Simplify OAS schema for GET /api/spaces/space query params

oas_docs/output/kibana.serverless.yaml

@@ -60024,23 +60024,9 @@ paths:
         - description: When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.
           in: query
           name: include_authorized_purposes
-          required: true
+          required: false
           schema:
-            anyOf:
-              - items: {}
-                type: array
-              - type: boolean
-              - type: number
-              - type: object
-              - type: string
-            nullable: true
-            oneOf:
-              - enum:
-                  - false
-                type: boolean
-                x-oas-optional: true
-              - type: boolean
-                x-oas-optional: true
+            type: boolean
       responses:
         '200':
           description: Indicates a successful call.

oas_docs/output/kibana.yaml

@@ -64466,23 +64466,9 @@ paths:
         - description: When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.
           in: query
           name: include_authorized_purposes
-          required: true
+          required: false
           schema:
-            anyOf:
-              - items: {}
-                type: array
-              - type: boolean
-              - type: number
-              - type: object
-              - type: string
-            nullable: true
-            oneOf:
-              - enum:
-                  - false
-                type: boolean
-                x-oas-optional: true
-              - type: boolean
-                x-oas-optional: true
+            type: boolean
       responses:
         '200':
           description: Indicates a successful call.

packages/kbn-api-contracts/allowlist.json

@@ -56,6 +56,13 @@
       "method": "put",
       "reason": "Optional package policy stream data_stream.type in 200 responses for OTel inputs with dynamic_signal_types (composable integrations).",
       "approvedBy": "elastic/fleet"
+    },
+    {
+      "path": "/api/spaces/space",
+      "method": "get",
+      "reason": "Replace schema.conditional with schema.maybe(schema.boolean()) for include_authorized_purposes query param. Runtime behavior is identical — the custom validate function still rejects include_authorized_purposes=true when purpose is set. The OAS type widens from conditional literal(false)/boolean to always boolean. TF provider codegen simplifies from union type to plain *bool, but the endpoint is unused in provider code.",
+      "approvedBy": "@elastic/kibana-security",
+      "prUrl": "https://github.com/elastic/kibana/pull/260831"
     }
   ]
 }

x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.test.ts

@@ -125,7 +125,7 @@ describe('GET /spaces/space', () => {
             expect(response.payload).toEqual(spaces);
           } else {
             expect(() => queryParamsValidation.validate(request.query)).toThrowError(
-              '[include_authorized_purposes]: expected value to equal [false]'
+              'include_authorized_purposes can only be false when purpose is specified'
             );
           }
         });

x-pack/platform/plugins/shared/spaces/server/routes/api/external/get_all.ts

@@ -36,35 +36,44 @@ export function initGetAllSpacesApi(deps: ExternalRouteDeps) {
         version: API_VERSIONS.public.v1,
         validate: {
           request: {
-            query: schema.object({
-              purpose: schema.maybe(
-                schema.oneOf(
-                  [
-                    schema.literal('any'),
-                    schema.literal('copySavedObjectsIntoSpace'),
-                    schema.literal('shareSavedObjectsIntoSpace'),
-                  ],
-                  {
+            query: schema.object(
+              {
+                purpose: schema.maybe(
+                  schema.oneOf(
+                    [
+                      schema.literal('any'),
+                      schema.literal('copySavedObjectsIntoSpace'),
+                      schema.literal('shareSavedObjectsIntoSpace'),
+                    ],
+                    {
+                      meta: {
+                        description:
+                          'Specifies which authorization checks are applied to the API call. The default value is `any`.',
+                      },
+                    }
+                  )
+                ),
+                include_authorized_purposes: schema.maybe(
+                  schema.boolean({
                     meta: {
                       description:
-                        'Specifies which authorization checks are applied to the API call. The default value is `any`.',
+                        'When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.',
                     },
+                  })
+                ),
+              },
+              {
+                validate: (value) => {
+                  if (
+                    value.purpose &&
+                    value.include_authorized_purposes !== undefined &&
+                    value.include_authorized_purposes !== false
+                  ) {
+                    return 'include_authorized_purposes can only be false when purpose is specified';
                   }
-                )
-              ),
-              include_authorized_purposes: schema.conditional(
-                schema.siblingRef('purpose'),
-                schema.string(),
-                schema.maybe(schema.literal(false)),
-                schema.maybe(schema.boolean()),
-                {
-                  meta: {
-                    description:
-                      'When enabled, the API returns any spaces that the user is authorized to access in any capacity and each space will contain the purposes for which the user is authorized. This can be useful to determine which spaces a user can read but not take a specific action in. If the security plugin is not enabled, this parameter has no effect, since no authorization checks take place. This parameter cannot be used in with the `purpose` parameter.',
-                  },
-                }
-              ),
-            }),
+                },
+              }
+            ),
           },
           response: {
             200: {