Skip to content

[Quality Management] Improve Permissions #7205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JakovljevicDusan wants to merge 5 commits into
base: main
Choose a base branch
from
Open

[Quality Management] Improve Permissions #7205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
55722ea
"D365 BASIC" -> "D365 BASIC ISV"
JakovljevicDusan Mar 17, 2026
34acc2c
"QltyMngmnt - Edit" -> "QltyMngmnt - Admin"
JakovljevicDusan Mar 17, 2026
4e3606a
Include HasAdminSupervisorRole() into reopen inspection action check
JakovljevicDusan Mar 17, 2026
908efac
4. Limit "permissionset 20404 QltyMngmntInspector" to operational-onl…
JakovljevicDusan Mar 17, 2026
dcc99cf
Suppress warnings
JakovljevicDusan Mar 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/Apps/W1/Quality Management/Test Library/src/QltyInspectionUtility.Codeunit.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,15 +54,15 @@ codeunit 139940 "Qlty. Inspection Utility"
LibraryUtility: Codeunit "Library - Utility";
NoSeriesCodeunit: Codeunit "No. Series";
DefaultResult2PassCodeLbl: Label 'PASS', Locked = true;
SupervisorRoleIDTok: Label 'QltyMngmnt - Edit', Locked = true;
AdminSupervisorRoleIDTok: Label 'QltyMngmnt - Admin', Locked = true;

internal procedure EnsureSetupExists()
var
QltyAutoConfigure: Codeunit "Qlty. Auto Configure";
UserPermissionsLibrary: Codeunit "User Permissions Library";
begin
QltyAutoConfigure.EnsureBasicSetupExists(false);
UserPermissionsLibrary.AssignPermissionSetToUser(UserSecurityId(), SupervisorRoleIDTok);
UserPermissionsLibrary.AssignPermissionSetToUser(UserSecurityId(), AdminSupervisorRoleIDTok);
end;

internal procedure CreateABasicTemplateAndInstanceOfAInspection(var OutCreatedQltyInspectionHeader: Record "Qlty. Inspection Header"; var OutQltyInspectionTemplateHdr: Record "Qlty. Inspection Template Hdr.")
Expand Down
28 changes: 20 additions & 8 deletions src/Apps/W1/Quality Management/app/src/AccessControl/QltyPermissionMgmt.Codeunit.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ codeunit 20406 "Qlty. Permission Mgmt."
ActionChangeItemTrackingLbl: Label 'change item tracking';
ActionChangeSourceQuantityLbl: Label 'change source quantity';
ActionEditLineCommentLbl: Label 'edit line note/comment';
SupervisorRoleIDTxt: Label 'QltyMngmnt - Edit', Locked = true;
AdminSupervisorRoleIDTxt: Label 'QltyMngmnt - Admin', Locked = true;
UserDoesNotHavePermissionToErr: Label 'The user [%1] does not have permission to [%2].', Comment = '%1=User id, %2=permission being attempted';

/// <summary>
Expand Down Expand Up @@ -64,7 +64,7 @@ codeunit 20406 "Qlty. Permission Mgmt."
/// <returns>True if the user can change other users' inspections; otherwise, false.</returns>
internal procedure CanChangeOtherInspections(): Boolean
begin
exit(HasSupervisorRole());
exit(HasAdminSupervisorRole());
end;

/// <summary>
Expand All @@ -90,10 +90,22 @@ codeunit 20406 "Qlty. Permission Mgmt."
/// </summary>
internal procedure VerifyCanReopenInspection()
begin
if not CanModifyTableData(Database::"Qlty. Inspection Header") then
if not CanReopenInspection() then
Error(UserDoesNotHavePermissionToErr, UserId(), ActionReopenInspectionLbl);
end;

/// <summary>
/// Checks if the current user can reopen an inspection.
/// </summary>
/// <returns>True if the user can reopen an inspection; otherwise, false.</returns>
local procedure CanReopenInspection(): Boolean
begin
if not CanModifyTableData(Database::"Qlty. Inspection Header") then
exit(false);

exit(HasAdminSupervisorRole());
end;

