fix: return OpaqueAccessDenied for NotFound remote cluster errors

lib/auth/auth_with_roles.go

@@ -4947,7 +4947,7 @@ func (a *ServerWithRoles) GetRemoteCluster(ctx context.Context, clusterName stri
 	}
 	cluster, err := a.authServer.GetRemoteCluster(ctx, clusterName)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, utils.OpaqueAccessDenied(err)
 	}
 	if err := a.context.Checker.CheckAccessToRemoteCluster(cluster); err != nil {
 		return nil, utils.OpaqueAccessDenied(err)

lib/auth/presence/presencev1/service.go

@@ -126,7 +126,7 @@ func (s *Service) GetRemoteCluster(
 
 	rc, err := s.backend.GetRemoteCluster(ctx, req.Name)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, utils.OpaqueAccessDenied(err)
 	}
 
 	if err := authCtx.Checker.CheckAccessToRemoteCluster(rc); err != nil {

lib/auth/presence/presencev1/service_test.go

@@ -143,7 +143,6 @@ func TestGetRemoteCluster(t *testing.T) {
 				Name: matchingRC.GetName(),
 			},
 			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				// Opaque no permission presents as not found
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
 		},
@@ -154,6 +153,7 @@ func TestGetRemoteCluster(t *testing.T) {
 				Name: notMatchingRC.GetName(),
 			},
 			assertError: func(t require.TestingT, err error, i ...interface{}) {
+				// Opaque no permission presents as not found
 				require.True(t, trace.IsNotFound(err), "error should be not found")
 			},
 		},
@@ -175,7 +175,7 @@ func TestGetRemoteCluster(t *testing.T) {
 				Name: "non-existent",
 			},
 			assertError: func(t require.TestingT, err error, i ...interface{}) {
-				require.True(t, trace.IsNotFound(err), "error should be bad parameter")
+				require.True(t, trace.IsNotFound(err), "error should be not found")
 			},
 		},
 	}
@@ -184,14 +184,31 @@ func TestGetRemoteCluster(t *testing.T) {
 			client, err := srv.NewClient(auth.TestUser(tt.user))
 			require.NoError(t, err)
 
-			bot, err := client.PresenceServiceClient().GetRemoteCluster(ctx, tt.req)
+			rc, err := client.PresenceServiceClient().GetRemoteCluster(ctx, tt.req)
 			tt.assertError(t, err)
 			if tt.want != nil {
-				// Check that the returned bot matches
-				require.Empty(t, cmp.Diff(tt.want, bot, protocmp.Transform()))
+				// Check that the returned remote cluster matches
+				require.Empty(t, cmp.Diff(tt.want, rc, protocmp.Transform()))
 			}
 		})
 	}
+
+	t.Run("doesnt exist and no permissions errors match", func(t *testing.T) {
+		client, err := srv.NewClient(auth.TestUser(user.GetName()))
+		require.NoError(t, err)
+
+		_, doesntExistError := client.PresenceServiceClient().GetRemoteCluster(ctx, &presencev1pb.GetRemoteClusterRequest{
+			Name: "non-existent",
+		})
+		require.Error(t, doesntExistError)
+		_, noPermissionsError := client.PresenceServiceClient().GetRemoteCluster(ctx, &presencev1pb.GetRemoteClusterRequest{
+			Name: notMatchingRC.GetName(),
+		})
+		require.Error(t, noPermissionsError)
+
+		require.Equal(t, doesntExistError.Error(), noPermissionsError.Error(),
+			"the error returned when the rc doesn't exist or when the user has no permission to see it should be indistinguishable")
+	})
 }
 
 // TestListRemoteClusters is an integration test that uses a real gRPC

lib/proxy/router.go

@@ -365,12 +365,12 @@ func (r *Router) getRemoteCluster(ctx context.Context, clusterName string, check
 
 	site, err := r.siteGetter.GetSite(clusterName)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, utils.OpaqueAccessDenied(err)
 	}
 
 	rc, err := r.clusterGetter.GetRemoteCluster(ctx, clusterName)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, utils.OpaqueAccessDenied(err)
 	}
 
 	if err := checker.CheckAccessToRemoteCluster(rc); err != nil {

lib/reversetunnelclient/api_with_roles.go

@@ -94,14 +94,14 @@ func (t *TunnelWithRoles) GetSite(clusterName string) (RemoteSite, error) {
 	ctx := context.TODO()
 	cluster, err := t.tunnel.GetSite(clusterName)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, utils.OpaqueAccessDenied(err)
 	}
 	if t.localCluster == cluster.GetName() {
 		return cluster, nil
 	}
 	rc, err := t.access.GetRemoteCluster(ctx, clusterName)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, utils.OpaqueAccessDenied(err)
 	}
 	if err := t.accessChecker.CheckAccessToRemoteCluster(rc); err != nil {
 		return nil, utils.OpaqueAccessDenied(err)

lib/utils/utils.go

@@ -414,10 +414,11 @@ func IsCertExpiredError(err error) bool {
 	return strings.Contains(trace.Unwrap(err).Error(), "ssh: cert has expired")
 }
 
-// OpaqueAccessDenied returns a generic NotFound instead of AccessDenied
-// so as to avoid leaking the existence of secret resources.
+// OpaqueAccessDenied returns a generic NotFound error if [err] is a NotFound or
+// AccessDenied error so as to avoid leaking the existence of secret resources,
+// for other error types it returns the original error.
 func OpaqueAccessDenied(err error) error {
-	if trace.IsAccessDenied(err) {
+	if trace.IsNotFound(err) || trace.IsAccessDenied(err) {
 		return trace.NotFound("not found")
 	}
 	return trace.Wrap(err)