Change 404 errors for aliases to 401s (#4575)

* Change 404 errors for alias resolution to 401s
---------

Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>

internal/daemon/controller/interceptor.go

@@ -335,10 +335,9 @@ func errorInterceptor(
 // For an field in the request to be considered for alias resolution, it must
 // be annotated with the Aliasable proto option.
 func aliasResolutionInterceptor(
-	ctx context.Context,
+	_ context.Context,
 	aliasRepoFn common.AliasRepoFactory,
 ) grpc.UnaryServerInterceptor {
-	const op = "alias.ResolutionInterceptor"
 	return func(interceptorCtx context.Context,
 		req any,
 		_ *grpc.UnaryServerInfo,
@@ -355,7 +354,16 @@ func aliasResolutionInterceptor(
 		}
 		interceptorCtx, err = alias.ResolveRequestIds(interceptorCtx, reqMsg, r)
 		if err != nil {
-			return nil, err
+			// Since this is intercepted prior to checking that the requester
+			// is authorized to make the request, returning a 404 here and a 401
+			// when the request is checked in the handler would expose which
+			// aliases exist. Instead, we return a unauthenticated error here so there
+			// is no way to distinguish between a missing alias and an existing
+			// alias that points to a destination the requester is not allowed
+			// to perform an action on.
+			// handlers.UnauthenticatedError() turns into an http 401 status
+			// code "Unauthorized".
+			return nil, handlers.UnauthenticatedError()
 		}
 		return handler(interceptorCtx, req)
 	}