From a3f53e73ca116bee0a8df0f73d5c4fb5fc8e0d1f Mon Sep 17 00:00:00 2001 From: "Christiane (Tina) Heiligers" Date: Wed, 1 Apr 2026 14:20:21 -0700 Subject: [PATCH 1/6] Replace schema.conditional with schema.maybe(schema.boolean()) for include_authorized_purposes --- .../routes/api/external/get_all.test.ts | 2 +- .../server/routes/api/external/get_all.ts | 59 +++++++++++-------- 2 files changed, 35 insertions(+), 26 deletions(-) diff --git a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts index f5fc5349b7eb7..3bad5984cf5a4 100644 --- a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts +++ b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts @@ -125,7 +125,7 @@ describe('GET /spaces/space', () => { expect(response.payload).toEqual(spaces); } else { expect(() => queryParamsValidation.validate(request.query)).toThrowError( - '[include_authorized_purposes]: expected value to equal [false]' + 'include_authorized_purposes can only be false when purpose is specified' ); } }); diff --git a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts index 7803698ef9032..d66bb492fef56 100644 --- a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts +++ b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts @@ -36,35 +36,44 @@ export function initGetAllSpacesApi(deps: ExternalRouteDeps) { version: API_VERSIONS.public.v1, validate: { request: { - query: schema.object({ - purpose: schema.maybe( - schema.oneOf( - [ - schema.literal('any'), - schema.literal('copySavedObjectsIntoSpace'), - schema.literal('shareSavedObjectsIntoSpace'), - ], - { + query: schema.object( + { + purpose: schema.maybe( + schema.oneOf( + [ + schema.literal('any'), + schema.literal('copySavedObjectsIntoSpace'), + schema.literal('shareSavedObjectsIntoSpace'), + ], + { + meta: { + description: + 'Specifies which authorization checks are applied to the API call. The default value is `any`.', + }, + } + ) + ), + include_authorized_purposes: schema.maybe( + schema.boolean({ meta: { description: - 'Specifies which authorization checks are applied to the API call. The default value is `any`.', + 'When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.', }, + }) + ), + }, + { + validate: (value) => { + if ( + value.purpose && + value.include_authorized_purposes !== undefined && + value.include_authorized_purposes !== false + ) { + return 'include_authorized_purposes can only be false when purpose is specified'; } - ) - ), - include_authorized_purposes: schema.conditional( - schema.siblingRef('purpose'), - schema.string(), - schema.maybe(schema.literal(false)), - schema.maybe(schema.boolean()), - { - meta: { - description: - 'When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.', - }, - } - ), - }), + }, + } + ), }, response: { 200: { From 2015e55ddc971b16031143ce20e30744b8ae8fed Mon Sep 17 00:00:00 2001 From: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Date: Wed, 1 Apr 2026 23:23:42 +0000 Subject: [PATCH 2/6] Changes from make api-docs --- oas_docs/output/kibana.serverless.yaml | 18 ++---------------- oas_docs/output/kibana.yaml | 18 ++---------------- 2 files changed, 4 insertions(+), 32 deletions(-) diff --git a/oas_docs/output/kibana.serverless.yaml b/oas_docs/output/kibana.serverless.yaml index 20b117aa6272c..ecd8f30d93aaa 100644 --- a/oas_docs/output/kibana.serverless.yaml +++ b/oas_docs/output/kibana.serverless.yaml @@ -60024,23 +60024,9 @@ paths: - description: When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter. in: query name: include_authorized_purposes - required: true + required: false schema: - anyOf: - - items: {} - type: array - - type: boolean - - type: number - - type: object - - type: string - nullable: true - oneOf: - - enum: - - false - type: boolean - x-oas-optional: true - - type: boolean - x-oas-optional: true + type: boolean responses: '200': description: Indicates a successful call. diff --git a/oas_docs/output/kibana.yaml b/oas_docs/output/kibana.yaml index 5234bbee0e841..023043583ec67 100644 --- a/oas_docs/output/kibana.yaml +++ b/oas_docs/output/kibana.yaml @@ -64466,23 +64466,9 @@ paths: - description: When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter. in: query name: include_authorized_purposes - required: true + required: false schema: - anyOf: - - items: {} - type: array - - type: boolean - - type: number - - type: object - - type: string - nullable: true - oneOf: - - enum: - - false - type: boolean - x-oas-optional: true - - type: boolean - x-oas-optional: true + type: boolean responses: '200': description: Indicates a successful call. From 3fa1d29c8a76ac9950987560103a76a3dce48cc2 Mon Sep 17 00:00:00 2001 From: "Christiane (Tina) Heiligers" Date: Wed, 1 Apr 2026 19:33:40 -0700 Subject: [PATCH 3/6] allowlist spaces API breaking change for include_authorized_purposes schema simplification --- packages/kbn-api-contracts/allowlist.json | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/packages/kbn-api-contracts/allowlist.json b/packages/kbn-api-contracts/allowlist.json index de213ad39bb82..9d718aea8c42e 100644 --- a/packages/kbn-api-contracts/allowlist.json +++ b/packages/kbn-api-contracts/allowlist.json @@ -56,6 +56,13 @@ "method": "put", "reason": "Optional package policy stream data_stream.type in 200 responses for OTel inputs with dynamic_signal_types (composable integrations).", "approvedBy": "elastic/fleet" + }, + { + "path": "/api/spaces/space", + "method": "get", + "reason": "Replace schema.conditional with schema.maybe(schema.boolean()) for include_authorized_purposes query param. Runtime behavior is identical — the custom validate function still rejects include_authorized_purposes=true when purpose is set. The OAS type widens from conditional literal(false)/boolean to always boolean. TF provider codegen simplifies from union type to plain *bool, but the endpoint is unused in provider code.", + "approvedBy": "@elastic/kibana-security", + "prUrl": "https://github.com/elastic/kibana/pull/260831" } ] } From fdc0475c9b4471c1f9b125f4713bc6154f773a50 Mon Sep 17 00:00:00 2001 From: "Christiane (Tina) Heiligers" Date: Fri, 3 Apr 2026 09:17:27 -0700 Subject: [PATCH 4/6] Update x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts Co-authored-by: Florent LB --- .../plugins/shared/spaces/server/routes/api/external/get_all.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts index d66bb492fef56..bd2a3ec95f386 100644 --- a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts +++ b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts @@ -57,7 +57,7 @@ export function initGetAllSpacesApi(deps: ExternalRouteDeps) { schema.boolean({ meta: { description: - 'When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.', + 'When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter can't be used together with the `purpose` parameter., }, }) ), From 4d04f0a3068dde5df17df343efebfa450a2da5cc Mon Sep 17 00:00:00 2001 From: "Christiane (Tina) Heiligers" Date: Fri, 3 Apr 2026 10:43:31 -0700 Subject: [PATCH 5/6] Update x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts --- .../plugins/shared/spaces/server/routes/api/external/get_all.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts index bd2a3ec95f386..210856672c371 100644 --- a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts +++ b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts @@ -57,7 +57,7 @@ export function initGetAllSpacesApi(deps: ExternalRouteDeps) { schema.boolean({ meta: { description: - 'When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter can't be used together with the `purpose` parameter., + 'When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter can't be used together with the `purpose` parameter.' }, }) ), From 3efb7038931be7deb0ff794456e7a112cc4d4318 Mon Sep 17 00:00:00 2001 From: "Christiane (Tina) Heiligers" Date: Fri, 3 Apr 2026 12:05:38 -0700 Subject: [PATCH 6/6] fix unescaped apostrophe in description string and regenerate OAS output --- oas_docs/output/kibana.serverless.yaml | 2 +- oas_docs/output/kibana.yaml | 2 +- .../plugins/shared/spaces/server/routes/api/external/get_all.ts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/oas_docs/output/kibana.serverless.yaml b/oas_docs/output/kibana.serverless.yaml index ecd8f30d93aaa..ed7b21edae5ee 100644 --- a/oas_docs/output/kibana.serverless.yaml +++ b/oas_docs/output/kibana.serverless.yaml @@ -60021,7 +60021,7 @@ paths: - copySavedObjectsIntoSpace - shareSavedObjectsIntoSpace type: string - - description: When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter. + - description: When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter. in: query name: include_authorized_purposes required: false diff --git a/oas_docs/output/kibana.yaml b/oas_docs/output/kibana.yaml index 023043583ec67..e3468d31e99a0 100644 --- a/oas_docs/output/kibana.yaml +++ b/oas_docs/output/kibana.yaml @@ -64463,7 +64463,7 @@ paths: - copySavedObjectsIntoSpace - shareSavedObjectsIntoSpace type: string - - description: When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter. + - description: When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter. in: query name: include_authorized_purposes required: false diff --git a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts index 210856672c371..47b8c18d9acd8 100644 --- a/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts +++ b/x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts @@ -57,7 +57,7 @@ export function initGetAllSpacesApi(deps: ExternalRouteDeps) { schema.boolean({ meta: { description: - 'When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter can't be used together with the `purpose` parameter.' + 'When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter.', }, }) ),