[Synthetics] Validate private location spaces for multi-space monitors by benakansara · Pull Request #260642 · elastic/kibana

benakansara · 2026-04-01T08:41:36Z

Summary

Multi-space monitors can reference private locations that are not shared to all the monitor's spaces. This caused confusing red error boxes in the UI when editing from a space where the location isn't available, and allowed invalid monitor configurations to be persisted silently.

This PR adds server-side validation to enforce that every private location assigned to a monitor is available in all spaces the monitor is shared to, for both UI and project monitors. It also improves the UI to surface a clear, actionable warning when a selected private location is not available in all monitor spaces.

Testing

Prerequisites

Two spaces: default and space-a
A private location shared only to default (not space-a)
A user with monitor permissions in both spaces

UI monitor - create

From default space, create a monitor.
Set Kibana spaces to [default, space-a].
Select the private location (shared only to default space).
Expected: Save is blocked with: "The following private locations are not available in all spaces this monitor is shared to: . Either share the private locations to all monitor spaces, or remove those spaces from the monitor."
Also verify a red warning appears below the locations picker before even saving.

UI monitor - edit

Step 1 - Create the bad state on main

Make sure you have two spaces: default and space-a
Create a private location
Share the private location only to default space (not space-a)
Go to Synthetics -> Create Monitor from default space
Set Kibana spaces to [default, space-a]
Select the private location
Save - it will succeed (no validation on main)

Step 2 - Switch back to PR branch

Step 3 - Test the edit flow

Scenario A - edit from default space (where private location exists):
- Open the monitor from default space
- Make any change (e.g. change the monitor name)
- Click Save
- Expected: 400 error: "The following private locations are not available in all spaces this monitor is shared to: . Either share the private locations to all monitor spaces, or remove those spaces from the monitor."
- Also verify the red warning text is visible below the locations picker
Scenario B - edit from space-a (where private location is not available):
- Switch to space-a
- Open the same monitor
- Expected: The private location chip appears in red in the locations field, and the red warning message is shown below the combo box
- Try to save -> same 400 error as Scenario A
Scenario C - fix and save:
- From either space, remove space-a from the spaces field (or remove the private location)
- Save
- Expected: Saves successfully, no error

Authorization check

As a user with monitor permissions in default but not space-a, open a monitor shared to both spaces.
Try to save any change.
Expected: 403 error: "This monitor is shared to spaces where you do not have update permissions. To save changes, either request access to those spaces or remove them from the monitor."

Project monitors

Push a project monitor config with a private location that isn't shared to all the monitor's spaces.
Expected: API returns a validation error identifying the location and missing spaces.

Monitors with only public locations

Monitors using only public locations should create/edit without any new errors.

Single-space monitors

Monitors in a single space with a private location in that space should work as before.

…cations

elasticmachine · 2026-04-13T11:21:32Z

💔 Build Failed

Buildkite Build
Commit: 458cd06

Failed CI Steps

Test Failures

[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store Logs Extraction with pagination (max 5 docs per page) - Should extract properly extract host with pagination
[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store Logs Extraction with pagination (max 5 docs per page) - Should extract properly extract host with pagination

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`synthetics`	1.1MB	1.1MB	+796.0B

History

cc @benakansara

macroscopeapp · 2026-04-27T15:42:15Z

Catch flakiness early (recommended)

Recommended before merge: run the flaky test runner against this PR to catch flakiness early.

New async API calls (sharePrivateLocationToSpaces) were added to legacy_and_multispace_monitor_api.ts, introducing state-mutating network requests in test setup that both configs exercise.

Trigger a run with the Flaky Test Runner UI or post this comment on the PR:

/flaky ftrConfig:x-pack/solutions/observability/test/api_integration_deployment_agnostic/configs/serverless/oblt.synthetics.serverless.config.ts:30 ftrConfig:x-pack/solutions/observability/test/api_integration_deployment_agnostic/configs/stateful/oblt.stateful.config.ts:30

^{Share feedback in the #appex-qa channel.}

^{Posted via Macroscope — Flaky Test Runner nudge}

cauemarcondes

Obs UI changes LGTM

shahzad31 · 2026-04-30T12:20:18Z

+    server.security.authz.checkSavedObjectsPrivilegesWithRequest(request);
+
+  const { hasAllRequested } = await checkSavedObjectsPrivileges(
+    'saved_object:synthetics-monitor/bulk_update',


Suggested change

'saved_object:synthetics-monitor/bulk_update',

'synthetics-monitor-multi-space/bulk_update' //. or it would synthetics-monitor depending on type,

i just realized this is a bug,synthetics-monitor is only single space monitor, when we start supporting multi space monitor, you will need to check against synthetics-monitor-multi-space

so i think in edit route when you fetch saved object, you can see it's type and based on that we will need to check which saved object to use.

