[API tests] End tenant sessions before dropping clean test tenant databases

[Prangshuman Das (t-prda)]

Review focus: Reset-BcTestTenant in build/scripts/ParallelTestExecution.psm1 (+ Pester tests).

Area fix: deterministic clean-tenant refresh. Before each RequiredTestIsolation=Disabled codeunit, clean-tenant execution drops and re-copies the worker tenant database. The container's Remove-NavDatabase runs ALTER DATABASE ... SET OFFLINE WITH ROLLBACK IMMEDIATE with no query timeout. In stack runs it intermittently blocked for 1,763-1,785 s on tenant2 (the server's 30-minute SQL command timeout), e.g. 4x in one IS IntegrationTests job on #12684, adding about 2 hours to that job.

Change:

• End the tenant's server sessions (Remove-NAVServerSession) before Dismount-NAVTenant.
• Replace Remove-NAVDatabase with one bounded query (120 s timeout, existing 3 retries): kill the remaining user SQL sessions on the database (by context and by held locks), SET SINGLE_USER WITH ROLLBACK IMMEDIATE, DROP DATABASE. It does nothing when the database does not exist.
• Log each ended session (program, status, wait) and the drop time, so any remaining stall can be diagnosed.

Validation: Pester 89/89. The T-SQL ran against SQL LocalDB with one connection holding an open transaction in the database and another idle in it: both sessions were ended and the database dropped in 0.17 s. Rerunning on a missing database is a no-op.

Related: AB#646383

Stack (each PR shows only its own layer; merge bottom first)

1. [API tests] Default to web service key authentication #12674 A: web service key auth (base: main)
2. [Expense tests] Re-enable Expense Agent API tests #12675 B: Expense API tests + clean test codeunit execution
3. [API tests] Re-enable APIV1 and APIV2 API tests #12676 C: re-enable APIV1/APIV2 API tests
4. [API tests] Simplify API test web service key handling #12890 Review fixes for A: simplify web service key handling
5. Area fixes: [API tests] Ensure VAT posting setup in API document fixtures #12677 D1 VAT fixtures → [API tests] Ensure cancellation reason codes in API sales document tests #12678 D2 cancellation reasons → [API tests] Handle localized purchase invoice payment discounts in APIV1 tests #12679 D3 localized discounts → [API tests] Set sales quote document and posting dates in API tests #12680 D4 quote dates → [API tests] Assign a number series to API vendor payment journals #12681 D5 journal numbering → [API tests] Ignore localized fields in API document comparisons #12682 D6 field comparison → [API tests] Return shipment PDF selection and pdfDocument test isolation #12683 D7 PDF documents → [API tests] Improve APIV1 fixture and verification reliability #12684 D8 APIV1 reliability → this PR, D9 tenant refresh

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ Security}$

The web service key is held in a Text variable while it is retrieved and checked, making the credential visible to debugger inspection and other plain-text handling. Keep the value as SecretText from the Identity Management retrieval through the authentication consumer; the [NonDebuggable] attribute does not replace the required SecretText credential type.

Knowledge:

• microsoft/knowledge/security/secrettext-for-credentials.md

Posting this finding as an issue comment because inline comment placement failed.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.50.6}

[github-actions]

$\textbf{🔴\ Critical\ Severity\ —\ Upgrade}$

The enum value with ordinal 1 was removed without an ObsoleteState = Pending -> Removed transition. Existing persisted rows using ordinal 1 can no longer resolve to the same enum member after the extension upgrade. Preserve the ordinal and obsolete the value with an ObsoleteReason and ObsoleteTag instead of deleting it.

Knowledge:

• microsoft/knowledge/upgrade/enum-values-additive-at-end.md

Posting this finding as an issue comment because inline comment placement failed.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.50.6}