19886 FIX Fix service discovery REST API permissions

Previously, the service discovery REST API endpoints (getting the
discovery result, waiting for a discovery run to complete, and updating
a service's discovery phase) required the "Read access to all hosts and
folders" permission unconditionally. This permission is normally
reserved for administrators.

As a result, users who could only access a host through their contact
group's folder permissions - without holding the blanket "Read access to
all hosts and folders" permission - were rejected with:

_We are sorry, but you lack the permission for this operation. If you do
not like this then please ask your administrator to provide you with the
following permission: 'Read access to all hosts and folders'._

even though they were otherwise allowed to see and manage that host.

These endpoints now use the same per-host, contact-group-aware
permission check already used by the host configuration REST API
endpoints. Users with folder-scoped access can now run and inspect
service discoveries via the REST API without needing the global "Read
access to all hosts and folders" permission.

SUP-29084

Change-Id: I6f68f8c659fb11bb3eb7f1f89bd9cee7897fd99a

Author: lpetrora

.werks/19886.md

@@ -0,0 +1,34 @@
+[//]: # (werk v2)
+# Fix service discovery REST API permissions
+
+key        | value
+---------- | ---
+date       | 2026-08-11T08:09:37.723492+00:00
+version    | 2.4.0p36
+class      | fix
+edition    | cre
+component  | rest-api
+level      | 1
+compatible | yes
+
+Previously, the service discovery REST API endpoints (getting the discovery
+result, waiting for a discovery run to complete, and updating a service's
+discovery phase) required the "Read access to all hosts and folders"
+permission unconditionally. This permission is normally reserved for
+administrators.
+
+As a result, users who could only access a host through their contact
+group's folder permissions - without holding the blanket "Read access to
+all hosts and folders" permission - were rejected with:
+
+_We are sorry, but you lack the permission for this operation. If you do
+not like this then please ask your administrator to provide you with the
+following permission: 'Read access to all hosts and folders'._
+
+even though they were otherwise allowed to see and manage that host.
+
+These endpoints now use the same per-host, contact-group-aware permission
+check already used by the host configuration REST API endpoints. Users
+with folder-scoped access can now run and inspect service discoveries via
+the REST API without needing the global "Read access to all hosts and
+folders" permission.

cmk/gui/openapi/endpoints/service_discovery/__init__.py

@@ -30,7 +30,6 @@
 from cmk.gui.openapi.endpoints.host_config.request_schemas import EXISTING_HOST_NAME
 from cmk.gui.openapi.restful_objects import constructors, Endpoint, response_schemas
 from cmk.gui.openapi.restful_objects.constructors import domain_object, link_rel, object_property
-from cmk.gui.openapi.restful_objects.parameters import HOST_NAME
 from cmk.gui.openapi.restful_objects.registry import EndpointRegistry
 from cmk.gui.openapi.restful_objects.type_defs import DomainObject, LinkType
 from cmk.gui.openapi.utils import EXT, problem, ProblemException, serve_json
@@ -81,7 +80,8 @@
     [
         permissions.Perm("wato.edit"),
         permissions.Perm("wato.services"),
-        permissions.Perm("wato.see_all_folders"),
+        # Only used as a shortcut to see hosts without being a contact of their folder.
+        permissions.Optional(permissions.Perm("wato.see_all_folders")),
         # The permissions below are required to manage BackgroundJobs
         permissions.Optional(permissions.Perm("background_jobs.stop_jobs")),
         permissions.Optional(permissions.Perm("background_jobs.stop_foreign_jobs")),
@@ -90,6 +90,14 @@
     ]
 )
 
+HOST_NAME_SETUP_READ = {
+    "host_name": gui_fields.HostField(
+        description="A host name.",
+        should_exist=True,
+        permission_type="setup_read",
+    )
+}
+
 SERVICE_DISCOVERY_PHASES = {
     "undecided": DiscoveryState.UNDECIDED,
     "vanished": DiscoveryState.VANISHED,
@@ -172,6 +180,7 @@ def _discovery_mode(default_mode: str) -> fields.String:
                 description="The host of the service discovery result",
                 example="example.com",
                 required=True,
+                permission_type="setup_read",
             )
         }
     ],
@@ -182,7 +191,6 @@ def show_service_discovery_result(params: Mapping[str, Any]) -> Response:
     """Show the current service discovery result"""
     user.need_permission("wato.edit")
     user.need_permission("wato.services")
-    user.need_permission("wato.see_all_folders")
 
     host = Host.load_host(params["host_name"])
 
