Issue Summary

When querying multiple spaces in a single batch via GET /wiki/api/v2/spaces?ids=...&include-icon=true, if the user lacks VIEWSPACE permission for one or more requested space IDs (for example, spaces restricted via access classes such as all-product-admins), the SQL permission filter improperly allows restricted space records to proceed to icon hydration.

During icon expansion, the permission evaluation throws a PermissionException, which the global ErrorHandler converts from HTTP 403 to HTTP 404. Consequently, the entire batch request fails with an HTTP 404 instead of returning the accessible spaces and omitting/filtering out the restricted ones.

Steps to Reproduce

1. Step 1: Have a Confluence Cloud site with spaces where the caller has view permissions (e.g., Space A) and at least one space where the caller lacks view permissions / has restricted access classes (e.g., Space B).
2. Step 2: Execute a batch request via Confluence REST API v2 including both space IDs and requesting icons:

   GET /wiki/api/v2/spaces?ids=<spaceA_id>,<spaceB_id>&include-icon=true

1. Observe the HTTP response code and response body.

Expected Results

• The endpoint returns HTTP 200 OK.

• Accessible spaces (Space A) are returned in the results with their icons populated.

• Restricted spaces (Space B) are filtered out or omitted from the response.

Actual Results

• The entire batch request fails with HTTP 404 Not Found.

• No spaces are returned, breaking navigation/app rendering (e.g., SubSpace Navigation) that relies on batch resolution.

The below exception is thrown in the backend telemetry / application log:

The entire batch request fails with HTTP 404 Not Found.No spaces are returned, breaking navigation/app rendering (e.g., SubSpace Navigation) that relies on batch resolution.

Workaround

• Avoid passing include-icon=true in multi-ID batch queries (query space metadata first, then resolve icons separately for accessible spaces).

• Query spaces individually using GET /wiki/api/v2/spaces/{id}?include-icon=true and handle individual 404 responses per space instead of using batch ids=... parameters.