From 29960c9182d26a302fd79fc9c0db6a6222968ef6 Mon Sep 17 00:00:00 2001
From: Leonardo Petrora <leonardo.petrora@checkmk.com>
Date: Tue, 24 Oct 2023 16:38:01 +0200
Subject: [PATCH] 16202 Mega menu: Hide "Customize" menu and menu items for
 users with no permission

This change hides "Customize" menu and its menu items depending on user
permissions. Permissions taken in account are:
* general.edit_pagetype_topic
* general.edit_bookmark_list
* general.edit_custom_snapin

* general.edit_views
* general.edit_dashboards

* general.edit_graph_collection
* general.edit_graph_tuning
* general.edit_custom_graph
* general.edit_forecast_graph

* general.edit_reports
* general.edit_sla_configuration

CMK-12087

Change-Id: I6506af73bd01b0e5078b941297f67fa411137b26
---
 .werks/16202         | 13 +++++++
 cmk/gui/pagetypes.py | 86 ++++++++++++++++++++++++++++++--------------
 2 files changed, 72 insertions(+), 27 deletions(-)
 create mode 100644 .werks/16202

diff --git a/.werks/16202 b/.werks/16202
new file mode 100644
index 00000000000..77ca6d28380
--- /dev/null
+++ b/.werks/16202
@@ -0,0 +1,13 @@
+Title: Mega menu: Hide "Customize" menu and menu items for users with no permission
+Class: feature
+Compatible: compat
+Component: wato
+Date: 1698216784
+Edition: cre
+Level: 1
+Version: 2.3.0b1
+
+Before this Werk, users without permissions to access the "Customize" menu could still see it in the mega menu,
+and then when accessing it they would get an error message. This Werk fixes that behaviour by hiding the menu
+entries to which the user does not have access, or the entire menu in case the user does not have any 
+customisation permissions.
diff --git a/cmk/gui/pagetypes.py b/cmk/gui/pagetypes.py
index 46f3ed2fabb..5c479fc5a28 100644
--- a/cmk/gui/pagetypes.py
+++ b/cmk/gui/pagetypes.py
@@ -2309,37 +2309,50 @@ def _no_bi_aggregate_active() -> bool:
 
 def _customize_menu_topics() -> list[TopicMenuTopic]:
     general_items = []
-    monitoring_items = [
-        TopicMenuItem(
-            name="views",
-            title=_("Views"),
-            url="edit_views.py",
-            sort_index=10,
-            is_show_more=False,
-            icon="view",
-        ),
-        TopicMenuItem(
-            name="dashboards",
-            title=_("Dashboards"),
-            url="edit_dashboards.py",
-            sort_index=20,
-            is_show_more=False,
-            icon="dashboard",
-        ),
-    ]
+    monitoring_items = []
     graph_items = []
-    business_reporting_items = [
-        TopicMenuItem(
-            name="reports",
-            title=_("Reports"),
-            url="edit_reports.py",
-            sort_index=10,
-            is_show_more=True,
-            icon="report",
+    business_reporting_items = []
+
+    if user.may("general.edit_views"):
+        monitoring_items.append(
+            TopicMenuItem(
+                name="views",
+                title=_("Views"),
+                url="edit_views.py",
+                sort_index=10,
+                is_show_more=False,
+                icon="view",
+            ),
+        )
+
+    if user.may("general.edit_dashboards"):
+        monitoring_items.append(
+            TopicMenuItem(
+                name="dashboards",
+                title=_("Dashboards"),
+                url="edit_dashboards.py",
+                sort_index=20,
+                is_show_more=False,
+                icon="dashboard",
+            ),
+        )
+
+    if user.may("general.edit_reports"):
+        business_reporting_items.append(
+            TopicMenuItem(
+                name="reports",
+                title=_("Reports"),
+                url="edit_reports.py",
+                sort_index=10,
+                is_show_more=True,
+                icon="report",
+            )
         )
-    ]
 
     for index, page_type_ in enumerate(all_page_types().values()):
+        if not user.may(f"general.edit_{page_type_.type_name()}"):
+            continue
+
         item = TopicMenuItem(
             name=page_type_.type_name(),
             title=page_type_.phrase("title_plural"),
@@ -2392,6 +2405,24 @@ def _customize_menu_topics() -> list[TopicMenuTopic]:
     return topics
 
 
+def hide_customize_menu() -> bool:
+    permissions = [
+        "general.edit_pagetype_topic",
+        "general.edit_bookmark_list",
+        "general.edit_custom_snapin",
+        "general.edit_graph_collection",
+        "general.edit_graph_tuning",
+        "general.edit_custom_graph",
+        "general.edit_forecast_graph",
+        "general.edit_sla_configuration",
+        "general.edit_views",
+        "general.edit_dashboards",
+        "general.edit_reports",
+    ]
+
+    return not any(user.may(perm) for perm in permissions)
+
+
 mega_menu_registry.register(
     MegaMenu(
         name="customize",
@@ -2399,6 +2430,7 @@ def _customize_menu_topics() -> list[TopicMenuTopic]:
         icon="main_customize",
         sort_index=10,
         topics=_customize_menu_topics,
+        hide=hide_customize_menu,
     )
 )