Address review: require query for dynamic labels, move platform validation into switch

- Dynamic case now rejects empty query (matches GitOps parser)
- Platform validation moved inside dynamic case only (manual/host_vitals
  already reject any platform, so the top-level check was misleading)
- Added test for dynamic label missing query

Author: sharon-fdm

server/service/labels.go

@@ -563,12 +563,6 @@ func (svc *Service) ApplyLabelSpecs(ctx context.Context, specs []*fleet.LabelSpe
 	var specLabelNamesNeedingMoving []string // should match namesToMove once specs have been checked
 
 	for _, spec := range specs {
-		if _, ok := fleet.ValidLabelPlatformVariants[spec.Platform]; !ok {
-			return fleet.NewUserMessageError(
-				ctxerr.Errorf(ctx, "invalid platform: %s", spec.Platform), http.StatusUnprocessableEntity,
-			)
-		}
-
 		// Validate mutually exclusive field combinations per label membership type
 		switch spec.LabelMembershipType {
 		case fleet.LabelMembershipTypeManual:
@@ -588,6 +582,11 @@ func (svc *Service) ApplyLabelSpecs(ctx context.Context, specs []*fleet.LabelSpe
 				)
 			}
 		case fleet.LabelMembershipTypeDynamic:
+			if spec.Query == "" {
+				return fleet.NewUserMessageError(
+					ctxerr.Errorf(ctx, "label %s is declared as dynamic but is missing a query", spec.Name), http.StatusUnprocessableEntity,
+				)
+			}
 			if spec.HostVitalsCriteria != nil {
 				return fleet.NewUserMessageError(
 					ctxerr.Errorf(ctx, "label %s is declared as dynamic but contains criteria", spec.Name), http.StatusUnprocessableEntity,
@@ -598,6 +597,11 @@ func (svc *Service) ApplyLabelSpecs(ctx context.Context, specs []*fleet.LabelSpe
 					ctxerr.Errorf(ctx, "label %s is declared as dynamic but contains hosts", spec.Name), http.StatusUnprocessableEntity,
 				)
 			}
+			if _, ok := fleet.ValidLabelPlatformVariants[spec.Platform]; !ok {
+				return fleet.NewUserMessageError(
+					ctxerr.Errorf(ctx, "label %s has invalid platform: %s", spec.Name, spec.Platform), http.StatusUnprocessableEntity,
+				)
+			}
 		case fleet.LabelMembershipTypeHostVitals:
 			if spec.HostVitalsCriteria == nil {
 				return fleet.NewUserMessageError(

server/service/labels_test.go

@@ -768,6 +768,16 @@ func TestApplyLabelSpecsManualLabelNilHosts(t *testing.T) {
 	require.Error(t, err)
 	require.ErrorContains(t, err, "declared as dynamic but contains hosts")
 
+	// Dynamic label without query should be rejected
+	err = svc.ApplyLabelSpecs(ctx, []*fleet.LabelSpec{
+		{
+			Name:                "dynamic_no_query",
+			LabelMembershipType: fleet.LabelMembershipTypeDynamic,
+		},
+	}, nil, nil)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "declared as dynamic but is missing a query")
+
 	// Dynamic label with criteria should be rejected
 	err = svc.ApplyLabelSpecs(ctx, []*fleet.LabelSpec{
 		{