Dashboards: Prevent saving to a non-existent folder (#103503)

pkg/services/dashboards/database/database.go

@@ -90,6 +90,8 @@ func (d *dashboardStore) ValidateDashboardBeforeSave(ctx context.Context, dash *
 
 			if folderIdFound {
 				dash.FolderID = existing.ID // nolint:staticcheck
+			} else {
+				return dashboards.ErrDashboardFolderNotFound
 			}
 		}
 

pkg/services/dashboards/database/database_test.go

@@ -427,12 +427,12 @@ func TestIntegrationDashboardDataAccess(t *testing.T) {
 				"tags":  []interface{}{},
 			}),
 			Overwrite: true,
-			FolderUID: "2",
+			FolderUID: savedFolder.UID,
 			UserID:    100,
 		}
 		dash, err := dashboardStore.SaveDashboard(context.Background(), cmd)
 		require.NoError(t, err)
-		require.EqualValues(t, dash.FolderUID, "2")
+		require.EqualValues(t, dash.FolderUID, savedFolder.UID)
 
 		cmd = dashboards.SaveDashboardCommand{
 			OrgID: 1,

pkg/services/publicdashboards/api/query_test.go

@@ -281,7 +281,7 @@ func TestIntegrationUnauthenticatedUserCanGetPubdashPanelQueryData(t *testing.T)
 	// Create Dashboard
 	saveDashboardCmd := dashboards.SaveDashboardCommand{
 		OrgID:     1,
-		FolderUID: "1",
+		FolderUID: "",
 		IsFolder:  false,
 		Dashboard: simplejson.NewFromAny(map[string]any{
 			"id":    nil,

pkg/tests/apis/dashboard/integration/api_validation_test.go

@@ -189,6 +189,15 @@ func runDashboardValidationTests(t *testing.T, ctx TestContext) {
 		})
 	})
 
+	t.Run("Dashboard folder validations", func(t *testing.T) {
+		// Test non-existent folder UID
+		t.Run("reject dashboard with non-existent folder UID", func(t *testing.T) {
+			nonExistentFolderUID := "non-existent-folder-uid"
+			_, err := createDashboard(t, adminClient, "Dashboard in Non-existent Folder", &nonExistentFolderUID, nil)
+			require.Error(t, err)
+		})
+	})
+
 	t.Run("Dashboard schema validations", func(t *testing.T) {
 		// Test invalid dashboard schema
 		t.Run("reject dashboard with invalid schema", func(t *testing.T) {