@@ -251,6 +259,7 @@ class UpdateDiscoveryPhase(BaseSchema):
             "host_name": gui_fields.HostField(
                 description="The host of the service which shall be updated.",
                 example="example.com",
+                permission_type="setup_read",
             ),
         }
     ],
@@ -265,7 +274,8 @@ class UpdateDiscoveryPhase(BaseSchema):
             permissions.Perm("wato.service_discovery_to_ignored"),
             permissions.Perm("wato.service_discovery_to_undecided"),
             permissions.Perm("wato.service_discovery_to_removed"),
-            permissions.Perm("wato.see_all_folders"),
+            # Only used as a shortcut to see hosts without being a contact of their folder.
+            permissions.Optional(permissions.Perm("wato.see_all_folders")),
         ]
     ),
 )
@@ -275,7 +285,6 @@ def update_service_phase(params: Mapping[str, Any]) -> Response:
     user.need_permission("wato.service_discovery_to_ignored")
     user.need_permission("wato.service_discovery_to_undecided")
     user.need_permission("wato.service_discovery_to_removed")
-    user.need_permission("wato.see_all_folders")
 
     body = params["body"]
     host = Host.load_host(params["host_name"])
@@ -312,15 +321,14 @@ def _update_single_service_phase(
     "cmk/show",
     method="get",
     tag_group="Setup",
-    path_params=[HOST_NAME],
+    path_params=[HOST_NAME_SETUP_READ],
     response_schema=response_schemas.DomainObject,
     permissions_required=RO_PERMISSIONS,
 )
 def show_service_discovery_run(params: Mapping[str, Any]) -> Response:
     """Show the last service discovery background job on a host"""
     user.need_permission("wato.edit")
     user.need_permission("wato.services")
-    user.need_permission("wato.see_all_folders")
     host = Host.load_host(params["host_name"])
     snapshot = _job_snapshot(host)
     job_id = snapshot.job_id
@@ -354,7 +362,7 @@ def show_service_discovery_run(params: Mapping[str, Any]) -> Response:
         "'Wait for completion' endpoint.",
         404: "There is no running service discovery",
     },
-    path_params=[HOST_NAME],
+    path_params=[HOST_NAME_SETUP_READ],
     additional_status_codes=[302],
     output_empty=True,
     permissions_required=RO_PERMISSIONS,
@@ -366,7 +374,6 @@ def service_discovery_run_wait_for_completion(params: Mapping[str, Any]) -> Resp
     """
     user.need_permission("wato.edit")
     user.need_permission("wato.services")
-    user.need_permission("wato.see_all_folders")
 
     host = Host.load_host(params["host_name"])
     snapshot = _job_snapshot(host)

tests/testlib/unit/rest_api_client.py

@@ -66,6 +66,7 @@
     "service",
     "service_discovery",
     "discovery_run",
+    "service_discovery_run",
     "ldap_connection",
     "saml_connection",
     "parent_scan",
@@ -2807,6 +2808,7 @@ def get_all(
 class ServiceDiscoveryClient(RestApiClient):
     service_discovery_domain: API_DOMAIN = "service_discovery"
     discovery_run_domain: API_DOMAIN = "discovery_run"
+    service_discovery_run_domain: API_DOMAIN = "service_discovery_run"
 
     def bulk_discovery(
         self,
@@ -2853,6 +2855,36 @@ def discovery_run_status(self, id_: str, expect_ok: bool = True) -> Response:
             expect_ok=expect_ok,
         )
 
+    def start_service_discovery(
+        self, host_name: str, mode: str = "refresh", expect_ok: bool = True
+    ) -> Response:
+        return self.request(
+            "post",
+            url=f"/domain-types/{self.service_discovery_run_domain}/actions/start/invoke",
+            body={"host_name": host_name, "mode": mode},
+            expect_ok=expect_ok,
+            follow_redirects=False,
+        )
+
+    def wait_for_service_discovery_completion(
+        self, host_name: str, expect_ok: bool = True
+    ) -> Response:
+        return self.request(
+            "get",
+            url=(
+                f"/objects/{self.service_discovery_run_domain}/{host_name}"
+                "/actions/wait-for-completion/invoke"
+            ),
+            expect_ok=expect_ok,
+        )
+
+    def get_service_discovery_status(self, host_name: str, expect_ok: bool = True) -> Response:
+        return self.request(
+            "get",
+            url=f"/objects/{self.service_discovery_run_domain}/{host_name}",
+            expect_ok=expect_ok,
+        )
+
 
 class LDAPConnectionClient(RestApiClient):
     domain: API_DOMAIN = "ldap_connection"

