Skip to content

Block unauthorized Sales Order Agent setup access #10232

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
attilatoury wants to merge 1 commit into
base: main
Choose a base branch
from
+5 −0
Open

Block unauthorized Sales Order Agent setup access #10232

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/Apps/W1/SalesOrderAgent/app/src/Setup/SOASetup.Page.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -464,6 +464,7 @@ page 4400 "SOA Setup"
var
AgentRec: Record Agent;
SOASetupRec: Record "SOA Setup";
AgentSystemPermissions: Codeunit "Agent System Permissions";
FeatureTelemetry: Codeunit "Feature Telemetry";
SOASetupCU: Codeunit "SOA Setup";
UserSecurityIDFilter: Text;
Expand All @@ -480,6 +481,9 @@ page 4400 "SOA Setup"
if not Evaluate(UserSecurityID, UserSecurityIDFilter) then
Clear(UserSecurityID);

if not AgentSystemPermissions.CurrentUserCanManageAgent(UserSecurityID) then

@github-actions github-actions Bot Aug 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$\textbf{🟡\ Medium\ Severity\ —\ Breaking\ Changes}$

Adding Error(NotAuthorizedToConfigureAgentErr) in OnOpenPage means users who previously could open the Sales Order Agent setup page can no longer do so unless they hold agent-management permission (Configure All Agents, or Can Curr. User Configure Agent on the resolved Agent record). For a page reached only via first-time setup (gated separately by AllowCreateNewSOAgent requiring Configure All Agents) this is consistent, but for the edit path any previously-permitted viewer is now blocked at open time rather than at a modify/configure action, which is a behavior change worth calling out explicitly in the PR description.

👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.32.4

@github-actions github-actions Bot Aug 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$\textbf{🟡\ Medium\ Severity\ —\ Telemetry}$

The new permission-denied branch throws Error(NotAuthorizedToConfigureAgentErr) before the existing FeatureTelemetry.LogUptake(...Discovered) call executes, so a user who opens the Sales Order Agent setup page but lacks permission to manage the agent no longer records the feature-discovery telemetry event. Per the feature-uptake lifecycle guidance, Discovered should be logged when the user encounters the feature even if the flow cannot continue past that point. Move the LogUptake(Discovered) call (or an equivalent call) ahead of the new permission check, or emit it inside the error branch.

Suggested fix (apply manually — could not be anchored as a one-click suggestion):

        if not AgentSystemPermissions.CurrentUserCanManageAgent(UserSecurityID) then begin
            FeatureTelemetry.LogUptake('0000QIK', SOASetupCU.GetFeatureName(), Enum::"Feature Uptake Status"::Discovered);
            Error(NotAuthorizedToConfigureAgentErr);
        end;

Knowledge:

👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.32.4

Error(NotAuthorizedToConfigureAgentErr);

if not IsNullGuid(UserSecurityID) then
if SOASetupRec.GetBasedOnAgentUserSecurityID(UserSecurityID, false) then begin
Rec."Agent Name" := SOASetupRec."Agent Name";
Expand Down Expand Up @@ -798,6 +802,7 @@ page 4400 "SOA Setup"
DailyEmailLimitErr: Label 'The daily email limit must be greater than zero.';
EmailSignatureModifyLbl: Label 'Edit signature';
SelectMailboxFirstMsg: Label 'Please select an email account first.';
NotAuthorizedToConfigureAgentErr: Label 'You do not have permission to configure the Sales Order Agent. Contact your system administrator to update your permissions or to mark you as one of the administrators for the agent.';
ConfiguredBy: Text[80];
SOACreateTaskLbl: Label 'Create task for the agent';
EnableAgentForTaskQst: Label 'Trying out the agent will activate it and turn off incoming email monitoring immediately.\\Do you want to continue?';
Expand Down
Loading