Fix bake-and-sign buttons staying enabled after signature key deletion

Deep-copy _feature_config_defaults in get_default_config() to prevent
exec-based .mk file loading from mutating the module-level defaults
via in-place dict.update(). This caused deleted signature keys to
persist across requests, keeping the buttons enabled.

CMK-33375

Change-Id: I1b8fa466f6e49ce3278a8e7c6b5bbb4d3b01971a

Author: LarsMichelsen

cmk/gui/config.py

@@ -246,7 +246,7 @@ def register_feature_config_defaults(defaults: dict[str, Any]) -> None:
 
 def get_default_config() -> dict[str, Any]:
     default_config = asdict(Config())  # First apply the built-in config
-    default_config.update(_feature_config_defaults)
+    default_config.update(copy.deepcopy(_feature_config_defaults))
     default_config.update(_get_default_config_from_legacy_plugins())
     default_config.update(_get_default_config_from_module_plugins())
     return default_config

tests/gui_e2e/test_signature_keys_for_signing_agents.py

@@ -168,7 +168,6 @@ def test_bake_and_sign(test_site: Site, dashboard_page: MainDashboard, with_key:
     agent_bakery_page.assert_baking_succeeded()
 
 
-@pytest.mark.skip(reason="CMK-33355")
 def test_bake_and_sign_disabled(dashboard_page: MainDashboard) -> None:
     """Delete all keys, go to agents and check that the sign buttons are disabled."""
     signature_keys_page = SignatureKeysPage(dashboard_page.page)

tests/unit/cmk/gui/test_gui_config.py

@@ -196,6 +196,25 @@ def test_feature_config_defaults_appear_in_default_config() -> None:
         cmk.gui.config._feature_config_defaults.pop("_test_feature_var", None)
 
 
+def test_feature_config_defaults_not_mutated_by_config_loading() -> None:
+    """Verify that get_default_config() deep-copies mutable values from _feature_config_defaults.
+
+    Without deep-copying, exec-based config loading (e.g. agent_signature_keys.update({...}))
+    mutates the module-level defaults, causing stale data to persist across requests (CMK-33375).
+    """
+    cmk.gui.config.register_feature_config_defaults({"_test_mutable_var": {}})
+    try:
+        default_config = cmk.gui.config.get_default_config()
+        default_config["_test_mutable_var"]["injected_key"] = "injected_value"
+
+        assert cmk.gui.config._feature_config_defaults["_test_mutable_var"] == {}
+
+        default_config_2 = cmk.gui.config.get_default_config()
+        assert default_config_2["_test_mutable_var"] == {}
+    finally:
+        cmk.gui.config._feature_config_defaults.pop("_test_mutable_var", None)
+
+
 def test_load_config(request_context: None) -> None:
     config_path = cmk.utils.paths.default_config_dir / "multisite.mk"
     config_path.unlink(missing_ok=True)