[PooyaKharamesh]

Fixes missing permission validation in Extension Management.

Related to AB#648158

[Maria Zhelezova (mazhelez)]

The releases/25.0 branch is not supported, so this backport is out of scope and will not be merged here.

[Maria Zhelezova (mazhelez)]

This backport targets releases/25.0, which is not a supported branch. It will not be approved or merged — please close it if it is no longer needed.

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Reject Changes

What this PR does

This change replaces the metadata-table read-permission proxy with explicit checks for SUPER or the system-scoped Exten. Mgt. - Admin permission set. It also adds tests for non-admin, administrator, SUPER, and company-scoped assignments.

The production checks are narrow and match the tenant-wide nature of extension management. However, the new test subscriber is invalid in a test codeunit and prevents both targeted build jobs from compiling, so the regression tests never run.

Problem-solution fit

Fit: Strong

The explicit permission-set checks directly address the missing authorization validation, including rejection of company-scoped administrator assignments. The implementation cannot be accepted in its current form because the test app does not compile.

Suggestions

S1 (🔴 High): Test subscriber prevents the app from compiling
This subscriber is declared in a test codeunit, so AL0501 stops both targeted builds before tests can run. Move it to a non-test test-library codeunit, or use a manual subscriber and bind it explicitly.

Risk assessment and necessity

Risk: This authorization path controls tenant-wide extension installation, removal, and management. The permission checks are narrow, but the test app does not compile, so the changed behavior cannot be validated or delivered.

Necessity: The authorization hardening is justified for a supported version. This backport targets the unsupported releases/25.0 branch, so it is out of scope for this channel and should be closed or moved to a supported target.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12387 round=1 by=alexei-dobriansky at=2026-10-06T23:17:28Z lastSha=f73c0e596235ea1168471e0ca3d76ed8dbd063fb reviewKey=3dcf344adb3f6018651a0c58b859fda3be1e175527d49854a4c90cd114fe305e suggestions=S1@56c73632

[alexei-dobriansky]

Good Sense Reviewer - Round 2

Recommendation: Reject Changes

What this PR does

This change replaces the broad application-object read-permission check with explicit tenant-wide SUPER and Exten. Mgt. - Admin assignment checks. The new commits make the test subscriber manual, bind a stable instance before protected extension operations, and keep the explicit-user permission tests on a separate codeunit instance.

The previous compilation blocker is resolved, and the relevant application and test builds pass. However, this backport targets releases/25.0, which is not an accepted merge target.

Status of previous suggestions

ID	Title	Status	Author response
S1	Test subscriber prevents the app from compiling	Addressed	Added manual subscriber mode and guarded one-time binding before extension-operation tests. The relevant builds pass.

New observations (commits since round 1)

None - the changes address the previous suggestion and reorder declarations only.

Risk assessment and necessity

Risk: The authorization check protects tenant-wide extension installation, removal, and related data-deletion operations. The round-2 commits only repair the test harness, and the successful application and test builds remove the previous compile risk.

Necessity: Explicit permission validation is needed because application-object read access is not extension-management authority. This PR should not merge through releases/25.0; the hardening must use an accepted target branch.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12387 round=2 by=alexei-dobriansky at=2026-10-07T23:36:13.3141293Z lastSha=e4feacbf6187e9e043a7212fba72a08124341bb5 reviewKey=948c593829f1671cbcd1df44be9adc8f1696cce511fcb1ccd5947767e1300715 suggestions=S1@56c73632:addressed parentRound=1

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.