[PooyaKharamesh]

Fixes missing permission validation in Extension Management.

Related to AB#648158

[Maria Zhelezova (mazhelez)]

The releases/24.5 branch is not supported, so this backport is out of scope and will not be merged here.

[Maria Zhelezova (mazhelez)]

This backport targets releases/24.5, which is not a supported branch. It will not be approved or merged — please close it if it is no longer needed.

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Reject Changes

What this PR does

This change replaces a broad table-read permission check with explicit SUPER or tenant-wide Exten. Mgt. - Admin assignment checks, and adds regression tests. The production logic matches the intended authorization boundary, including rejection of a company-scoped admin assignment, but the new test subscriber prevents the test app from compiling.

Problem-solution fit

Fit: Strong

The change directly addresses the permission-validation gap and covers non-admin, admin, SUPER, and company-scoped cases. However, it targets an unsupported release branch, so it cannot be merged through this channel.

Suggestions

S1 (🔴 High): Test subscriber prevents the app from compiling
Test codeunits with event subscribers must use manual binding. Add EventSubscriberInstance = Manual and bind this subscriber only around tests that need the authorization bypass.

Risk assessment and necessity

Risk: This changes the authorization gate used by extension install, uninstall, and schema-related operations. A faulty check can grant or deny tenant-wide extension management, and the test module currently fails to compile, so the added regression tests have not run successfully.

Necessity: The permission hardening is needed for supported versions, but this backport targets unsupported releases/24.5. Close it here and move the fix to a supported branch or the approved servicing process.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12385 round=1 by=alexei-dobriansky at=2026-10-06T23:17:27Z lastSha=5cc2d7eec20df925dbd61beda8f623b3c6771d1d reviewKey=3f251c45036687d7ea7e40e47fb03a2e2540ddfb299ca9aab78d4b128a617023 suggestions=S1@653ec59d

[alexei-dobriansky]

Good Sense Reviewer - Round 2

Recommendation: Reject Changes

What this PR does

This change replaces a broad table-read permission check with explicit tenant-wide checks for SUPER or the Exten. Mgt. - Admin permission set. The new commits make the test subscriber manual, bind a stable instance before protected extension operations, and keep the explicit-user permission tests on a separate codeunit instance.

The previous compilation blocker is resolved, and the relevant application and test builds pass. The PR-specific discussion explicitly identifies this exact target branch, releases/24.5, as unsupported/out of channel and states that it will not be merged. The technically sound fix should not merge through this PR.

Status of previous suggestions

ID	Title	Status	Author response
S1	Test subscriber prevents the app from compiling	Addressed	Added manual subscriber mode and guarded one-time binding before extension-operation tests. The relevant application and test builds pass.

New observations (commits since round 1)

None - the changes address the previous suggestion and reorder declarations only.

Risk assessment and necessity

Risk: The authorization check protects tenant-wide extension installation, removal, and related data-deletion operations. The round-2 commits only repair the test harness; the successful application and test builds remove the previous compile risk. The PR-specific discussion explicitly identifies this exact target branch, releases/24.5, as unsupported/out of channel and states that it will not be merged. The technically sound fix should not merge through this PR.

Necessity: Explicit permission validation is needed because application-object read access is not extension-management authority. The PR-specific discussion explicitly identifies this exact target branch, releases/24.5, as unsupported/out of channel and states that it will not be merged. The technically sound fix should not merge through this PR.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12385 round=2 by=alexei-dobriansky at=2026-10-07T23:43:20Z lastSha=5841288c26d341c0085a8d71d1c7558d9e87de4c reviewKey=e2be03d68d106bb309df8d46900cd0cdc4fa2fdc50916674665ac75105caf4fd suggestions=S1@653ec59d:addressed parentRound=1

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.