[PooyaKharamesh]

Fixes missing permission validation in Extension Management.

Related to AB#648158

[Maria Zhelezova (mazhelez)]

The releases/25.1 branch is not supported, so this backport is out of scope and will not be merged here.

[Maria Zhelezova (mazhelez)]

This backport targets releases/25.1, which is not a supported branch. It will not be approved or merged — please close it if it is no longer needed.

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Reject Changes

What this PR does

This PR replaces the broad Application Object Metadata read-permission proxy with explicit checks for tenant-wide SUPER or Exten. Mgt. - Admin assignments. It also adds the User Permissions dependency and regression tests for allowed and denied assignments.

The check is centralized before extension management operations. Empty-company, system-scope matching correctly rejects company-scoped admin assignment, and the existing helper resolves effective assignments for real users. The internal test event is limited to the friend test app and does not change the public surface.

Problem-solution fit

Fit: Strong

The implementation directly addresses the reported authorization gap and handles tenant-wide scope. The target branch is not supported, so the fix is in the wrong merge channel even though the code fits the bug.

Suggestions

S1 (🟠 Moderate): Cover included permission-set assignments
Add a real User-based case assigning System App - Admin, which includes Exten. Mgt. - Admin. These synthetic GUID tests only exercise direct Access Control rows, not the effective permission-composition path used in production.

Risk assessment and necessity

Risk: Authorization is centralized across extension management operations, so a wrong check could grant unauthorized access or lock out legitimate administrators. The code is internal, uses the existing User Permissions API, and does not change public signatures. The strict build passed; the other build failures were caused by unavailable baseline artifacts.

Necessity: The hardening is needed on a supported servicing branch because the old table-read proxy does not express the intended role. This backport targets releases/25.1, which is unsupported, so it should not merge through this branch.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12388 round=1 by=alexei-dobriansky at=2026-10-07T00:06:33.2673894Z lastSha=dae9031fc625946b8d93d8f3476429c992a6e061 reviewKey=9155b48984c7b84055e4365fdfccce611265d2ebb47b042b4d74e5b5a7aa9aab suggestions=S1@26598af9

[alexei-dobriansky]

Good Sense Reviewer - Round 2

Recommendation: Reject Changes

What this PR does

The new commits make the test codeunit a manual event subscriber, bind a stable authorization subscriber before the existing extension scenarios, keep permission checks on a separate codeunit instance, and reorder declarations. The production authorization logic is unchanged.

The implementation still replaces application-object read access with explicit tenant-wide checks for SUPER or Exten. Mgt. - Admin. For real users, the permission API checks direct assignments and then resolves included permission sets, so composite administrator roles remain supported.

Status of previous suggestions

ID	Title	Status	Author response
S1	Cover included permission-set assignments	Not addressed	The tests still use synthetic user IDs and direct Access Control rows, so they do not exercise the real-user permission-composition path.

New observations (commits since round 1)

None - the changes repair the test subscriber lifecycle and declaration order without introducing a new issue.

Risk assessment and necessity

Risk: The authorization gate protects tenant-wide extension installation, removal, deployment, and data cleanup. The production check is narrow and supports included permission sets for real users; the remaining test gap is non-blocking. The strict build passes, while the other build failures are caused by an unavailable baseline artifact rather than an AL diagnostic.

Necessity: Replacing metadata-read access as the authorization proxy is required because that permission is not extension-management authority. However, this backport targets
eleases/25.1, which is not a supported merge target, so the fix must use an accepted servicing branch.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12388 round=2 by=alexei-dobriansky at=2026-10-07T23:46:59.5394835+00:00 lastSha=4cb153324ed78d0cf7a8d1207105a25e8e7cbda9 reviewKey=e8a852749be409ed0d78ffeee982e8cf8a0a8047dacb5d13683ff2c915cb0e62 suggestions=S1@26598af9:notaddressed parentRound=1

[PooyaKharamesh]

Closing this PR because its target branch is unsupported and will not be merged here. The authorization-hardening change and any remaining review/build follow-up will be fixed in separate PRs targeting supported branches.

[PooyaKharamesh]

Closing this PR because its target branch is unsupported and will not be merged here. The authorization-hardening change and any remaining review/build follow-up will be fixed in separate PRs targeting supported branches.