From de75bbe004224d7104c09572747c13566a4f3c21 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 9 Nov 2026 08:47:56 +0100
Subject: [PATCH] fix(upload): return 404 for a database the team cannot open

The backup upload returned a hard-coded 500 when the database uuid was
unknown or belonged to another team. It now returns 404 with the same
JSON error shape that the import form reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .changes/server-error-when-a-backup-was.md    |  6 ++++
 app/Http/Controllers/UploadController.php     |  2 +-
 .../UploadBackupAuthorizationTest.php         | 33 +++++++++++++++++--
 3 files changed, 37 insertions(+), 4 deletions(-)
 create mode 100644 .changes/server-error-when-a-backup-was.md

diff --git a/.changes/server-error-when-a-backup-was.md b/.changes/server-error-when-a-backup-was.md
new file mode 100644
index 0000000000..594250b189
--- /dev/null
+++ b/.changes/server-error-when-a-backup-was.md
@@ -0,0 +1,6 @@
+---
+type: fixed
+---
+Server error when a backup was uploaded in `Import Backup` for a database that the team cannot open
+
+- The upload now answers with `Database not found`
diff --git a/app/Http/Controllers/UploadController.php b/app/Http/Controllers/UploadController.php
index 4d4a5a080e..374017a063 100644
--- a/app/Http/Controllers/UploadController.php
+++ b/app/Http/Controllers/UploadController.php
@@ -24,7 +24,7 @@ class UploadController extends BaseController
         $databaseIdentifier = request()->route('databaseUuid');
         $resource = getResourceByUuid($databaseIdentifier, data_get(auth()->user()->currentTeam(), 'id'));
         if (is_null($resource)) {
-            return response()->json(['error' => 'You do not have permission for this database'], 500);
+            return response()->json(['error' => 'Database not found.'], 404);
         }
 
         $this->authorize('uploadBackup', $resource);
diff --git a/tests/Feature/Authorization/UploadBackupAuthorizationTest.php b/tests/Feature/Authorization/UploadBackupAuthorizationTest.php
index 59097b4102..96e0257da6 100644
--- a/tests/Feature/Authorization/UploadBackupAuthorizationTest.php
+++ b/tests/Feature/Authorization/UploadBackupAuthorizationTest.php
@@ -174,7 +174,12 @@ test('member gets 403 from POST /upload/backup and no file lands on disk', funct
     expect(File::exists($uploadDir.'/restore'))->toBeFalse();
 });
 
-test('user from different team hits null-resource branch with 500', function () {
+test('user from different team gets 404 from POST /upload/backup and no file lands on disk', function () {
+    $uploadDir = storage_path('app/upload/'.$this->database->uuid);
+    if (File::exists($uploadDir)) {
+        File::deleteDirectory($uploadDir);
+    }
+
     $otherTeam = Team::factory()->create();
     $otherUser = User::factory()->create();
     $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
@@ -182,9 +187,31 @@ test('user from different team hits null-resource branch with 500', function ()
     $this->actingAs($otherUser);
     session(['currentTeam' => $otherTeam]);
 
-    $response = $this->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
+    $response = $this->withHeader('Accept', 'application/json')
+        ->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
 
-    $response->assertStatus(500);
+    $response->assertNotFound();
+    $response->assertJsonMissing(['error' => 'You do not have permission for this database']);
+
+    expect(File::exists($uploadDir.'/restore'))->toBeFalse();
+});
+
+test('unknown database uuid gets 404 from POST /upload/backup and no file lands on disk', function () {
+    $unknownUuid = (string) Str::uuid();
+    $uploadDir = storage_path('app/upload/'.$unknownUuid);
+    if (File::exists($uploadDir)) {
+        File::deleteDirectory($uploadDir);
+    }
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $response = $this->withHeader('Accept', 'application/json')
+        ->post(route('upload.backup', ['databaseUuid' => $unknownUuid]));
+
+    $response->assertNotFound();
+
+    expect(File::exists($uploadDir.'/restore'))->toBeFalse();
 });
 
 test('unauthenticated request is redirected to login', function () {