[Synthetics] Validate private location spaces for multi-space monitors

x-pack/solutions/observability/plugins/synthetics/public/apps/synthetics/components/monitor_add_edit/form/field_config.tsx

@@ -52,6 +52,7 @@ import {
   FieldPassword,
   Checkbox,
   ComboBox,
+  LocationsComboBox,
   Select,
   Switch,
   Source,
@@ -428,7 +429,7 @@ export const FIELD = (readOnly?: boolean): FieldMap => ({
     fieldKey: ConfigKey.LOCATIONS,
     required: true,
     controlled: true,
-    component: ComboBox,
+    component: LocationsComboBox,
     label: i18n.translate('xpack.synthetics.monitorConfig.locations.label', {
       defaultMessage: 'Locations',
     }),
@@ -1345,7 +1346,7 @@ export const FIELD = (readOnly?: boolean): FieldMap => ({
         id="xpack.synthetics.monitorConfig.throttlingDisabled.label"
         defaultMessage="Connection profile ( {icon} Important information about throttling: {link})"
         values={{
-          icon: <EuiIcon type="alert" color="warning" size="s" />,
+          icon: <EuiIcon type="alert" color="warning" size="s" aria-hidden={true} />,
           link: (
             <EuiLink
               data-test-subj="syntheticsFIELDNoticeLink"

x-pack/solutions/observability/plugins/synthetics/public/apps/synthetics/components/monitor_add_edit/form/field_wrappers.tsx

@@ -8,6 +8,7 @@
 import type { Ref } from 'react';
 import React from 'react';
 import { omit } from 'lodash';
+import { i18n } from '@kbn/i18n';
 import type { ControllerRenderProps } from 'react-hook-form';
 import type {
   EuiFieldTextProps,
@@ -30,6 +31,8 @@ import {
   EuiButtonGroup,
   EuiComboBox,
   EuiTextArea,
+  EuiText,
+  EuiSpacer,
 } from '@elastic/eui';
 import type { MonitorSpacesProps } from '../fields/monitor_spaces';
 import { MonitorSpaces } from '../fields/monitor_spaces';
@@ -119,6 +122,36 @@ export const ComboBox = React.forwardRef<unknown, EuiComboBoxProps<unknown>>((pr
   <EuiComboBox {...omit(props, ['isServiceManaged'])} />
 ));
 
+export const LocationsComboBox = React.forwardRef<unknown, EuiComboBoxProps<unknown>>(
+  (props, _ref) => {
+    const { selectedOptions, options } = props;
+    const optionIds = new Set((options ?? []).map((o) => o.id));
+    const unavailableLocations = (selectedOptions ?? []).filter(
+      (sel) =>
+        !(sel as unknown as { isServiceManaged?: boolean }).isServiceManaged &&
+        !optionIds.has(sel.id)
+    );
+
+    return (
+      <>
+        <EuiComboBox {...omit(props, ['isServiceManaged'])} />
+        {unavailableLocations.length > 0 && (
+          <>
+            <EuiSpacer size="xs" />
+            <EuiText size="xs" color="danger">
+              {i18n.translate('xpack.synthetics.monitorConfig.locations.notInSpaceWarning', {
+                defaultMessage:
+                  '{count, plural, one {# private location is} other {# private locations are}} not available in all spaces this monitor is shared to. Share the {count, plural, one {location} other {locations}} to all monitor spaces, or remove {count, plural, one {it} other {them}} from the monitor.',
+                values: { count: unavailableLocations.length },
+              })}
+            </EuiText>
+          </>
+        )}
+      </>
+    );
+  }
+);
+
 export const JSONEditor = React.forwardRef<unknown, DefaultCodeEditorProps>((props, _ref) => (
   <DefaultJSONEditor {...props} />
 ));

x-pack/solutions/observability/plugins/synthetics/server/mocks/server_mock.ts

@@ -45,6 +45,21 @@ export const getServerMock = () => {
       },
     },
     encryptedSavedObjects: mockEncryptedSO(),
+    coreStart: {
+      savedObjects: {
+        createInternalRepository: jest.fn().mockReturnValue({
+          createPointInTimeFinder: jest.fn().mockImplementation(() => ({
+            close: jest.fn(async () => {}),
+            find: jest.fn().mockReturnValue({
+              async *[Symbol.asyncIterator]() {
+                yield { saved_objects: [] };
+              },
+            }),
+          })),
+          get: jest.fn(),
+        }),
+      },
+    },
   } as unknown as SyntheticsServerSetup;
 
   return serverMock;

x-pack/solutions/observability/plugins/synthetics/server/routes/monitor_cruds/add_monitor.ts

@@ -19,10 +19,15 @@ import {
 import type { CreateMonitorPayLoad } from './add_monitor/add_monitor_api';
 import { AddEditMonitorAPI } from './add_monitor/add_monitor_api';
 import type { SyntheticsRestApiRouteFactory } from '../types';
+import { ConfigKey } from '../../../common/runtime_types';
 import { SYNTHETICS_API_URLS } from '../../../common/constants';
 import { normalizeAPIConfig, validateMonitor } from './monitor_validation';
 import { mapSavedObjectToMonitor } from './formatters/saved_object_to_monitor';
 import { getBrowserTimeoutWarningForMonitor } from './monitor_warnings';
+import {
+  assertCanUpdateMonitorInAllSpaces,
+  validateMonitorPrivateLocationSpaces,
+} from './monitor_locations_utils';
 
 export const addSyntheticsMonitorRoute: SyntheticsRestApiRouteFactory = () => ({
   method: 'POST',
@@ -128,6 +133,29 @@ export const addSyntheticsMonitorRoute: SyntheticsRestApiRouteFactory = () => ({
         });
       }
 
