fix: Missing revision on restore returns 404 instead of authorization error (#13249)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

server/commands/documentRestorer.ts

@@ -24,6 +24,7 @@ type Props = {
  * @param props - the document and restore options.
  * @returns the restored document.
  * @throws ValidationError if the destination collection is not active.
+ * @throws NotFoundError if the given revision does not exist.
  */
 async function documentRestorer(
   ctx: APIContext,
@@ -81,7 +82,10 @@ async function documentRestorer(
   } else if (revisionId) {
     // restore a document to a specific revision
     authorize(user, "update", document);
-    const revision = await Revision.findByPk(revisionId, { transaction });
+    const revision = await Revision.findByPk(revisionId, {
+      transaction,
+      rejectOnEmpty: true,
+    });
     authorize(document, "restore", revision);
 
     await document.restoreFromRevision(revision);

server/routes/api/documents/documents.test.ts

@@ -2935,6 +2935,23 @@ describe("#documents.restore", () => {
     expect(res.status).toEqual(403);
   });
 
+  it("should fail with not found for a revision that does not exist", async () => {
+    const user = await buildUser();
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const res = await server.post("/api/documents.restore", user, {
+      body: {
+        id: document.id,
+        revisionId: faker.string.uuid(),
+      },
+    });
+
+    expect(res.status).toEqual(404);
+  });
+
   it("should require id", async () => {
     const user = await buildUser();
     const document = await buildDocument({