Skip to content

Slice 580818: [Expense Management] - Role Centers updates 💸 - #10677

Open
ViditGupta1277 wants to merge 6 commits into
mainfrom
features/Slice-580818-Expense-Management-Role-Centers-updates
Open

ViditGupta1277 wants to merge 6 commits into
mainfrom
features/Slice-580818-Expense-Management-Role-Centers-updates

Conversation

@ViditGupta1277

@ViditGupta1277 ViditGupta1277 commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Fixes AB#580818

Requirement:
Update the following role centers:
-Accountant
-Accounts Payable Administrator
-Business Manager
-Business Manager Evaluation

We need the following cues:
-Opened Expense Reports
-Release Expense Reports
-Expense Reports Pending Approvals
-Approved Expense Reports
-Rejected Expense Reports
-Processed for Payment Exp. Rep.
-Completed Expense Reports
-Released Expenses
-Policy Violated Expenses

@ViditGupta1277
ViditGupta1277 requested a review from a team August 27, 2026 04:02
@ViditGupta1277
ViditGupta1277 requested a review from a team as a code owner August 27, 2026 04:02
@github-actions github-actions Bot added the AL: Apps (W1) Add-on apps for W1 label Aug 27, 2026
@github-actions github-actions Bot added this to the Version 30.0 milestone Aug 27, 2026
…res/Slice-580818-Expense-Management-Role-Centers-updates
@@ -62,5 +62,6 @@ permissionset 6907 "Expense Mgmt. Read"
tabledata "Expense VAT Specification" = R,
tabledata "Expense Report Line VAT Spec." = R,
tabledata "Expense Activity Log Entry" = R,
tabledata "Expense Activities Cue" = RIMD,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$\textbf{🟠\ High\ Severity\ —\ Security}$

"Expense Mgmt. Read" (permissionset 6907) grants tabledata "Expense Activities Cue" = RIMD, while every other tabledata grant in this same read-only permission set is R only. This is an inconsistent over-grant: a permission set named and captioned "Expense Management - Read" should not hand out Insert/Modify/Delete rights on a table, especially since the cue table's own OnOpenPage trigger (Rec.Init/Rec.Insert) is what actually needs write access. Either move the row-initialization logic behind a call that runs under a more privileged/system context, or scope the write rights to the Edit permission set (which is already granted IMD on the same table) and keep Read at R.

Knowledge:

👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.35.4

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it should be Read Only

@github-actions

Copy link
Copy Markdown
Contributor

$\textbf{🟡\ Medium\ Severity\ —\ Style}$

src/Apps/W1/ExpenseAgent/app/src/Permissions/ExpenseManagementObjects.permissionset.al uses a lowercase permissionset type segment in its filename. BCQuality's file-naming rule expects the canonical AL object type casing in <ObjectName>.<ObjectType>.al (matching the sibling files ExpenseMgmtEdit.PermissionSet.al and ExpenseMgmtRead.PermissionSet.al in the same PR), so this file should be named ExpenseManagementObjects.PermissionSet.al for consistent path-to-object-kind mapping.

Knowledge:

Line mapping was unavailable, so this was posted as an issue comment.

👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.35.4

@JesperSchulz Jesper Schulz-Wedde (JesperSchulz) added the Team: Finance GitHub request for Finance area label Aug 27, 2026
@alexei-dobriansky

Copy link
Copy Markdown
Contributor

Good Sense Reviewer - Round 1

Recommendation: Accept with Suggestions

What this PR does

This change adds an Expense Activities cue part to the Accountant, Accounts Payable Administrator, and Business Manager role centers. The cue table counts expense reports by status and adds drilldowns to the expense report, expense, and rule-violation lists.

The status cues mostly map directly to the new flow fields, and the singleton cue record follows the usual role-center pattern. Two details should be tightened: the new part is always added to standard role centers without an Expense permission guard, and the policy-violated cue counts violation rows rather than expenses.

Problem-solution fit

Fit: Partial

The role centers receive the requested cues and drilldowns for the main report statuses. The fit is not complete because one cue name says it counts policy-violated expenses, but the implementation counts rule-violation records, which can be more than one per expense.

Suggestions

S1 (🟠 Moderate): Hide the part without Expense permissions
The three role center extensions add the Expense Activities part unconditionally. Please add an AccessByPermission guard, such as the Expense setup or cue table read permission, so users of these standard role centers do not get an Expense part they cannot open.

S2 (🟠 Moderate): Count violated expenses, not violations
Policy Violated Expenses uses count("Expense Rule Violation"), so one expense with two rule violations is counted twice. Please either count distinct expenses with violations, or rename the cue and drilldown so it clearly represents violation records instead of expenses.

Risk assessment and necessity

Risk: The change does not affect posting or ledger data, but it changes highly visible role centers. The main risks are role-center load or permission friction for users without Expense access, and misleading cue numbers for policy violations.

Necessity: The requested role-center visibility is a reasonable feature increment for expense management. The scope is also right for a role-center update, but the permission and cue-semantics details should be corrected before relying on the new tiles.


