Simply error surfacing

client/server/server.go

@@ -2932,7 +2932,7 @@ func targetFromMatch(id ipcauth.Identity, handle string, match profilemanager.Ha
 
 	switch {
 	case len(owned) == 1:
-		return ipcauth.Target{Path: owned[0].Path, Owned: true}, nil
+		return targetForProfile(owned[0], true), nil
 
 	case len(owned) > 1:
 		return ipcauth.Target{}, gstatus.Errorf(codes.InvalidArgument, "%v", &profilemanager.ErrAmbiguousHandle{
@@ -2943,13 +2943,25 @@ func targetFromMatch(id ipcauth.Identity, handle string, match profilemanager.Ha
 
 	case len(match.Profiles) > 0:
 		// The handle names a profile that is real but not the caller's.
-		return ipcauth.Target{Path: match.Profiles[0].Path}, nil
+		return targetForProfile(match.Profiles[0], false), nil
 
 	default:
 		return ipcauth.Target{}, gstatus.Errorf(codes.NotFound, "profile %q not found", handle)
 	}
 }
 
+// targetForProfile describes a resolved profile for the gate. UnOwned comes
+// off the profile rather than from owned, since a privileged caller may address
+// a profile nobody has claimed.
+func targetForProfile(p profilemanager.Profile, owned bool) ipcauth.Target {
+	return ipcauth.Target{
+		Path:    p.Path,
+		Owned:   owned,
+		UnOwned: len(p.Owners) == 0,
+		Handle:  p.ID.String(),
+	}
+}
+
 // matchHandleError renders a failed match as something the caller can act on.
 func matchHandleError(handle string, err error) error {
 	if errors.Is(err, profilemanager.ErrProfileNotFound) {

client/server/server_resolvetarget_test.go

@@ -137,6 +137,28 @@ func TestResolveTarget_AnotherUsersProfileIsNotOwned(t *testing.T) {
 	target, err := s.ResolveTarget(foreignIdentity(), activeProfile)
 	require.NoError(t, err, "the profile is there, so nothing about the handle is wrong")
 	require.False(t, target.Owned, "a profile the caller does not own is not theirs to act on")
+	require.False(t, target.UnOwned, "it has an owner, just not this caller")
+}
+
+// A profile nobody has claimed resolves like any other and reports itself
+// unowned, so the refusal can point at the claim.
+func TestResolveTarget_UnownedProfileResolvesAsUnOwned(t *testing.T) {
+	s, _, _, _, _ := setupServerWithProfile(t)
+
+	// Not the default profile, whose own claim path would stamp an owner on it
+	// the moment a caller at a console resolved it.
+	unowned := "unowned-profile"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    filepath.Join(profilemanager.DefaultConfigPathDir, unowned+".json"),
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+
+	target, err := s.ResolveTarget(unprivilegedIdentity(), unowned)
+	require.NoError(t, err, "the profile is there, so nothing about the handle is wrong")
+	require.False(t, target.Owned, "an unclaimed profile is nobody's to act on")
+	require.True(t, target.UnOwned, "nothing was ever stamped on it")
+	require.Equal(t, unowned, target.Handle, "the refusal names this in the claim command")
 }
 
 // Only a handle matching two of the caller's own profiles is genuinely