+      const monitorSpaces = normalizedMonitor[ConfigKey.KIBANA_SPACES] ?? [];
+      if (monitorSpaces.length > 0) {
+        const spaceAuthError = await assertCanUpdateMonitorInAllSpaces(routeContext, monitorSpaces);
+        if (spaceAuthError) {
+          return spaceAuthError;
+        }
+      }
+
+      if (addMonitorAPI.allPrivateLocations && addMonitorAPI.allPrivateLocations.length > 0) {
+        const plSpaceError = validateMonitorPrivateLocationSpaces(
+          normalizedMonitor,
+          addMonitorAPI.allPrivateLocations
+        );
+        if (plSpaceError) {
+          return response.badRequest({
+            body: {
+              message: plSpaceError.message,
+              attributes: plSpaceError.attributes,
+            },
+          });
+        }
+      }
+
       const { errors, newMonitor } = await addMonitorAPI.syncNewMonitor({
         id,
         normalizedMonitor,

x-pack/solutions/observability/plugins/synthetics/server/routes/monitor_cruds/add_monitor/add_monitor_api.ts

@@ -42,7 +42,7 @@ import { DefaultRuleService } from '../../default_alerts/default_alert_service';
 import type { RouteContext } from '../../types';
 import { formatTelemetryEvent, sendTelemetryEvents } from '../../telemetry/monitor_upgrade_sender';
 import { formatKibanaNamespace } from '../../../../common/formatters';
-import { getPrivateLocations } from '../../../synthetics_service/get_private_locations';
+import { getPrivateLocationsForNamespaces } from '../../../synthetics_service/get_private_locations';
 
 export type CreateMonitorPayLoad = MonitorFields & {
   url?: string;
@@ -199,7 +199,16 @@ export class AddEditMonitorAPI {
       const monitorLocations = parseMonitorLocations(monitorPayload, prevLocations, internal);
 
       if (monitorLocations.privateLocations.length > 0) {
-        this.allPrivateLocations = await getPrivateLocations(savedObjectsClient);
+        const monitorSpaces = monitor[ConfigKey.KIBANA_SPACES] ?? [];
+        const namespacesForLookup = [
+          ...new Set([this.routeContext.spaceId, ...monitorSpaces]),
+        ].filter(Boolean);
+        const internalClient =
+          this.routeContext.server.coreStart.savedObjects.createInternalRepository();
+        this.allPrivateLocations = await getPrivateLocationsForNamespaces(
+          internalClient,
+          namespacesForLookup
+        );
       } else {
         this.allPrivateLocations = [];
       }

x-pack/solutions/observability/plugins/synthetics/server/routes/monitor_cruds/edit_monitor.ts

@@ -18,8 +18,12 @@ import {
 import type { CreateMonitorPayLoad } from './add_monitor/add_monitor_api';
 import { AddEditMonitorAPI } from './add_monitor/add_monitor_api';
 import { ELASTIC_MANAGED_LOCATIONS_DISABLED } from './project_monitor/add_monitor_project';
-import { getPrivateLocations } from '../../synthetics_service/get_private_locations';
+import { getPrivateLocationsForNamespaces } from '../../synthetics_service/get_private_locations';
 import { mergeSourceMonitor } from './formatters/saved_object_to_monitor';
+import {
+  assertCanUpdateMonitorInAllSpaces,
+  validateMonitorPrivateLocationSpaces,
+} from './monitor_locations_utils';
 import type { RouteContext, SyntheticsRestApiRouteFactory } from '../types';
 import type {
   MonitorFields,
@@ -141,6 +145,32 @@ export const editSyntheticsMonitorRoute: SyntheticsRestApiRouteFactory = () => (
         });
       }
 
+      const editedMonitorSpaces = (editedMonitor as MonitorFields)[ConfigKey.KIBANA_SPACES] ?? [];
+      if (editedMonitorSpaces.length > 0) {
+        const spaceAuthError = await assertCanUpdateMonitorInAllSpaces(
+          routeContext,
+          editedMonitorSpaces
+        );
+        if (spaceAuthError) {
+          return spaceAuthError;
+        }
+      }
+
+      if (editMonitorAPI.allPrivateLocations && editMonitorAPI.allPrivateLocations.length > 0) {
+        const plSpaceError = validateMonitorPrivateLocationSpaces(
+          editedMonitor as MonitorFields,
+          editMonitorAPI.allPrivateLocations
+        );
+        if (plSpaceError) {
+          return response.badRequest({
+            body: {
+              message: plSpaceError.message,
+              attributes: plSpaceError.attributes,
+            },
+          });
+        }
+      }
+
       const monitorWithRevision = {
         ...validationResult.decodedMonitor,
         /* reset config hash to empty string. Ensures that the synthetics agent is able
@@ -276,7 +306,13 @@ export const syncEditedMonitor = async ({
     };
     const formattedMonitor = formatSecrets(monitorWithId);
 
-    const allPrivateLocations = await getPrivateLocations(savedObjectsClient);
+    const monitorSpaces = (monitorWithId as MonitorFields)[ConfigKey.KIBANA_SPACES] ?? [];
+    const namespacesForLookup = [...new Set([spaceId, ...monitorSpaces])].filter(Boolean);
+    const internalClient = server.coreStart.savedObjects.createInternalRepository();
+    const allPrivateLocations = await getPrivateLocationsForNamespaces(
+      internalClient,
+      namespacesForLookup
+    );
 
     const [editedMonitorSavedObject, { publicSyncErrors, failedPolicyUpdates }] = await Promise.all(
       [