[PooyaKharamesh]

Fixes missing permission validation in Extension Management.

Related to AB#648158

[Maria Zhelezova (mazhelez)]

The releases/24.3 branch is not supported, so this backport is out of scope and will not be merged here.

[Maria Zhelezova (mazhelez)]

This backport targets releases/24.3, which is not a supported branch. It will not be approved or merged — please close it if it is no longer needed.

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Reject Changes

What this PR does

This change replaces the indirect metadata read-permission check with explicit authorization for SUPER or the system-scoped Exten. Mgt. - Admin permission set. It also adds focused tests for administrators, non-administrators, SUPER, and company-scoped assignments.

The permission API checks direct and inherited assignments, and the app ID, scope, company, and role filters match the intended tenant-wide authorization. The code-level fix is coherent and targets the authorization root cause.

Problem-solution fit

Fit: Strong

The change directly replaces the overly broad authorization signal with the specific permission sets intended to manage extensions. The added tests cover the main allow and deny cases.

Suggestions

None.

Risk assessment and necessity

Risk: This changes the tenant-wide authorization gate used by extension installation, removal, and data deletion. The explicit checks appear correct, and the code remains internal, but an error here could either deny valid administrators or allow unauthorized extension changes. AL compilation succeeded; runtime tests did not complete because the build environment could not connect to Docker.

Necessity: The authorization hardening is justified because unrelated metadata read access must not grant extension-management rights. However, releases/24.3 is not a supported target, so this backport should use a supported servicing channel or branch instead of being merged here.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12383 round=1 by=alexei-dobriansky at=2026-10-06T22:59:27Z lastSha=2c671ee8d6a5418c2e1256dc706bb0a5b2a15dc8 reviewKey=57b98099db6f04cc6ce2c10cea2a2b4460ec7f563e91b0e69a297b6b4f44f190 suggestions=none

[alexei-dobriansky]

Good Sense Reviewer - Round 2

Recommendation: Reject Changes

What this PR does

The new commits make the test-only authorization subscriber manual, bind it before extension lifecycle tests, and separate the test codeunit variables. They also reorder using declarations.

These updates fix the test subscriber lifecycle without changing the authorization logic. The explicit SUPER and system-scoped Exten. Mgt. - Admin checks remain coherent, and the focused authorization tests pass.

Status of previous suggestions

None from round 1.

New observations (commits since round 1)

None.

Risk assessment and necessity

Risk: This changes the tenant-wide authorization gate used by extension installation, removal, and data deletion. The explicit checks remain targeted, the application builds pass, and all 15 focused Extension Management tests pass; the round-2 commits add no new production behavior.

Necessity: The authorization hardening is justified. The PR-specific discussion explicitly identifies this exact target branch, releases/24.3, as unsupported/out of channel and states that it will not be merged. The technically sound fix should not merge through this PR.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12383 round=2 by=alexei-dobriansky at=2026-10-07T23:48:28Z lastSha=ba3710124efdcb12547b0a1574519278f065b9cf reviewKey=005e744ec209be9927b5b4602c078b8ff68e85f12071bd9463b2856263f41530 suggestions=none parentRound=1

[PooyaKharamesh]

Closing this PR because its target branch is unsupported and will not be merged here. The authorization-hardening change and any remaining review/build follow-up will be fixed in separate PRs targeting supported branches.

[PooyaKharamesh]

Closing this PR because its target branch is unsupported and will not be merged here. The authorization-hardening change and any remaining review/build follow-up will be fixed in separate PRs targeting supported branches.