In this commit we rewrite a bit add_click in order to remove the inlined sudo and ease inheritance and parameter management inside the method. Access through controllers is sudo-ed as the main API method is now done with current user access rights. This commit is linked to task ID 1904277 and PR #28242.