Fix missing permissions for custom icons and actions

CMK-21974

Change-Id: Ia14ef23e5a564d22376687d2d8178ce87980a8ff

cmk/gui/views/icon/__init__.py

@@ -3,8 +3,12 @@
 # This file is part of Checkmk (https://checkmk.com). It is subject to the terms and
 # conditions defined in the file COPYING, which is part of this source code package.
 
+from cmk.gui.config import active_config
 from cmk.gui.painter.v0 import PainterRegistry
-from cmk.gui.permissions import PermissionSectionRegistry
+from cmk.gui.permissions import (
+    declare_dynamic_permissions,
+    PermissionSectionRegistry,
+)
 
 from .base import Icon
 from .builtin import (
@@ -32,6 +36,7 @@
     StalenessIcon,
     StarsIcon,
 )
+from .config_icons import declare_icons_and_actions_perm
 from .page_ajax_popup_action_menu import ajax_popup_action_menu
 from .painter import PainterHostIcons, PainterServiceIcons
 from .permission_section import PermissionSectionIconsAndActions
@@ -72,6 +77,11 @@ def register(
     icon_registry.register(CrashdumpsIcon)
     icon_registry.register(CheckPeriodIcon)
 
+    # also declare permissions for custom icons
+    declare_dynamic_permissions(
+        lambda: declare_icons_and_actions_perm(active_config.user_icons_and_actions)
+    )
+
 
 __all__ = [
     "icon_and_action_registry",

cmk/gui/views/icon/config_icons.py

@@ -4,6 +4,9 @@
 # conditions defined in the file COPYING, which is part of this source code package.
 
 
+from cmk.gui.config import default_authorized_builtin_role_ids
+from cmk.gui.i18n import _
+from cmk.gui.permissions import declare_permission, permission_registry
 from cmk.gui.type_defs import BuiltinIconVisibility, IconSpec
 
 from .base import Icon
@@ -26,6 +29,8 @@ def update_builtin_icons_from_config(
 
 
 def config_based_icons(user_icons_and_actions: dict[str, IconSpec]) -> dict[str, Icon]:
+    declare_icons_and_actions_perm(user_icons_and_actions)
+
     return {
         icon_id: type(
             "CustomIcon%s" % icon_id.title(),
@@ -47,3 +52,16 @@ def config_based_icons(user_icons_and_actions: dict[str, IconSpec]) -> dict[str,
         )()
         for icon_id, icon_cfg in user_icons_and_actions.items()
     }
+
+
+def declare_icons_and_actions_perm(icons: dict[str, IconSpec]) -> None:
+    for ident, _icon in icons.items():
+        if (permname := f"icons_and_actions.{ident}") in permission_registry:
+            continue
+
+        declare_permission(
+            permname,
+            ident,
+            _("Allow to see the icon %s in the host and service views") % ident,
+            default_authorized_builtin_role_ids,
+        )