[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=10677 round=1 by=alexei-dobriansky at=2026-08-27T13:21:53Z lastSha=211fa9c37baf4d935dd8655b50ef66850d055d25 reviewKey=42febf9795913570375ebc088533879d3c221e523f55367e24068c797a3cc7a0 suggestions=S1@83fe6158,S2@5d065276

Comment thread src/Apps/W1/ExpenseAgent/app/src/Common/Pages/ExpenseActivities.Page.al Outdated
Comment thread src/Apps/W1/ExpenseAgent/app/src/Common/Tables/ExpenseActivitiesCue.Table.al Outdated
@ViditGupta1277
ViditGupta1277 requested a review from a team as a code owner August 31, 2026 05:25
@alexei-dobriansky

Copy link
Copy Markdown
Contributor

Good Sense Reviewer - Round 2

Recommendation: Accept with Suggestions

What this PR does

This change adds Expense Activities cues to the standard finance role centers and wires drilldowns for expense reports, released expenses, and policy violations. The only new code-bearing change since round 1 renumbers the new cue page and cue table and extends the app object range; that change is consistent with the final net diff.

The role-center wiring and object renumbering are low-risk metadata/UI changes. The earlier cue visibility and policy-violation count concerns are still present in the current diff.

Status of previous suggestions
ID Title Status Author response
S1 Hide the part without Expense permissions Not addressed
S2 Count violated expenses, not violations Not addressed
New observations (commits since round 1)

None - the new commit only renumbers the new objects and updates the app object range.

Risk assessment and necessity

Risk: The remaining risk is UI accuracy and role-center friction, not posting or ledger integrity. Users can still see an Expense part on standard role centers without a page-level permission guard, and the policy-violated cue can still show violation records instead of distinct expenses.

Necessity: The role-center visibility is a valid feature increment for expense management, and the new object numbers are necessary after the renumbering. The two earlier suggestions should still be considered before relying on these cues in preview.


[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=10677 round=2 by=alexei-dobriansky at=2026-08-31T07:17:16Z lastSha=91c57339a1278565fce1800e356cadaf80a3271a reviewKey=f2a9e45e7111c89c42fe44359370accd45b7ea7f8d6efdefef213da6ce34b353 suggestions=S1@83fe6158:notaddressed,S2@5d065276:notaddressed parentRound=1

@github-actions

Copy link
Copy Markdown
Contributor

$\textbf{🟡\ Medium\ Severity\ —\ Style}$

The changed permission-set file is named ExpenseManagementObjects.permissionset.al, but the style convention requires AL source files to follow <ObjectName>.<ObjectType>.al with the canonical object-type segment casing. Rename it to use .PermissionSet.al so grep- and convention-based tooling can identify the object type consistently.

Knowledge:

Line mapping was unavailable, so this was posted as an issue comment.

👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.35.4

@alexei-dobriansky

Copy link
Copy Markdown
Contributor

Good Sense Reviewer - Round 3

Recommendation: Accept

What this PR does

This change adds an Expense Activities cue part to the accountant, accounts payable administrator, and business manager role centers. It shows expense report status counts, released expenses, and expenses with policy violations, with drilldowns to the matching lists.

The changes since round 2 address the remaining issues: the cue part is now hidden unless the user can read Expense records, and the policy-violated cue now counts and opens expenses instead of violation rows. The added data classification for the cue key is also consistent with the singleton cue-table pattern.

Status of previous suggestions
ID Title Status Author response
S1 Hide the part without Expense permissions Addressed The part now has an Expense read-permission guard.
S2 Count violated expenses, not violations Addressed The cue and drilldown now use Expense records filtered by rule violations.
New observations (commits since round 2)

None - the new commits address the previous suggestions and add cue-key data classification.

Risk assessment and necessity

Risk: The remaining risk is limited to role-center UI and cue accuracy. The change does not touch posting, approvals, ledger entries, or amount calculation, and the new permission guard reduces role-center friction for users without expense access.

Necessity: The requested role-center cues are a coherent feature increment for expense management. The round 3 updates are necessary to make the cue visibility and policy-violated cue match the intended user experience.


[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=10677 round=3 by=alexei-dobriansky at=2026-08-31T13:23:34Z lastSha=35fb03465bda4cbb00636efe448c223de76080ec reviewKey=defc6e67c0341d5cc3134f666897a6c7b173c5dc4d1c7c174bfa28a2c9dc69be suggestions=S1@83fe6158:addressed,S2@5d065276:addressed parentRound=2

@v-rohangarg20 v-rohangarg20 removed the Team: Finance GitHub request for Finance area label Sep 1, 2026
@github-actions github-actions Bot added the Team: Finance GitHub request for Finance area label Sep 1, 2026
@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.


🔄 How to trigger a new status check:

  1. 📤 Push a new commit to the PR branch, or
  2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AL: Apps (W1) Add-on apps for W1 Team: Finance GitHub request for Finance area

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants