server/service/hosts.go (1)

1243-1251: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Make source-team authorization atomic with the transfer.

Line 1243/Line 1393 read each host's current TeamID, but the move happens later at Line 1251/Line 1407. A concurrent transfer can change the source team between those steps, so this can authorize against team A and then move the host out of team B. Please enforce the source-team check inside the same datastore transaction/update that performs the transfer, and fail if any host's current team drifted after authorization.

Also applies to: 1393-1408

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/service/hosts.go` around lines 1243 - 1251, The source-team check
(svc.authorizeHostSourceTeams called after svc.ds.ListHostsLiteByIDs) must be
moved into the same datastore operation that performs the transfer to avoid
TOCTOU races: modify the datastore update (currently svc.ds.AddHostsToTeam /
fleet.NewAddHostsToTeamParams) to accept the expected source team(s) or
host->team snapshot and perform an atomic transaction that verifies each host's
current TeamID matches the authorized source team(s) and only then updates
TeamID to the destination; if any host's TeamID differs, the datastore call must
fail and return an error so the service (svc) returns that error instead of
proceeding. Use or add a new method like AddHostsToTeamWithSourceCheck or add
parameters to AddHostsToTeam, and remove the separate
svc.authorizeHostSourceTeams step so authorization and update occur inside the
same transactional datastore call.

server/service/hosts_test.go (1)

1961-1972: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Test logic bug: destination team ID doesn't match test intent.

The test comment states "team 1 maintainer tries to transfer it to team 1" and the test name is "cannot steal host from another team", but line 1969 uses new(uint(2)) as the destination, attempting to transfer from team 2 to team 2.

To properly test the "stealing" scenario (unauthorized access to source team), the destination should be a team the user CAN write to (team 1), so the failure is specifically due to lack of access to the source team. Compare with the similar test at line 1982 and the technician test at line 2165, which correctly use new(uint(1)).

🐛 Proposed fix

     userCtx := test.UserContext(ctx, test.UserTeamMaintainerTeam1)
-    err := svc.AddHostsToTeam(userCtx, new(uint(2)), []uint{10}, false)
+    err := svc.AddHostsToTeam(userCtx, new(uint(1)), []uint{10}, false)
     require.Error(t, err)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/service/hosts_test.go` around lines 1961 - 1972, The test is using the
wrong destination team ID so it doesn't exercise the "steal from another team"
case; update the destination passed to svc.AddHostsToTeam in the "team
maintainer cannot steal host from another team" test to be new(uint(1)) so a
user in test.UserTeamMaintainerTeam1 attempts to transfer host ID 10 (which
ds.ListHostsLiteByIDsFunc returns with TeamID=2) into team 1; ensure the test
still asserts require.Error and that the error contains "forbidden" (references:
svc.AddHostsToTeam, ds.ListHostsLiteByIDsFunc, test.UserTeamMaintainerTeam1).