 when reading a non-existent pack', async () => {
await supertest
.get('/api/osquery/packs/non-existent-id')
.set('kbn-xsrf', 'true')
.expect(404);
});

it('returns 404 when updating a non-existent pack', async () => {
await supertest
.put('/api/osquery/packs/non-existent-id')
.set('kbn-xsrf', 'true')
.send({
name: 'Updated Pack',
description: 'Updated',
enabled: true,
queries: { q1: { query: 'select 1;', interval: 3600 } },
})
.expect(404);
});

it('returns 404 when deleting a non-existent pack', async () => {
await supertest
.delete('/api/osquery/packs/non-existent-id')
.set('kbn-xsrf', 'true')
.expect(404);
});
});
});
}
Loading