/// <summary>
/// Verifies the current user can delete an open inspection. Throws an error if not permitted.
/// </summary>
Expand Down Expand Up @@ -121,7 +133,7 @@ codeunit 20406 "Qlty. Permission Mgmt."
if not CanDeleteTableData(Database::"Qlty. Inspection Header") then
exit(false);

exit(HasSupervisorRole());
exit(HasAdminSupervisorRole());
end;

/// <summary>
Expand Down Expand Up @@ -160,7 +172,7 @@ codeunit 20406 "Qlty. Permission Mgmt."
if not CanModifyTableData(Database::"Qlty. Inspection Header") then
exit(false);

exit(HasSupervisorRole());
exit(HasAdminSupervisorRole());
end;

/// <summary>
Expand Down Expand Up @@ -195,15 +207,15 @@ codeunit 20406 "Qlty. Permission Mgmt."
end;

#region Verify Permissions
local procedure HasSupervisorRole() IsAssigned: Boolean
local procedure HasAdminSupervisorRole() IsAssigned: Boolean
var
UserPermissions: Codeunit "User Permissions";
CurrentExtensionModuleInfo: ModuleInfo;
begin
IsAssigned := HasUserPermissionSetDirectlyAssigned(UserSecurityId(), SupervisorRoleIDTxt);
IsAssigned := HasUserPermissionSetDirectlyAssigned(UserSecurityId(), AdminSupervisorRoleIDTxt);
if not IsAssigned then
if NavApp.GetCurrentModuleInfo(CurrentExtensionModuleInfo) then
IsAssigned := UserPermissions.HasUserPermissionSetAssigned(UserSecurityId(), CompanyName(), SupervisorRoleIDTxt, 0, CurrentExtensionModuleInfo.Id());
IsAssigned := UserPermissions.HasUserPermissionSetAssigned(UserSecurityId(), CompanyName(), AdminSupervisorRoleIDTxt, 0, CurrentExtensionModuleInfo.Id());
if not IsAssigned then
IsAssigned := UserPermissions.IsSuper(UserSecurityId());
end;
Expand Down
3 changes: 2 additions & 1 deletion src/Apps/W1/Quality Management/app/src/Document/QltyInspectionHeader.Table.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,8 @@ table 20405 "Qlty. Inspection Header"
DrillDownPageId = "Qlty. Inspection List";
LookupPageId = "Qlty. Inspection List";
DataClassification = CustomerContent;
Permissions = tabledata "Qlty. Inspection Line" = d;
Permissions = tabledata "Qlty. Inspection Line" = d,
tabledata "Qlty. I. Result Condit. Conf." = d;

fields
{
Expand Down
1 change: 1 addition & 0 deletions src/Apps/W1/Quality Management/app/src/Document/QltyInspectionLine.Table.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ table 20406 "Qlty. Inspection Line"
LookupPageId = "Qlty. Inspection Lines";
DrillDownPageId = "Qlty. Inspection Lines";
DataClassification = CustomerContent;
Permissions = tabledata "Qlty. I. Result Condit. Conf." = d;

fields
{
Expand Down
2 changes: 1 addition & 1 deletion ...pps/W1/Quality Management/app/src/Permissions/AdministratorQltyMngmnt.PermissionSetExt.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,5 +8,5 @@ using System.Security.AccessControl;

permissionsetextension 20402 "Administrator - QltyMngmnt" extends "Administrator"
{
IncludedPermissionSets = "QltyMngmnt - Edit";
IncludedPermissionSets = "QltyMngmnt - Admin";
}
4 changes: 2 additions & 2 deletions ...s/D365BasicQltyMngmnt.PermissionSetExt.al → ...365BasicIsvQltyMngmnt.PermissionSetExt.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ namespace Microsoft.QualityManagement.Permissions;

using System.Security.AccessControl;

permissionsetextension 20400 "D365 BASIC - QltyMngmnt" extends "D365 BASIC"
permissionsetextension 20400 "D365 BASIC ISV - QltyMngmnt" extends "D365 BASIC ISV"
{
IncludedPermissionSets = "QltyMngmnt - Edit";
IncludedPermissionSets = "QltyMngmnt - Admin";
}
2 changes: 1 addition & 1 deletion ...W1/Quality Management/app/src/Permissions/D365BusFullAccessQltyMngmnt.PermissionSetExt.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,5 +8,5 @@ using System.Security.AccessControl;

permissionsetextension 20401 "D365 BUS FULL ACCESS - QltyMngmnt" extends "D365 BUS FULL ACCESS"
{
IncludedPermissionSets = "QltyMngmnt - Edit";
IncludedPermissionSets = "QltyMngmnt - Admin";
}
8 changes: 6 additions & 2 deletions ...rmissions/QltyMngmntEdit.PermissionSet.al → ...missions/QltyMngmntAdmin.PermissionSet.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,11 @@ using Microsoft.QualityManagement.Workflow;
/// <summary>
/// Used for administering Quality Management and supervising Quality Inspections.
/// </summary>
permissionset 20405 "QltyMngmnt - Edit"
#pragma warning disable AS0125
#pragma warning disable AS0090
permissionset 20405 "QltyMngmnt - Admin"
{
Caption = 'Quality Management - Full edit access';
Caption = 'Quality Management - Administrator';
Access = Public;
Assignable = true;

Expand All @@ -43,3 +45,5 @@ permissionset 20405 "QltyMngmnt - Edit"
tabledata "Qlty. Inspection Header" = RIMD,
tabledata "Qlty. Inspection Line" = RIMD;
}
#pragma warning restore AS0090
#pragma warning restore AS0125
24 changes: 11 additions & 13 deletions src/Apps/W1/Quality Management/app/src/Permissions/QltyMngmntInspector.PermissionSet.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ using Microsoft.QualityManagement.Configuration.SourceConfiguration;
using Microsoft.QualityManagement.Configuration.Template;
using Microsoft.QualityManagement.Configuration.Template.Test;
using Microsoft.QualityManagement.Document;
using Microsoft.QualityManagement.Integration.Inventory.Transfer;
using Microsoft.QualityManagement.RoleCenters;
using Microsoft.QualityManagement.Setup;
using Microsoft.QualityManagement.Workflow;
Expand All @@ -27,20 +26,19 @@ permissionset 20404 QltyMngmntInspector
IncludedPermissionSets = "QltyMngmnt - Objects";

Permissions =
tabledata "Qlty. Workflow Config. Value" = RIMD,
tabledata "Qlty. Inspection Gen. Rule" = RIMd,
tabledata "Qlty. Workflow Config. Value" = Rim,
tabledata "Qlty. Inspection Gen. Rule" = R,
tabledata "Qlty. I. Result Condit. Conf." = RIMd,
tabledata "Qlty. Inspection Result" = RIMd,
tabledata "Qlty. Inspection Template Hdr." = RIMd,
tabledata "Qlty. Inspection Template Line" = RIMd,
tabledata "Qlty. Test Lookup Value" = RIMd,
tabledata "Qlty. Management Setup" = RIMd,
tabledata "Qlty. Related Transfers Buffer" = RIMD,
tabledata "Qlty. Mgmt. Role Center Cue" = RIMd,
tabledata "Qlty. Inspect. Src. Fld. Conf." = RIMd,
tabledata "Qlty. Inspect. Source Config." = RIMd,
tabledata "Qlty. Inspection Result" = R,
Copy link
Contributor

@attilatoury attilatoury Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can a quality management inspector still record inspection results with this?

tabledata "Qlty. Inspection Template Hdr." = R,
tabledata "Qlty. Inspection Template Line" = R,
tabledata "Qlty. Test Lookup Value" = R,
tabledata "Qlty. Management Setup" = R,
tabledata "Qlty. Mgmt. Role Center Cue" = Ri,
tabledata "Qlty. Inspect. Src. Fld. Conf." = R,
tabledata "Qlty. Inspect. Source Config." = R,
tabledata "Qlty. Inspection Line" = RIMd,
tabledata "Qlty. Inspection Header" = RIMd,
tabledata "Qlty. Test" = RIMd;
tabledata "Qlty. Test" = R;
}

