use space_id instead of space_guid with new helper

app/controllers/v3/service_credential_bindings_controller.rb

@@ -335,7 +335,7 @@ def spaces_query
     if permission_queryer.can_read_globally?
       nil
     else
-      permission_queryer.readable_space_guids_query
+      permission_queryer.readable_spaces_query
     end
   end
 

lib/cloud_controller/permissions.rb

@@ -156,6 +156,14 @@ def readable_space_guids
     readable_space_guids_query.select_map(:guid)
   end
 
+  def readable_spaces_query
+    if can_read_globally?
+      raise 'must not be called for users that can read globally'
+    else
+      membership.authorized_spaces_subquery(ROLES_FOR_SPACE_READING)
+    end
+  end
+
   def readable_space_guids_query
     if can_read_globally?
       raise 'must not be called for users that can read globally'

spec/unit/lib/cloud_controller/permissions_spec.rb

@@ -378,6 +378,16 @@ module VCAP::CloudController
       end
     end
 
+    describe '#readables_space_query' do
+      it 'returns subquery from membership' do
+        membership = instance_double(Membership)
+        subquery = instance_double(Sequel::Dataset)
+        expect(Membership).to receive(:new).with(user).and_return(membership)
+        expect(membership).to receive(:authorized_spaces_subquery).with(Permissions::ROLES_FOR_SPACE_READING).and_return(subquery)
+        expect(permissions.readable_spaces_query).to be(subquery)
+      end
+    end
+
     describe '#readables_space_guids_query' do
       it 'returns subquery from membership' do
         membership = instance_double(Membership)