[8.19](backport #7009) fix: enforce policy-based access control on artifact downloads

[mergify]

What is the problem this PR solves?

The artifact download endpoint (/api/fleet/artifacts/{id}/{sha256}) only validates the agent's API key but never checks whether the requested artifact belongs to the agent's assigned policy. This means an agent enrolled under one policy can download artifacts belonging to a different policy if it knows the artifact ID and SHA256 hash. For example, an agent enrolled under a policy with no integrations can retrieve Elastic Defend trust lists, exception lists, and other security artifacts from another policy.

How does this PR solve the problem?

Implements the authorizeArtifact() function (previously a no-op that returned nil) to enforce policy-based access control:

1. Adds a GetPolicy(ctx, policyID) method to the policy.Monitor interface that returns the cached policy for a given ID (reloads from ES on cache miss).
2. In authorizeArtifact, fetches the agent's policy via the monitor using agent.AgentPolicyID and verifies that the requested artifact (identifier + decoded_sha256) appears in the policy's inputs[].artifact_manifest.artifacts.
3. Returns 403 Forbidden (ErrUnauthorizedArtifact) if the artifact is not listed in the agent's assigned policy.

How to test this PR locally

1. Set up Fleet Server with Elasticsearch and Kibana
2. Create two agent policies: Victim-Policy with Elastic Defend integration (add a trusted application), and Attacker-Policy with no integrations
3. Create an enrollment token for Attacker-Policy and enroll an agent
4. Attempt to download an artifact belonging to Victim-Policy using the attacker agent's API key — should now receive 403 Forbidden instead of the artifact contents
5. Verify that an agent enrolled under Victim-Policy can still download its own artifacts normally (200 OK)

Design Checklist

• I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
• I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
• I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool

  ---

  This is an automatic backport of pull request fix: enforce policy-based access control on artifact downloads #7009 done by Mergify.

[mergify]

Cherry-pick of caa8b2d has failed:

On branch mergify/bp/8.19/pr-7009
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit caa8b2d.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1778540235-fix-artifact-access-control.yaml
	modified:   internal/pkg/api/error.go
	modified:   internal/pkg/api/handleArtifacts.go
	new file:   internal/pkg/api/handleArtifacts_test.go
	modified:   internal/pkg/dl/constants.go
	modified:   internal/pkg/server/fleet.go
	modified:   testing/e2e/api_version/client_api_2023_06_01.go
	modified:   testing/e2e/api_version/client_api_current.go
	modified:   testing/e2e/scaffold/scaffold.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   internal/pkg/api/handleCheckin_test.go
	both modified:   internal/pkg/policy/monitor.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

TL;DR

check-ci failed because unresolved cherry-pick conflict markers (<<<<<<<, =======, >>>>>>>) were committed in Go source files, so goimports/parser exited before CI could proceed. Resolve the conflicts in the two affected files and rerun CI.

Remediation

• Manually resolve merge conflicts in internal/pkg/api/handleCheckin_test.go and internal/pkg/policy/monitor.go, removing all conflict markers and keeping the intended backport logic.
• Run mage check:all (or at minimum the same check_ci.sh path) locally after conflict resolution to confirm parsing/linting succeeds.

Investigation details

Root Cause

This is a configuration/backport integration failure from an incomplete cherry-pick resolution, not a runtime code regression.

Build logs show Go parser errors in both files at lines containing conflict-marker tokens, e.g. expected declaration, found '<<' and illegal character U+0023 '#'.

The PR already contains Mergify’s conflict note indicating these exact files were left unmerged:

• internal/pkg/api/handleCheckin_test.go
• internal/pkg/policy/monitor.go

Evidence

• Build: https://buildkite.com/elastic/fleet-server/builds/15019
• Job/step: Run check-ci (.buildkite/scripts/check_ci.sh)
• Key log excerpt:

internal/pkg/api/handleCheckin_test.go:44:1: expected declaration, found '<<'
internal/pkg/api/handleCheckin_test.go:76:1: expected declaration, found '>>'
internal/pkg/api/handleCheckin_test.go:76:82: illegal character U+0023 '#'
internal/pkg/policy/monitor.go:68:1: expected '}', found '<<'
internal/pkg/policy/monitor.go:77:82: illegal character U+0023 '#'
internal/pkg/policy/monitor.go:535:1: expected declaration, found '<<'
Error: running "go tool -modfile dev-tools/go.mod golang.org/x/tools/cmd/goimports -w ." failed with exit code 2

Verification

• Local rerun not performed in this detective workflow (read-only diagnosis from provided Buildkite artifacts).

Follow-up

After conflict resolution, if CI still fails, re-check for any remaining conflict markers with:
rg '<<<<<<<|=======|>>>>>>>' internal/pkg/api/handleCheckin_test.go internal/pkg/policy/monitor.go

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[mergify]

This pull request has not been merged yet. Could you please review and merge it @ycombinator? 🙏

[mergify]

This pull request has not been merged yet. Could you please review and merge it @ycombinator? 🙏