[PooyaKharamesh]

Fixes missing permission validation in Extension Management.

Related to AB#648158

[Maria Zhelezova (mazhelez)]

Verified that this backport contains the same Extension Management authorization-hardening change as the reviewed main PR #12417 (identical production code; equivalent tests). Approving.

[Maria Zhelezova (mazhelez)]

Reviewed against the main PR #12417 (which I reviewed in full). The production/shipping changes in this backport are identical to main; the only differences are cosmetic whitespace and per-branch test-harness structure. Approving.

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Accept with Suggestions

What this PR does

This change replaces the Application Object Metadata read-permission proxy with explicit checks for SUPER or the system-scoped Exten. Mgt. - Admin permission set. The module ID and empty company scope prevent same-named or company-scoped assignments from granting tenant-wide extension management access. Existing install and uninstall flows still call the centralized permission check before changing extensions.

Problem-solution fit

Fit: Strong

The authorization change matches the reported missing permission validation and addresses the root cause. Direct administrator, SUPER, non-administrator, and company-scoped cases confirm the intended boundaries.

Suggestions

S1 (🟠 Moderate): Cover inherited administrator permission paths
Add a test for a user assigned a standard containing role such as System App - Admin. The current tests use direct Exten. Mgt. - Admin assignment, so they do not exercise the effective permission-set path used in production.

Risk assessment and necessity

Risk: This is a security-sensitive authorization path. The direct permission cases are covered, but standard containing roles depend on effective permission resolution that the new tests do not exercise.

Necessity: Read access to application metadata does not prove authority to install, uninstall, or otherwise manage tenant extensions. Replacing that proxy with the dedicated administrator permission is required.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12386 round=1 by=alexei-dobriansky at=2026-10-06T23:25:38Z lastSha=084edbf822a660ce92e7f6b6259743c2eccdd318 reviewKey=e2c384ba5ea35833b1ff898f7358ca15cd4585c489893de1592085d448218112 suggestions=S1@8fe75a70

[alexei-dobriansky]

Good Sense Reviewer - Round 2

Recommendation: Accept with Suggestions

What this PR does

The new commits repair the test harness by using a manual subscriber, binding it before extension lifecycle tests, and correcting test codeunit variables and ordering. These changes keep the production authorization logic unchanged and make the test-only bypass active only where the existing install and uninstall tests need it.

Status of previous suggestions

ID	Title	Status	Author response
S1	Cover inherited administrator permission paths	Not addressed	—

New observations (commits since round 1)

None - the changes only repair the test harness and do not introduce a new issue.

Risk assessment and necessity

Risk: The production check remains targeted: it accepts SUPER or the effective system-scoped extension administrator permission for the current app and rejects company-scoped assignments. The direct-assignment tests still do not exercise permission inherited through System App - Admin, so that production path remains unverified.

Necessity: Replacing application-metadata read access as the authorization proxy is required because metadata access does not grant authority to manage tenant extensions. The new test-harness changes are also needed so existing extension lifecycle tests can run without changing platform user records.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12386 round=2 by=alexei-dobriansky at=2026-10-07T23:48:09.7244052Z lastSha=ec7a881937222da031351fc7aea4a1ee90378c32 reviewKey=ea89192c14fb4e83282f9f6624d55e61e5a38849b8891543f151273778a9f965 suggestions=S1@8fe75a70:notaddressed parentRound=1