SearchKit - Add "administer search_kit" permission

[colemanw]

Overview

Adds a permission which allows non-admins to use Search Kit.

See https://lab.civicrm.org/dev/core/-/issues/3457

Before

Previously the user needed 'administer CiviCRM data' permission to use Search Kit.

After

Technical Details

When updating the navigation menu permissions, I switched it over to use a .mgd.php to insert the menu item instead of creating it with the installer. This should also work better for multi-domain sites.

[civibot]

(Standard links)

• If this is your first pull-request for CiviCRM, please browse CONTRIBUTING.md for information about the development and testing processes.
• If you are reviewing this pull-request, you may wish to consult the test sites and the Review Standards (long template, short template).

[demeritcowboy]

I know there's no standard and it's already mixed just I think it would be neat if all the internal names of permissions were all lower-case, to avoid mismatches that have come up before.

Not sure what the fail is about:

CRM_Member_Form_MembershipTest::testFinancialEntriesOnCancelledContribution
Failed asserting that '-20.00' matches expected -259.0.

/home/jenkins/bknix-dfl/build/core-23670-3djbs/web/sites/all/modules/civicrm/tests/phpunit/CRM/Member/Form/MembershipTest.php:941

jenkins retest this please

[colemanw]

@demeritcowboy that would be nice in retrospect. And we can do it going forward. I've changed this one to "administer search_kit" since that's the proper name of the extension anyway, good for it to match!

[demeritcowboy]

Working: Don't give administer civicrm or administer civicrm data or administer search_kit => can't do admin stuff but can use existing search displays.

But then add the permission to administer search_kit and while I can now see the admin interface, if I try to save a new search I get a spinning save button. It gives error 403 with {"error_code":"1","error_message":"Sorry an error occurred and your request was not completed. (Error ID: UYOC-Qphn-rkNB)"}

[eileenmcnaughton]

sounds like progress :-)

[colemanw]

How about that, it turns out there was a fixme in the API code anticipating we'd hit that problem eventually.
I fixed the fixme and now it's fixed :)

[awestuk]

Tested this on production and it's working great! Non-admins can now create and view searches, which is exactly what we wanted.

Only minor issue is that non-admins with this and 'edit all contacts' don't see the 'Related Contacts' entity. I'm assuming that's because permissions on relationships are more complicated. I can see it devolves down to addSelectWhereClause, but haven't got any further than that yet.

[colemanw]

@awestuk great. Here's a fix for the other thing you noticed. Can you please review/test #23684.

[eileenmcnaughton]

Issues have been addressed upping to MOP