Refactor search functionality to use SearchColumnProviderHook for custom variable retrieval and added new SearchColumnProviderHook class

Author: gianlucapiccolo

library/Icingadb/Common/SearchControls.php

@@ -4,6 +4,7 @@
 
 namespace Icinga\Module\Icingadb\Common;
 
+use Icinga\Module\Icingadb\Hook\SearchColumnsProviderHook;
 use Icinga\Module\Icingadb\Web\Control\SearchBar\ObjectSuggestions;
 use ipl\Html\Html;
 use ipl\Orm\Query;
@@ -40,9 +41,21 @@ public function createSearchBar(Query $query, ...$params): SearchBar
             $searchBar->addWrapper(Html::tag('div', ['class' => 'search-controls']));
         }
 
+        $model = $query->getModel();
+        $defaultColumns = $model->getSearchColumns();
+        $columns = SearchColumnsProviderHook::getCustomVarColumns($model, $defaultColumns);
+        $searchBar->setSearchColumns($columns);
+
+        $searchBar->handleRequest(ServerRequest::fromGlobals());
+
         return $searchBar;
     }
 
+    private function callHandleRequest()
+    {
+        return false;
+    }
+
     /**
      * Create and return a ContinueWith
      *

library/Icingadb/Hook/CustomVarsRetrieverHook.php

@@ -0,0 +1,53 @@
+<?php
+
+// SPDX-FileCopyrightText: 2026 Icinga GmbH <https://icinga.com>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+namespace Icinga\Module\Icingadb\Hook;
+
+use Icinga\Application\Hook;
+use Icinga\Application\Logger;
+use ipl\Orm\Model;
+use Throwable;
+
+/**
+ * Hook for providing additional search columns such as custom variables.
+ *
+ * This is a first attempt to generalize support for modules to provide additional search columns.
+ * The end user won't be able to customize the set provided and every global or route search will
+ * always use them. Any hook implementation must ensure that only columns the user has access to
+ * and that are valid in the current route are returned. Returning invalid columns may cause errors
+ * for users. See https://github.com/Icinga/icingadb-web/security/advisories/GHSA-w57j-28jc-8429
+ * for an example of what can go wrong.
+ *
+ * @deprecated This will not be used by any future version without any further notice.
+ */
+abstract class SearchColumnsProviderHook
+{
+    abstract public function retrieveCustomVars(Model $model): array;
+
+    final public static function getCustomVarColumns(Model $model, array $defaultColumns = []): array
+    {
+        $columns = $defaultColumns;
+
+        $hooks = Hook::all('icingadb/SearchColumnsProvider');
+        foreach ($hooks as $hook) {
+            try {
+                $customVars = $hook->retrieveCustomVars($model);
+                if (!empty($customVars)) {
+                    $columns = [...$columns, ...$customVars];
+                }
+            } catch (Throwable $e) {
+                Logger::error(
+                    'Error retrieving Custom Vars for %s with table name "%s": %s',
+                    get_class($model),
+                    $model->getTableName(),
+                    $e->getMessage()
+                );
+            }
+        }
+
+        return array_unique($columns);
+    }
+}
+

library/Icingadb/Hook/SearchColumnsProviderHook.php

@@ -7,7 +7,7 @@
 use Generator;
 use Icinga\Module\Icingadb\Common\Auth;
 use Icinga\Module\Icingadb\Common\Database;
-use Icinga\Module\Icingadb\Hook\CustomVarsRetrieverHook;
+use Icinga\Module\Icingadb\Hook\SearchColumnsProviderHook;
 use Icinga\Module\Icingadb\Model\Behavior\ReRoute;
 use Icinga\Module\Icingadb\Model\CustomvarFlat;
 use Icinga\Module\Icingadb\Model\Host;
@@ -133,8 +133,8 @@ protected function createQuickSearchFilter($searchTerm)
         $resolver = $model::on($this->getDb())->getResolver();
 
         $quickFilter = Filter::any();
-        $customVarColumns = CustomVarsRetrieverHook::getCustomVarColumns($model);
-        $columns = [...$model->getSearchColumns(), ...$customVarColumns];
+        $defaultColumns = $model->getSearchColumns();
+        $columns = SearchColumnsProviderHook::getCustomVarColumns($model, $defaultColumns);
 
         foreach ($columns as $column) {
             if (strpos($column, '.') === false) {

library/Icingadb/Web/Control/SearchBar/ObjectSuggestions.php

@@ -22,7 +22,7 @@
 use Icinga\Module\Icingadb\Common\SearchControls;
 use Icinga\Module\Icingadb\Data\CsvResultSet;
 use Icinga\Module\Icingadb\Data\JsonResultSet;
-use Icinga\Module\Icingadb\Hook\CustomVarsRetrieverHook;
+use Icinga\Module\Icingadb\Hook\SearchColumnsProviderHook;
 use Icinga\Module\Icingadb\Web\Control\GridViewModeSwitcher;
 use Icinga\Module\Icingadb\Web\Control\ViewModeSwitcher;
 use Icinga\Module\Icingadb\Widget\ItemTable\StateItemTable;
@@ -305,8 +305,9 @@ public function handleSearchRequest(Query $query, array $additionalColumns = [])
     protected function prepareSearchFilter(Query $query, string $search, Filter\Any $filter, array $additionalColumns)
     {
         $model = $query->getModel();
-        $customVarColumns = CustomVarsRetrieverHook::getCustomVarColumns($model);
-        $columns = array_merge($model->getSearchColumns(), $additionalColumns, $customVarColumns);
+        $defaultColumns = $model->getSearchColumns();
+        $customVarColumns = SearchColumnsProviderHook::getCustomVarColumns($model, $defaultColumns);
+        $columns = array_merge($additionalColumns, $customVarColumns);
         foreach ($columns as $column) {
             if (strpos($column, '.') === false) {
                 $column = $query->getResolver()->qualifyColumn($column, $query->getModel()->getTableName());