[PooyaKharamesh]

Fixes missing permission validation in Extension Management.

Related to AB#648158

[Maria Zhelezova (mazhelez)]

This backport targets releases/25.3, which is not a supported branch. It will not be approved or merged — please close it if it is no longer needed.

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Reject Changes

What this PR does

This change replaces a broad metadata read-permission proxy with explicit tenant-wide checks for SUPER or Exten. Mgt. - Admin. It also adds positive and negative regression tests, including the company-scoped assignment case.

The production permission logic is focused and matches the tenant-wide authorization boundary. However, the new test subscriber is not valid in a test codeunit, so the changed test app cannot compile.

Problem-solution fit

Fit: Strong

The change directly addresses the missing authorization boundary and covers the main allowed and denied assignments. The implementation is not merge-ready because the added test authorization subscriber prevents the test app from compiling.

Suggestions

S1 (🔴 High): Static subscriber prevents the test app compiling
Move this subscriber to a non-Test test-library codeunit, or make it manual and bind it explicitly. A static subscriber in a Test codeunit raises AL0501, so the changed test app cannot compile.

Risk assessment and necessity

Risk: Extension installation, removal, and orphan-data deletion are tenant-wide administrative operations. The explicit permission checks are narrow and match the established implementation, but the regression tests cannot compile or run in their current form.

Necessity: Replacing the table-read proxy is needed because it does not prove extension-management authority. This backport targets an unsupported release branch, so it should be closed or moved to a supported branch after the test subscriber is corrected.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12390 round=1 by=alexei-dobriansky at=2026-10-07T00:07:17.4968589Z lastSha=052c368d90cc136c1b75e6ffb1c35c0c18c7a88b reviewKey=a7a081acf99d716dbf4775b72d19319e5d3828f7f3e14fc8df0b5e71268be1fa suggestions=S1@653ec59d

[alexei-dobriansky]

Good Sense Reviewer - Round 2

Recommendation: Reject Changes

What this PR does

This change replaces the broad application-object read-permission check with explicit tenant-wide SUPER and Exten. Mgt. - Admin assignment checks. The new commits make the test subscriber manual, bind a stable instance before protected extension operations, and keep the explicit-user permission tests on a separate codeunit instance.

The round-1 compilation blocker is resolved. The strict application build passes, while the default jobs fail before compilation because a baseline artifact is unavailable. However, this backport targets releases/25.3, which is not a supported merge target.

Status of previous suggestions

ID	Title	Status	Author response
S1	Static subscriber prevents the test app compiling	Addressed	Added manual subscriber mode and guarded one-time binding before extension-operation tests.

New observations (commits since round 1)

None - the changes address the previous suggestion and reorder declarations only.

Risk assessment and necessity

Risk: The authorization check protects tenant-wide extension installation, removal, and related data-deletion operations. The round-2 commits only repair the test harness and preserve the explicit-user permission tests. The strict build passes; the default failures occur before compilation and do not provide a code diagnostic.

Necessity: Explicit permission validation is needed because application-object read access is not extension-management authority. This PR should not merge through releases/25.3; the hardening must use a supported target branch.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12390 round=2 by=alexei-dobriansky at=2026-10-07T23:51:27.4237207Z lastSha=6cefe85c376249df4b3614f4f8ac11b5e71b1136 reviewKey=5536bbe90537f7242d56dd46d9d96550912edd05946a88b3b1b77ca23c5c94ea suggestions=S1@653ec59d:addressed parentRound=1

[PooyaKharamesh]

Closing this PR because its target branch is unsupported and will not be merged here. The authorization-hardening change and any remaining review/build follow-up will be fixed in separate PRs targeting supported branches.

[PooyaKharamesh]

Closing this PR because its target branch is unsupported and will not be merged here. The authorization-hardening change and any remaining review/build follow-up will be fixed in separate PRs targeting supported branches.