Fixed in 331ac59

Also, applied the fix in edit_private_location.ts. When editing a private location, the checkPrivileges was using saved_object:synthetics-monitor/bulk_update: 2baeb18

shahzad31

LGTM !!

kibanamachine · 2026-05-04T10:09:50Z

💚 Build Succeeded

Buildkite Build
Commit: 125c036

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`synthetics`	1.1MB	1.1MB	+796.0B

History

💚 Build #436609 succeeded 94d542e
💚 Build #434648 succeeded de80e6e
💔 Build #434534 failed fe0f41c
💔 Build #434499 failed 6257c10
💔 Build #434482 failed c63fd76
💔 Build #434425 failed efedd66

cc @benakansara

elastic#260642) Resolves elastic#233434, elastic#247904 ## Summary Multi-space monitors can reference private locations that are not shared to all the monitor's spaces. This caused confusing red error boxes in the UI when editing from a space where the location isn't available, and allowed invalid monitor configurations to be persisted silently. This PR adds server-side validation to enforce that every private location assigned to a monitor is available in all spaces the monitor is shared to, for both UI and project monitors. It also improves the UI to surface a clear, actionable warning when a selected private location is not available in all monitor spaces. ## Testing ### Prerequisites - Two spaces: default and space-a - A private location shared only to default (not space-a) - A user with monitor permissions in both spaces ### UI monitor - create - From default space, create a monitor. - Set Kibana spaces to [default, space-a]. - Select the private location (shared only to default space). - Expected: Save is blocked with: "The following private locations are not available in all spaces this monitor is shared to: <name>. Either share the private locations to all monitor spaces, or remove those spaces from the monitor." - Also verify a red warning appears below the locations picker before even saving. ### UI monitor - edit **Step 1 - Create the bad state on main** - Make sure you have two spaces: default and space-a - Create a private location - Share the private location only to default space (not space-a) - Go to Synthetics -> Create Monitor from default space - Set Kibana spaces to [default, space-a] - Select the private location - Save - it will succeed (no validation on main) **Step 2 - Switch back to PR branch** **Step 3 - Test the edit flow** - Scenario A - edit from default space (where private location exists): - Open the monitor from default space - Make any change (e.g. change the monitor name) - Click Save - Expected: 400 error: "The following private locations are not available in all spaces this monitor is shared to: <name>. Either share the private locations to all monitor spaces, or remove those spaces from the monitor." - Also verify the red warning text is visible below the locations picker - Scenario B - edit from space-a (where private location is not available): - Switch to space-a - Open the same monitor - Expected: The private location chip appears in red in the locations field, and the red warning message is shown below the combo box - Try to save -> same 400 error as Scenario A - Scenario C - fix and save: - From either space, remove space-a from the spaces field (or remove the private location) - Save - Expected: Saves successfully, no error ### Authorization check - As a user with monitor permissions in default but not space-a, open a monitor shared to both spaces. - Try to save any change. - Expected: 403 error: "This monitor is shared to spaces where you do not have update permissions. To save changes, either request access to those spaces or remove them from the monitor." ### Project monitors - Push a project monitor config with a private location that isn't shared to all the monitor's spaces. - Expected: API returns a validation error identifying the location and missing spaces. ### Monitors with only public locations - Monitors using only public locations should create/edit without any new errors. ### Single-space monitors - Monitors in a single space with a private location in that space should work as before. --------- Co-authored-by: Shahzad <shahzad31comp@gmail.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

PR elastic#270540's monitor_integration_health_api.{ts,test.ts} import getPrivateLocationsForNamespaces, which was added on main by PR elastic#260642 but does not exist on 9.4 yet — causing 5 type errors in CI. Port the symbol verbatim from main: add the multi-namespace export and rewrite getPrivateLocations as a one-line wrapper. The public signature of getPrivateLocations is preserved, so all existing 9.4 callers are unaffected. Co-authored-by: Cursor <cursoragent@cursor.com>

validate private location spaces for multi-space monitors

e6ab82e

benakansara self-assigned this Apr 1, 2026

github-actions Bot added the author:actionable-obs PRs authored by the actionable obs team label Apr 1, 2026

benakansara added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting and removed author:actionable-obs PRs authored by the actionable obs team labels Apr 1, 2026

macroscopeapp Bot reviewed Apr 1, 2026

View reviewed changes

Comment thread x-pack/solutions/observability/plugins/synthetics/server/routes/monitor_cruds/edit_monitor.ts

benakansara and others added 2 commits April 1, 2026 10:57

fix validation bypass when editing monitor spaces without changing lo…

3eefe79

…cations

Merge branch 'main' into feat/multi-space-monitors-and-private-locations

b503818

benakansara marked this pull request as ready for review April 1, 2026 09:01

benakansara requested a review from a team as a code owner April 1, 2026 09:01

benakansara linked an issue Apr 1, 2026 that may be closed by this pull request

[Synthetics] Editing a multi-space monitor with a single-space private location shows an error #247904

Closed

benakansara and others added 3 commits April 1, 2026 12:13

fix types

c139955

Merge branch 'main' into feat/multi-space-monitors-and-private-locations

fb46fda

Merge branch 'main' into feat/multi-space-monitors-and-private-locations

458cd06

benakansara and others added 3 commits April 27, 2026 15:11

Merge branch 'main' into feat/multi-space-monitors-and-private-locations

9cf7606

remove unused translation key

9f01d59

share private location to spaces

a15a34c

update tests

ead32a2

benakansara requested a review from a team as a code owner April 27, 2026 16:48

kibanamachine added 2 commits April 27, 2026 16:54

Changes from node scripts/lint_ts_projects --fix

85dbfd7

Changes from node scripts/regenerate_moon_projects.js --update

efedd66

elastic-vault-github-plugin-prod Bot requested a review from a team as a code owner April 27, 2026 17:06

cauemarcondes approved these changes Apr 27, 2026

View reviewed changes

benakansara and others added 4 commits April 27, 2026 21:01

update tests

c63fd76

update tests

6257c10

Merge branch 'main' into feat/multi-space-monitors-and-private-locations

fe0f41c

Merge branch 'main' into feat/multi-space-monitors-and-private-locations

de80e6e

steliosmavro approved these changes Apr 28, 2026

View reviewed changes

shahzad31 reviewed Apr 30, 2026

View reviewed changes

benakansara and others added 3 commits April 30, 2026 19:18

use correct so type

331ac59

use correct so type when editing private location

2baeb18

Merge branch 'main' into feat/multi-space-monitors-and-private-locations

94d542e

shahzad31 approved these changes May 1, 2026

View reviewed changes

Merge branch 'main' into feat/multi-space-monitors-and-private-locations

125c036

benakansara merged commit a80721e into elastic:main May 4, 2026
24 checks passed

kibanamachine added the v9.5.0 label May 4, 2026

benakansara added the author:actionable-obs PRs authored by the actionable obs team label May 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Synthetics] Validate private location spaces for multi-space monitors#260642

[Synthetics] Validate private location spaces for multi-space monitors#260642
benakansara merged 20 commits into
elastic:mainfrom
benakansara:feat/multi-space-monitors-and-private-locations

benakansara commented Apr 1, 2026

Uh oh!

Uh oh!

elasticmachine commented Apr 13, 2026 •

edited

Loading

Uh oh!

macroscopeapp Bot commented Apr 27, 2026

Uh oh!

cauemarcondes left a comment

Uh oh!

shahzad31 Apr 30, 2026

Uh oh!

benakansara Apr 30, 2026

Uh oh!

shahzad31 left a comment

Uh oh!

kibanamachine commented May 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

	'saved_object:synthetics-monitor/bulk_update',
	'synthetics-monitor-multi-space/bulk_update' //. or it would synthetics-monitor depending on type,

Conversation

benakansara commented Apr 1, 2026

Summary

Testing

Prerequisites

UI monitor - create

UI monitor - edit

Authorization check

Project monitors

Monitors with only public locations

Single-space monitors

Uh oh!

Uh oh!

elasticmachine commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

History

Uh oh!

macroscopeapp Bot commented Apr 27, 2026

Catch flakiness early (recommended)

Uh oh!

cauemarcondes left a comment

Choose a reason for hiding this comment

Uh oh!

shahzad31 Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

benakansara Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

shahzad31 left a comment

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented May 4, 2026

💚 Build Succeeded

Metrics [docs]

Async chunks

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

elasticmachine commented Apr 13, 2026 •

edited

Loading