api/admin: fix error message when refusing to create template on temp…

…late

Fixes QubesOS/qubes-issues#4463

qubes/api/admin.py

@@ -992,12 +992,15 @@ def _vm_create(self, vm_type, allow_pool=False, untrusted_payload=None):
 
         # if argument is given, it needs to be a valid template, and only
         # when given VM class do need a template
-        if hasattr(vm_class, 'template'):
-            if self.arg:
-                self.enforce(self.arg in self.app.domains)
+        if self.arg:
+            if hasattr(vm_class, 'template'):
+                if self.arg not in self.app.domains:
+                    raise qubes.api.PermissionDenied(
+                        'Template {} does not exist'.format(self.arg))
                 kwargs['template'] = self.app.domains[self.arg]
-        else:
-            self.enforce(not self.arg)
+            else:
+                raise qubes.exc.QubesValueError(
+                    '{} cannot be based on template'.format(vm_type))
 
         for untrusted_param in untrusted_payload.decode('ascii',
                 errors='strict').split(' '):

qubes/tests/api_admin.py

@@ -1168,7 +1168,7 @@ def test_330_vm_create_standalone(self, storage_mock):
     @unittest.mock.patch('qubes.storage.Storage.create')
     def test_331_vm_create_standalone_spurious_template(self, storage_mock):
         storage_mock.side_effect = self.dummy_coro
-        with self.assertRaises(qubes.api.PermissionDenied):
+        with self.assertRaises(qubes.exc.QubesValueError):
             self.call_mgmt_func(b'admin.vm.Create.StandaloneVM',
                 b'dom0', b'test-template', b'name=test-vm2 label=red')