[Fleet] GET fleet/agent_policies returns space ids unavailable to the user

[jillguyonnet]

This was discovered while investigating #193827.

Description

GET fleet/agent_policies always returns all space ids assigned to each agent policy. This means that a user with access to only some of these spaces is able to see the ids of unavailable spaces.

In contrast, GET fleet/agent_policies/<policyId> returns ? for space ids unavailable to the user.

Expectation

GET fleet/agent_policies should return ? for unavailable spaces.

Explanation

This difference comes from the Saved Object API.

GET fleet/agent_policies is handled by agentPolicy.list, which uses soClient.find, which returns all the space ids:

kibana/x-pack/plugins/fleet/server/services/agent_policy.ts

Lines 615 to 618 in 04d04d9

	agentPoliciesSO = await soClient.find<AgentPolicySOAttributes>({
	...baseFindParams,
	filter,
	});

In contrast, GET fleet/agent_policies/<policyId> is handled by agentPolicy.get, which uses soClient.get, which returns ? for unavailable space ids:

kibana/x-pack/plugins/fleet/server/services/agent_policy.ts

Line 480 in 04d04d9

const agentPolicySO = await soClient.get<AgentPolicySOAttributes>(savedObjectType, id);

Steps to reproduce

1. Define a custom space (Space1).
2. Create an agent policy and assign it to the Default and Space1 spaces.
3. Create a role with Kibana access to Space1 only.
4. Create a user with that role.
5. Log in with the user and check the output of these requests in Dev Tools:

GET fleet/agent_policies

{
...
      "space_ids": [
        "default",
        "space1"
      ],
...
}

GET fleet/agent_policies/<policyId>

{
...
      "space_ids": [
        "space1",
        "?"
      ],
...
}

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)