Ondřej, could we also prevent this happening in future? What if every permission defined by plugin would be automatically assigned to Manager role and if it matches view_.+ it would be also associated to Viewer? Plugins would only defined plugin_manager and plugin_viewer role. Any other suggestions are welcome.

I do not think we can do this completely automatically and there may be cases when we do not want to. But I think #18001 is a reasonable solution.

In Discovery we are planning to lock and reset default discovery plugin roles in a seed script, this is likely a precedent. See discussion at https://github.com/theforeman/foreman_discovery/pull/352

I think the plugin API should do this automatically when roles are being registered (they should be locked).

Lukas Zapletal wrote:

In Discovery we are planning to lock and reset default discovery plugin roles in a seed script, this is likely a precedent. See discussion at https://github.com/theforeman/foreman_discovery/pull/352

I think the plugin API should do this automatically when roles are being registered (they should be locked).

I believe it's tracked by http://projects.theforeman.org/issues/19039, which is ready for testing