[API tests] Adopt shared authentication for remaining general APIs

[Prangshuman Das (t-prda)]

Scope

Fixes AB#646383

Remaining general API shared-authentication adoption and reviewed non-Expense re-enablement above Expense-first #12325. This focused review diff has159 paths, removing temporary entries from the existing API exclusion manifests.

Expense authentication, its 51 existing API reenables, preserved nine non-API exclusions, existing clean-execution activation, PerDiem WorkDate prerequisite and consolidated Expense fixes/tests are inherited from #12325, not repeated here. No app-name allowlist or new runner selection logic.

Retain the general APIV1/APIV2/other reviewed caller migrations, license-safe WorkDate usage, Disabled-isolation declarations and exclusion changes. Keep the real HTTP CU139496 MicrosoftAuthenticationRespectsServerAuthMode regression here, alongside the existing shared auth/URL contracts. Its UserPassword path expects 401/200/401; Windows expects 200/200/200. Runtime at this new head is not yet proven.

The 47 general fix-owned methods remain downstream in #11224–#11230 and #11322, with each original layer-local patch unchanged. No extra Expense re-enablement is deferred to those PRs.

Exact head: c4953dceffe02a017adad34973e1955017bf5d20; tree: 0c79c4094ea8e54fb61edc325ce8166ec9b07b55.

Expense-first sequencing using existing exclusions

The same 193 method-specific temporary exclusions (135 APIV1 +58 APIV2 across12 codeunits) now live in the existing src/DisabledTests/_Exclude_APIV1__Tests/_Exclude_APIV1__Tests.DisabledTest.json and src/DisabledTests/_Exclude_APIV2__Tests/_Exclude_APIV2__Tests.DisabledTest.json. No separate sequencing files remain. Original entries retain their order/style/content; no new duplicate or wildcard/codeunit-wide exclusion is introduced. Unrelated pre-existing APIV2 duplicates are preserved rather than mixed with this change.

#11860 removes the temporary additions from these same existing manifests alongside its already-reviewed authentication uptake. All193 temporary stage entries are removed in #11860, but it makes 192/193 target methods eligible: the independent 139739::TestDeleteInUse exclusion remains until the VAT fixture fix #11224 removes it. From #11224 onward all193 are eligible; eligibility is not runtime success. All general/downstream cumulative trees are exactly byte-identical to the preceding checkpoint; the full checkpoint has none of these193 methods excluded. No app-name allowlist, selection setting, runner/authentication/test/production change or Logiq exclusion is added.

Why these methods started executing: they already required Disabled isolation and were IntegrationTest codeunits. Ordinary typed selection in TestSuiteMgt332–352 selects None|Codeunit; the old extra Disabled pass in RunTestsInBcContainer was UnitTest-only. The clean-execution switch newly reaches Disabled IntegrationTest codeunits and still honors the existing JSON exclusions. These193 methods were not listed in those exclusions. This is a pre-existing selection gap, not a newly introduced product auth bug or proof they never ran in any historical configuration. A complete67-codeunit audit preserves existing UnitTest/Legacy behavior and the ten independently handled Logiq integration tests. Historical baseline run37215976231 at head69df41756d918a516a3c868ca66f45cbfd320428 independently corroborates this: zero of the exact193 methods appear across five inspected W1 result artifacts containing37,626 testcases (Integration, both Legacy buckets, default/unit and Uncategorized). This evidence is limited to that W1 baseline, not every country or historical run. The completed alternate-path audit found no other ordinary configured baseline BCApps lane: APIV1/APIV2 are outside Legacy buckets, Disabled-unit fallback retains UnitTest filtering, discovery skips test procedures, and ordinary PR/CI/CD/rerun routes do not bypass those constraints. Manual or explicitly untyped execution remains possible; no universal historical or NAV absence is claimed.

**Expense scope is unchanged:**51 API reenables, nine non-API exclusions, baseline six cases and all consolidated regressions. The two legacy Spend Requests methods remain conditional on not CLEAN30. Focused #12325 review:21 files, including the two existing exclusion manifests. General #11860 review:159 files.

