Icinga · nilmerg · Nov 14, 2025 · Oct 24, 2025 · Oct 24, 2025 · Oct 24, 2025
diff --git a/application/controllers/ContactGroupController.php b/application/controllers/ContactGroupController.php
@@ -24,7 +24,7 @@ class ContactGroupController extends CompatController
 {
     public function init(): void
     {
-        $this->assertPermission('notifications/config/contact-groups');
+        $this->assertPermission('notifications/config/contacts');
     }
 
     public function indexAction(): void

diff --git a/application/controllers/ContactGroupsController.php b/application/controllers/ContactGroupsController.php
@@ -4,6 +4,7 @@
 
 namespace Icinga\Module\Notifications\Controllers;
 
+use Icinga\Module\Notifications\Common\ConfigurationTabs;
 use Icinga\Module\Notifications\Common\Database;
 use Icinga\Module\Notifications\Common\Links;
 use Icinga\Module\Notifications\Forms\ContactGroupForm;
@@ -28,18 +29,18 @@
 use ipl\Web\Layout\MinimalItemLayout;
 use ipl\Web\Widget\ActionLink;
 use ipl\Web\Widget\ButtonLink;
-use ipl\Web\Widget\Tabs;
 
 class ContactGroupsController extends CompatController
 {
+    use ConfigurationTabs;
     use SearchControls;
 
     /** @var Filter\Rule Filter from query string parameters */
     private $filter;
 
     public function init(): void
     {
-        $this->assertPermission('notifications/config/contact-groups');
+        $this->assertPermission('notifications/config/contacts');
     }
 
     public function indexAction(): void
@@ -96,15 +97,23 @@ public function indexAction(): void
             if (Channel::on(Database::get())->columns([new Expression('1')])->limit(1)->first() === null) {
                 $addButton->disable($this->translate('A channel is required to add a contact group'));
 
-                $emptyStateMessage = TemplateString::create(
-                    // translators: %1$s will be replaced by a line break
-                    $this->translate(
-                        'No contact groups found.%1$sTo add new contact group, please {{#link}}configure a'
-                        . ' Channel{{/link}} first.%1$sOnce done, you should proceed by creating your first contact.'
-                    ),
-                    ['link' => (new ActionLink(null, Links::channelAdd()))->setBaseTarget('_next')],
-                    [HtmlString::create('<br>')]
-                );
+                if ($this->Auth()->hasPermission('config/modules')) {
+                    $emptyStateMessage = TemplateString::create(
+                        // translators: %1$s will be replaced by a line break
+                        $this->translate(
+                            'No contact groups found.%1$s'
+                            . 'To add new contact group, please {{#link}}configure a Channel{{/link}} first.%1$s'
+                            . 'Once done, you should proceed by creating your first contact.'
+                        ),
+                        ['link' => (new ActionLink(null, Links::channelAdd()))->setBaseTarget('_next')],
+                        [HtmlString::create('<br>')]
+                    );
+                } else {
+                    $emptyStateMessage = $this->translate(
+                        'No contact groups found. To add a new contact group, a channel is required.'
+                        . ' Please contact your system administrator.'
+                    );
+                }
             } else {
                 $emptyStateMessage = TemplateString::create(
                     $this->translate(
@@ -195,28 +204,6 @@ public function suggestMemberAction(): void
         $this->getDocument()->addHtml($members);
     }
 
-    public function getTabs(): Tabs
-    {
-        return parent::getTabs()
-            ->add('schedules', [
-                'label'      => $this->translate('Schedules'),
-                'url'        => Links::schedules(),
-                'baseTarget' => '_main'
-            ])->add('event-rules', [
-                'label'      => $this->translate('Event Rules'),
-                'url'        => Links::eventRules(),
-                'baseTarget' => '_main'
-            ])->add('contacts', [
-                'label'      => $this->translate('Contacts'),
-                'url'        => Links::contacts(),
-                'baseTarget' => '_main'
-            ])->add('contact-groups', [
-                'label'      => $this->translate('Contact Groups'),
-                'url'        => Links::contactGroups(),
-                'baseTarget' => '_main'
-            ]);
-    }
-
     /**
      * Get the filter created from query string parameters
      *

diff --git a/application/controllers/ContactsController.php b/application/controllers/ContactsController.php
@@ -4,6 +4,7 @@
 
 namespace Icinga\Module\Notifications\Controllers;
 
+use Icinga\Module\Notifications\Common\ConfigurationTabs;
 use Icinga\Module\Notifications\Common\Links;
 use Icinga\Module\Notifications\Model\Channel;
 use Icinga\Module\Notifications\View\ContactRenderer;
@@ -29,6 +30,7 @@
 
 class ContactsController extends CompatController
 {
+    use ConfigurationTabs;
     use SearchControls;
 