tests/unit/cmk/gui/openapi/test_openapi_service_discovery.py

@@ -1264,3 +1264,109 @@ def test_openapi_refresh_job_status(
     assert "state" in resp.json["extensions"]
     assert "result" in resp.json["extensions"]["logs"]
     assert "progress" in resp.json["extensions"]["logs"]
+
+
+@pytest.mark.usefixtures("inline_background_jobs")
+def test_openapi_service_discovery_accessible_to_folder_contact(
+    clients: ClientRegistry,
+    mock_discovery_preview: MagicMock,
+) -> None:
+    """Regression test for SUP-29084.
+
+    A user who can see a host only through their contact group's folder permissions (not
+    through the blanket 'wato.see_all_folders' permission, which is only held by admins) must
+    still be able to run a service discovery and read back its result/status via the REST API.
+    """
+    host_name = "restricted_host"
+    clients.ContactGroup.create("folder_cg", alias="folder_cg")
+    clients.User.create(
+        username="folder_member",
+        fullname="folder_member",
+        customer=None,
+        roles=["user"],
+        contactgroups=["folder_cg"],
+        auth_option={"auth_type": "password", "password": "supersecretish"},
+    )
+    clients.Folder.create(
+        title="restricted_folder",
+        parent="/",
+        folder_name="restricted_folder",
+        attributes={"contactgroups": {"groups": ["folder_cg"], "recurse_perms": True}},
+    )
+    clients.HostConfig.create(host_name=host_name, folder="/restricted_folder")
+
+    clients.ServiceDiscovery.set_credentials("folder_member", "supersecretish")
+
+    clients.ServiceDiscovery.start_service_discovery(host_name, "refresh").assert_status_code(303)
+
+    clients.ServiceDiscovery.wait_for_service_discovery_completion(host_name).assert_status_code(
+        204
+    )
+
+    run_resp = clients.ServiceDiscovery.get_service_discovery_status(host_name)
+
+    run_resp.assert_status_code(200)
+    assert run_resp.json["extensions"]["state"] == "finished"
+
+
+def test_openapi_service_discovery_inaccessible_to_non_folder_contact(
+    clients: ClientRegistry,
+) -> None:
+    """A user who is NOT a member of the host folder's contact group gets 404, indistinguishable
+    from a host that does not exist, so that host existence is not leaked."""
+    host_name = "restricted_host"
+    clients.ContactGroup.create("correct_cg", alias="correct_cg")
+    clients.ContactGroup.create("wrong_cg", alias="wrong_cg")
+    clients.User.create(
+        username="wrong_member",
+        fullname="wrong_member",
+        customer=None,
+        roles=["user"],
+        contactgroups=["wrong_cg"],
+        auth_option={"auth_type": "password", "password": "supersecretish"},
+    )
+    clients.Folder.create(
+        title="restricted_folder",
+        parent="/",
+        folder_name="restricted_folder",
+        attributes={"contactgroups": {"groups": ["correct_cg"], "recurse_perms": True}},
+    )
+    clients.HostConfig.create(host_name=host_name, folder="/restricted_folder")
+
+    clients.ServiceDiscovery.set_credentials("wrong_member", "supersecretish")
+
+    clients.ServiceDiscovery.wait_for_service_discovery_completion(
+        host_name, expect_ok=False
+    ).assert_status_code(404)
+
+
+@pytest.mark.usefixtures("inline_background_jobs")
+def test_openapi_service_discovery_accessible_to_admin_not_in_folder_contact_group(
+    clients: ClientRegistry,
+    mock_discovery_preview: MagicMock,
+) -> None:
+    """Regression test for SUP-29084.
+
+    Admins can see every host via the blanket 'wato.see_all_folders' permission, regardless of
+    contact group membership.
+    """
+    host_name = "restricted_host"
+    clients.ContactGroup.create("folder_cg", alias="folder_cg")
+    clients.Folder.create(
+        title="restricted_folder",
+        parent="/",
+        folder_name="restricted_folder",
+        attributes={"contactgroups": {"groups": ["folder_cg"], "recurse_perms": True}},
+    )
+    clients.HostConfig.create(host_name=host_name, folder="/restricted_folder")
+
+    clients.ServiceDiscovery.start_service_discovery(host_name, "refresh").assert_status_code(303)
+
+    clients.ServiceDiscovery.wait_for_service_discovery_completion(host_name).assert_status_code(
+        204
+    )
+
+    run_resp = clients.ServiceDiscovery.get_service_discovery_status(host_name)
+
+    run_resp.assert_status_code(200)
+    assert run_resp.json["extensions"]["state"] == "finished"