1 change: 1 addition & 0 deletions src/Apps/W1/Quality Management/app/src/RoleCenters/QltyInspectionActivities.Page.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ page 20425 "Qlty. Inspection Activities"
RefreshOnActivate = true;
SourceTable = "Qlty. Mgmt. Role Center Cue";
ApplicationArea = QualityManagement;
Permissions = TableData "Qlty. Mgmt. Role Center Cue" = i;

layout
{
Expand Down
3 changes: 2 additions & 1 deletion src/Apps/W1/Quality Management/app/src/Workflow/QltyWorkflowResponse.Codeunit.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ using System.Reflection;
/// </summary>
codeunit 20424 "Qlty. Workflow Response"
{
Permissions = tabledata "Workflow Step Instance" = r;
Permissions = tabledata "Workflow Step Instance" = r,
tabledata "Qlty. Workflow Config. Value" = im;

var
QltyWorkflowSetup: Codeunit "Qlty. Workflow Setup";
Expand Down
20 changes: 10 additions & 10 deletions src/Apps/W1/Quality Management/test/src/QltyTestsPermissionMgmt.Codeunit.al
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
QltyInspectionUtility: Codeunit "Qlty. Inspection Utility";
LibraryAssert: Codeunit "Library Assert";
UserDoesNotHavePermissionToErr: Label 'The user [%1] does not have permission to [%2].', Comment = '%1=User id, %2=permission being attempted';
SupervisorRoleIDTok: Label 'QltyMngmnt - Edit', Locked = true;
AdminSupervisorRoleIDTok: Label 'QltyMngmnt - Admin', Locked = true;

[Test]
procedure VerifyCanCreateManualInspection_ShouldError()
Expand All @@ -41,7 +41,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that creating a manual inspection succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanCreateManualInspection is called
QltyInspectionUtility.VerifyCanCreateManualInspection();
Expand Down Expand Up @@ -69,7 +69,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that creating a re-inspection succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanCreateReinspection is called
QltyInspectionUtility.VerifyCanCreateReinspection();
Expand Down Expand Up @@ -97,7 +97,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that deleting an open inspection succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanDeleteOpenInspection is called
QltyInspectionUtility.VerifyCanDeleteOpenInspection();
Expand Down Expand Up @@ -125,7 +125,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that deleting a finished inspection succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanDeleteFinishedInspection is called
QltyInspectionUtility.VerifyCanDeleteFinishedInspection();
Expand All @@ -140,7 +140,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that changing other users' inspections succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanChangeOtherInspections is called
QltyInspectionUtility.VerifyCanChangeOtherInspections();
Expand Down Expand Up @@ -169,7 +169,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that reopening an inspection succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanReopenInspection is called
QltyInspectionUtility.VerifyCanReopenInspection();
Expand Down Expand Up @@ -197,7 +197,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that finishing an inspection succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanFinishInspection is called
QltyInspectionUtility.VerifyCanFinishInspection();
Expand Down Expand Up @@ -226,7 +226,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that changing item tracking succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanChangeItemTracking is called
QltyInspectionUtility.VerifyCanChangeItemTracking();
Expand Down Expand Up @@ -255,7 +255,7 @@ codeunit 139957 "Qlty. Tests - Permission Mgmt."
// [SCENARIO] Verify that changing source quantity succeeds with proper supervisor permissions

// [GIVEN] The supervisor role permission set is added
LibraryLowerPermissions.AddPermissionSet(SupervisorRoleIDTok);
LibraryLowerPermissions.AddPermissionSet(AdminSupervisorRoleIDTok);

// [WHEN] VerifyCanChangeSourceQuantity is called
QltyInspectionUtility.VerifyCanChangeSourceQuantity();
Expand Down
Loading