     /** @var Connection */
@@ -96,12 +98,19 @@ public function indexAction()
         if (Channel::on($this->db)->columns([new Expression('1')])->limit(1)->first() === null) {
             $addButton->disable($this->translate('A channel is required to add a contact'));
 
-            $emptyStateMessage = TemplateString::create(
-                $this->translate(
-                    'No contacts found. To add a new contact, please {{#link}}configure a Channel{{/link}} first.'
-                ),
-                ['link' => (new ActionLink(null, Links::channelAdd()))->setBaseTarget('_next')]
-            );
+            if ($this->Auth()->hasPermission('config/modules')) {
+                $emptyStateMessage = TemplateString::create(
+                    $this->translate(
+                        'No contacts found. To add a new contact, please {{#link}}configure a Channel{{/link}} first.'
+                    ),
+                    ['link' => (new ActionLink(null, Links::channelAdd()))->setBaseTarget('_next')]
+                );
+            } else {
+                $emptyStateMessage = $this->translate(
+                    'No contacts found. To add a new contact, a channel is required.'
+                    . ' Please contact your system administrator.'
+                );
+            }
         }
 
         $this->addContent($addButton);
@@ -171,30 +180,4 @@ protected function getFilter(): Filter\Rule
 
         return $this->filter;
     }
-
-    public function getTabs()
-    {
-        if ($this->getRequest()->getActionName() === 'index') {
-            return parent::getTabs()
-                ->add('schedules', [
-                    'label'      => $this->translate('Schedules'),
-                    'url'        => Links::schedules(),
-                    'baseTarget' => '_main'
-                ])->add('event-rules', [
-                    'label'      => $this->translate('Event Rules'),
-                    'url'        => Links::eventRules(),
-                    'baseTarget' => '_main'
-                ])->add('contacts', [
-                    'label'      => $this->translate('Contacts'),
-                    'url'        => Links::contacts(),
-                    'baseTarget' => '_main'
-                ])->add('contact-groups', [
-                    'label'      => $this->translate('Contact Groups'),
-                    'url'        => Links::contactGroups(),
-                    'baseTarget' => '_main'
-                ]);
-        }
-
-        return parent::getTabs();
-    }
 }
diff --git a/application/controllers/EventRuleController.php b/application/controllers/EventRuleController.php
@@ -39,7 +39,7 @@ class EventRuleController extends CompatController
 
     public function init(): void
     {
-        $this->assertPermission('notifications/config/event-rule');
+        $this->assertPermission('notifications/config/event-rules');
         $this->session = Session::getSession()->getNamespace('notifications.event-rule');
     }
 

diff --git a/application/controllers/EventRulesController.php b/application/controllers/EventRulesController.php
@@ -4,6 +4,7 @@
 
 namespace Icinga\Module\Notifications\Controllers;
 
+use Icinga\Module\Notifications\Common\ConfigurationTabs;
 use Icinga\Module\Notifications\Common\Database;
 use Icinga\Module\Notifications\Common\Links;
 use Icinga\Module\Notifications\Forms\EventRuleForm;
@@ -28,6 +29,7 @@
 
 class EventRulesController extends CompatController
 {
+    use ConfigurationTabs;
     use SearchControls;
 
     public function init()
@@ -159,30 +161,4 @@ public function searchEditorAction(): void
         $this->getDocument()->add($editor);
         $this->setTitle($this->translate('Adjust Filter'));
     }
-
-    public function getTabs()
-    {
-        if ($this->getRequest()->getActionName() === 'index') {
-            return parent::getTabs()
-                ->add('schedules', [
-                    'label'      => $this->translate('Schedules'),
-                    'url'        => Links::schedules(),
-                    'baseTarget' => '_main'
-                ])->add('event-rules', [
-                    'label'      => $this->translate('Event Rules'),
-                    'url'        => Links::eventRules(),
-                    'baseTarget' => '_main'
-                ])->add('contacts', [
-                    'label'      => $this->translate('Contacts'),
-                    'url'        => Links::contacts(),
-                    'baseTarget' => '_main'
-                ])->add('contact-groups', [
-                    'label'      => $this->translate('Contact Groups'),
-                    'url'        => Links::contactGroups(),
-                    'baseTarget' => '_main'
-                ]);
-        }
-
-        return parent::getTabs();
-    }
 }
diff --git a/application/controllers/ScheduleController.php b/application/controllers/ScheduleController.php
@@ -30,6 +30,8 @@ class ScheduleController extends CompatController
 
     public function init(): void
     {
+        $this->assertPermission('notifications/config/schedules');
+
         parent::init();
 
