Bug 1589266

Description of problem: Use case - government customer runs cyber security training lab, and create multiple VMs - some of which the students own and have direct console access to.  The others, the should not be aware of - the idea is that they will be discovering them and accessing them via SSH, RDP, etc as part of the course.  

In the most recent release of CloudForms, I have created a mockup of this lab design using bundle catalog items - the first item creates the visible VMs, the second creates the hidden ones.  They are all under the same service.  In the ops UI, this works as intended - the student user with a restricted view only sees the items they should.  In the self service UI, they still show up as visible, regardless of how I handle limiting their visibiliby - through ownership change or using tagging.  

Note that this only makes them visible - if the user clicks on the VMs they should not have access to, an error loading VM details pops up, and they can't interact with it.  Ideally, however, the VMs should not be visible at all.  


Version-Release number of selected component (if applicable): 5.9.2


How reproducible: Always


Steps to Reproduce:
1. Provision catalog item with multiple VMs as a user with access set to only user owned, or with some sort of visibility restriction based on tagging
2. Either change the ownership of some of the created items, or apply a tag that would restrict the users's view
3. Log into self service UI as the user and navigate the service

Actual results: User can see a listing of the items they do not have access to


Expected results: Student should not see the items they do not have access to, as in the ops UI. 


Additional info: