From b1957db1e0327f4edeb7aefe6baa759593bf937c Mon Sep 17 00:00:00 2001
From: hc-github-team-nomad-core
 <82989552+hc-github-team-nomad-core@users.noreply.github.com>
Date: Tue, 14 Feb 2023 11:49:51 -0500
Subject: [PATCH] eventstream: Handle missing policy documents in event streams
 (#15495) (#16177)

Fixes https://github.com/hashicorp/nomad/issues/15493

Co-authored-by: Will Nicholson <5702746+wjnicholson@users.noreply.github.com>
---
 .changelog/15495.txt         | 3 +++
 nomad/stream/event_broker.go | 7 ++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 .changelog/15495.txt

diff --git a/.changelog/15495.txt b/.changelog/15495.txt
new file mode 100644
index 00000000000..77b38170ce8
--- /dev/null
+++ b/.changelog/15495.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+event stream: Fixed a bug where undefined ACL policies on the request's ACL would result in incorrect authentication errors
+```
diff --git a/nomad/stream/event_broker.go b/nomad/stream/event_broker.go
index e619968e0ab..4aa9ca40af6 100644
--- a/nomad/stream/event_broker.go
+++ b/nomad/stream/event_broker.go
@@ -275,9 +275,14 @@ func aclObjFromSnapshotForTokenSecretID(aclSnapshot ACLTokenProvider, aclCache *
 	aclPolicies := make([]*structs.ACLPolicy, 0, len(aclToken.Policies))
 	for _, policyName := range aclToken.Policies {
 		policy, err := aclSnapshot.ACLPolicyByName(nil, policyName)
-		if err != nil || policy == nil {
+		if err != nil {
 			return nil, errors.New("error finding acl policy")
 		}
+		if policy == nil {
+			// Ignore policies that don't exist, since they don't grant any
+			// more privilege.
+			continue
+		}
 		aclPolicies = append(aclPolicies, policy)
 	}