The official NAV Disable-NAVALTest helper was inspected: it has no destination/app-file parameter, writes NAV's App/DisabledTests using per-codeunit filenames and sorts entries. It cannot safely preserve these BCApps files. A bounded JSON relocation preserved original prefixes/order and checked exact identities, then exercised the unchanged real loader. No new shared helper/framework or NAV selector change was made.

Validation and presentation evidence

Pester117/117 passed independently at the new Expense/general/full heads. Actual existing-loader checks confirm identical effective193-method selection after relocation and preserved51/9 Expense scope. All nine downstream Git tree hashes remain exactly unchanged. Fresh exact-head CI is pending; old-head successes are not substituted for current runtime evidence.

Historical run37330893173 at head88881be reached193 general methods:171 genuine401 failures and22 nominal passes (17 bare-ASSERTERROR cases can accept the wrong error; five local fixtures). Separately, all51 Expense methods passed in13 inspected countries (663 results), and all63 touched API methods yielded819 results; Activity coverage was117/198 at that checkpoint. These are bounded historical results, not a full/current matrix pass. The preceding stage-fix runs hit50 hosted-runner acquisition cancellations; other jobs were active, so this was not a claimed global outage. New pushes schedule fresh CI, not an AL retry. The general SQL-pool NRE and missing warning-reference artifacts remain separate unresolved limitations.

Durable session presentation notes: api-test-enablement-presentation-notes.md, with source-pinned selection proof, fix/coverage inventory, helper limitations and historical-vs-current evidence boundaries. Fresh runtime proof must still establish the51 Expense cases and actual193-case suppression at Expense stage.

AB#646383 (link only). Native stack #12327 remains #12325 → #11860 → #11224 → #11225 → #11226 → #11227 → #11228 → #11229 → #11230 → #11322. Protected merged #10085/#11862/#11891 and validation #11892 are untouched; validation-only #11861/#11455 remain Do Not Merge. No new main integration, native-group/base change, PR merge, queue operation, Actions cancellation or manual retry was made. All prior heads remain ancestors; source publication used backups and an atomic forward-only push with explicit leases.

Exact current head: c4953dceffe02a017adad34973e1955017bf5d20; source tree: 0c79c4094ea8e54fb61edc325ce8166ec9b07b55.

[github-actions]

Issue #11224 is not valid. Please make sure you link an issue that exists, is open and is approved.

[alexei-dobriansky]

Good Sense Reviewer - Round 5

Recommendation: Accept

What this PR does

Since round 4, the stack was reshaped above the Expense-first PR. Fourteen inherited Expense and shared-prerequisite paths leave this PR, while all 159 remaining head files are byte-identical to the previously reviewed head. The updated base temporarily excludes 193 API methods; this PR removes 192 of them and intentionally keeps 139739::TestDeleteInUse excluded for its downstream fixture fix.

Status of previous suggestions

No previous suggestions were open.

New observations (commits since round 4)

None - both review samples found the stack reshaping consistent. The 135 APIV1 temporary exclusions are reduced by 134, all 58 APIV2 temporary exclusions are removed, and no new implementation path was introduced.

Risk assessment and necessity

Risk: The effective implementation at the head is unchanged for all 159 remaining paths. The current checks show 54 successes and 113 pending jobs; the single failure is issue-link validation rather than an AL correctness failure, so fresh runtime validation remains incomplete.

Necessity: The reshaping keeps Expense-first changes in the base and limits this PR to general API authentication uptake. Removing the temporary method exclusions makes the authenticated methods eligible while preserving the independently blocked TestDeleteInUse case.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=11860 round=5 by=alexei-dobriansky at=2026-10-05T22:55:26.768Z lastSha=c4953dceffe02a017adad34973e1955017bf5d20 reviewKey=197e5cecae4f07adb765e5194c80fa4c5a63c7389a141b2528e0e7914e8659a3 suggestions=none parentRound=4