fix(alertzero): serialize manage_proposals check through actions.api.get for API-key credentials

Author: patrykkopycinski

x-pack/platform/plugins/shared/agentic_investigations/server/proposals/step_types/assert_manage_proposals.ts

@@ -39,7 +39,10 @@ export const assertManageProposals = async ({
   try {
     const checkPrivileges = security.authz.checkPrivilegesWithRequest(request);
     const privileges = await checkPrivileges.atSpace(spaceId, {
-      kibana: [PROPOSALS_API_PRIVILEGE_MANAGE],
+      // The serialized form of a feature API privilege is prefixed (see
+      // api_authorization.ts: requestedPrivileges.map(p => actions.api.get(p)));
+      // checking the bare string never matches for API-key credentials.
+      kibana: [security.authz.actions.api.get(PROPOSALS_API_PRIVILEGE_MANAGE)],
     });
     if (!privileges.hasAllRequested) {
       throw new ProposalsAuthorizationError(

x-pack/platform/plugins/shared/agentic_investigations/server/proposals/step_types/step_types.test.ts

@@ -24,6 +24,11 @@ const FAKE_REQUEST = { fake: true } as never;
 const createSecurity = (hasAllRequested: boolean) =>
   ({
     authz: {
+      // Mirrors the real serializer: feature API privileges are stored in
+      // prefixed form (api_authorization.ts routes requests through
+      // actions.api.get). A gate passing the bare string passes unit tests
+      // with a naive mock but denies every real API-key caller.
+      actions: { api: { get: (privilege: string) => `api:${privilege}` } },
       checkPrivilegesWithRequest: jest.fn().mockReturnValue({
         atSpace: jest.fn().mockResolvedValue({ hasAllRequested }),
       }),