         $this->session = Session::getSession()->getNamespace('notifications.schedule');

diff --git a/application/controllers/SchedulesController.php b/application/controllers/SchedulesController.php
@@ -4,6 +4,7 @@
 
 namespace Icinga\Module\Notifications\Controllers;
 
+use Icinga\Module\Notifications\Common\ConfigurationTabs;
 use Icinga\Module\Notifications\Common\Database;
 use Icinga\Module\Notifications\Common\Links;
 use Icinga\Module\Notifications\Model\Schedule;
@@ -17,15 +18,20 @@
 use ipl\Web\Control\SortControl;
 use ipl\Web\Filter\QueryString;
 use ipl\Web\Widget\ButtonLink;
-use ipl\Web\Widget\Tabs;
 
 class SchedulesController extends CompatController
 {
+    use ConfigurationTabs;
     use SearchControls;
 
     /** @var Filter\Rule Filter from query string parameters */
     private $filter;
 
+    public function init(): void
+    {
+        $this->assertPermission('notifications/config/schedules');
+    }
+
     public function indexAction(): void
     {
         $schedules = Schedule::on(Database::get());
@@ -102,28 +108,6 @@ public function searchEditorAction(): void
         $this->setTitle(t('Adjust Filter'));
     }
 
-    public function getTabs(): Tabs
-    {
-        return parent::getTabs()
-            ->add('schedules', [
-                'label'         => $this->translate('Schedules'),
-                'url'           => Links::schedules(),
-                'baseTarget'    => '_main'
-            ])->add('event-rules', [
-                'label' => $this->translate('Event Rules'),
-                'url'   => Links::eventRules(),
-                'baseTarget' => '_main'
-            ])->add('contacts', [
-                'label' => $this->translate('Contacts'),
-                'url'   => Links::contacts(),
-                'baseTarget' => '_main'
-            ])->add('contact-groups', [
-                'label'      => $this->translate('Contact Groups'),
-                'url'        => Links::contactGroups(),
-                'baseTarget' => '_main'
-            ]);
-    }
-
     /**
      * Get the filter created from query string parameters
      *

diff --git a/configuration.php b/configuration.php
@@ -3,6 +3,7 @@
 /* Icinga Notifications Web | (c) 2023 Icinga GmbH | GPLv2 */
 
 use Icinga\Application\Modules\Module;
+use Icinga\Authentication\Auth;
 
 /** @var Module $this */
 
@@ -14,14 +15,30 @@
     ]
 );
 
-$section->add(
-    N_('Configuration'),
-    [
-        'icon'          => 'wrench',
-        'description'   => $this->translate('Configuration'),
-        'url'           => 'notifications/schedules'
-    ]
-);
+$auth = Auth::getInstance();
+$authenticated = $auth->getUser() !== null;
+
+$configLandingPage = null;
+if ($authenticated) {
+    if ($auth->hasPermission('notifications/config/schedules')) {
+        $configLandingPage = 'notifications/schedules';
+    } elseif ($auth->hasPermission('notifications/config/event-rules')) {
+        $configLandingPage = 'notifications/event-rules';
+    } elseif ($auth->hasPermission('notifications/config/contacts')) {
+        $configLandingPage = 'notifications/contacts';
+    }
+}
+
+if ($configLandingPage !== null) {
+    $section->add(
+        N_('Configuration'),
+        [
+            'icon'          => 'wrench',
+            'description'   => $this->translate('Configuration'),
+            'url'           => $configLandingPage
+        ]
+    );
+}
 
 $section->add(
     N_('Events'),
@@ -32,25 +49,35 @@
     ]
 );
 
+$this->providePermission(
+    'notifications/config/schedules',
+    $this->translate('Allow to configure schedules')
+);
+
 $this->providePermission(
     'notifications/config/event-rules',
     $this->translate('Allow to configure event rules')
 );
 
 $this->providePermission(
-    'notifications/config/contact-groups',
-    $this->translate('Allow to configure contact groups')
+    'notifications/config/contacts',
+    $this->translate('Allow to configure contacts and contact groups')
+);
+
+$this->providePermission(
+    'notifications/view/contacts',
+    $this->translate('Allow to view contacts')
 );
 
 $this->providePermission(
     'notifications/api',
     $this->translate('Allow to modify configuration via API')
 );
 
-$this->provideRestriction(
-    'notifications/filter/objects',
-    $this->translate('Restrict access to the objects that match the filter')
-);
+//$this->provideRestriction(
+//    'notifications/filter/objects',
+//    $this->translate('Restrict access to the objects that match the filter')
+//);
 
 $this->provideConfigTab(
     'database',