[Bug 640454] Scope Expense Agent Entra permissions by company

src/Apps/W1/ExpenseAgent/app/src/Common/ExpenseAgentAPIValidation.Codeunit.al

@@ -6,7 +6,6 @@ namespace Microsoft.ExpenseAgent;
 
 using System.AI;
 using System.Environment;
-using System.Environment.Configuration;
 
 codeunit 6993 "Expense Agent API Validation"
 {
@@ -17,7 +16,6 @@ codeunit 6993 "Expense Agent API Validation"
     var
         AgentNotEnabledErr: Label 'Expense Agent is not enabled. Please contact your administrator.';
         CapabilityNotEnabledErr: Label 'The "%1" capability is not enabled. Please contact your administrator to enable the capability.', Comment = '%1 = a capability name, such as Expense Agent';
-        ExpenseAgentAadAppIdTxt: Label 'ee1eb5fd-719b-44f2-97d0-0efd34bc4148', Locked = true;
 
     procedure VerifyAgentAccess()
     begin
@@ -46,32 +44,24 @@ codeunit 6993 "Expense Agent API Validation"
     end;
 
     procedure GetAadAppId(): Text
+    var
+        ExpenseAgentEntraApp: Codeunit "Expense Agent Entra App Mgt.";
     begin
-        exit(ExpenseAgentAadAppIdTxt);
+        exit(ExpenseAgentEntraApp.GetAadAppId());
     end;
 
     procedure IsCurrentUserExpenseAgent(): Boolean
     var
-        AADApplication: Record "AAD Application";
-        EnvironmentInfo: Codeunit "Environment Information";
+        ExpenseAgentEntraApp: Codeunit "Expense Agent Entra App Mgt.";
     begin
-        if not EnvironmentInfo.IsSaaSInfrastructure() then
-            exit(true);
-
-        if not AADApplication.Get(ExpenseAgentAadAppIdTxt) then
-            exit(false);
-
-        exit(AADApplication."User ID" = UserSecurityId());
+        exit(ExpenseAgentEntraApp.IsCurrentUserExpenseAgent());
     end;
 
     [TryFunction]
     internal procedure TryGetExpenseAgentUserId(var ExpenseAgentUserId: Guid)
     var
-        AadApplication: Record "AAD Application";
+        ExpenseAgentEntraApp: Codeunit "Expense Agent Entra App Mgt.";
     begin
-        AadApplication.Get(ExpenseAgentAadAppIdTxt);
-        AadApplication.TestField(State, AadApplication.State::Enabled);
-
-        ExpenseAgentUserId := AadApplication."User ID";
+        ExpenseAgentUserId := ExpenseAgentEntraApp.GetEnabledExpenseAgentUserId();
     end;
 }

src/Apps/W1/ExpenseAgent/app/src/Integration/EAHttpClient.Codeunit.al

@@ -589,13 +589,13 @@ codeunit 6941 "EA Http Client"
     var
         ExpenseAgentSetup: Record "Expense Agent Setup";
         AzureADMgt: Codeunit "Azure AD Mgt.";
-        ExpenseAgentAPIValidation: Codeunit "Expense Agent API Validation";
+        ExpenseAgentEntraApp: Codeunit "Expense Agent Entra App Mgt.";
         OAuth2: Codeunit OAuth2;
         Scopes: List of [Text];
         OAuthScope: Text;
         OAuthScopePatternLbl: Label 'api://%1/', Locked = true;
     begin
-        OAuthScope := StrSubstNo(OAuthScopePatternLbl, ExpenseAgentAPIValidation.GetAadAppId());
+        OAuthScope := StrSubstNo(OAuthScopePatternLbl, ExpenseAgentEntraApp.GetAadAppId());
         Scopes.Add(OAuthScope + 'Expenses.ReadWrite.All');
         AccessToken := AzureADMgt.GetAccessTokenAsSecretText(OAuthScope, '', false);
         if AccessToken.IsEmpty() then begin

src/Apps/W1/ExpenseAgent/app/src/Setup/Codeunits/ExpenseAgentEntraAppMgt.Codeunit.al

@@ -0,0 +1,305 @@
+// ------------------------------------------------------------------------------------------------
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+// ------------------------------------------------------------------------------------------------
+namespace Microsoft.ExpenseAgent;
+
+using System.Agents;
+using System.Environment;
+using System.Environment.Configuration;
+using System.Security.AccessControl;
+using System.Security.User;
+
+codeunit 6913 "Expense Agent Entra App Mgt."
+{
+    Access = Internal;
+    InherentEntitlements = X;
+    InherentPermissions = X;
+    Permissions =
+        tabledata "AAD Application" = rm,
+        tabledata "Access Control" = rimd;
+
+    internal procedure EnableAadApplicationForCurrentCompany()
+    begin
+        VerifyCurrentUserCanManageExpenseAgent();
+        EnableAadApplicationForCurrentCompanyWithoutAuthorization();
+    end;
+
+    internal procedure DisableAadApplicationForCurrentCompany()
+    begin
+        VerifyCanDisableAadApplicationForCurrentCompany();
+        DisableAadApplicationForCompany(GetCurrentCompanyName());
+    end;
+
+    internal procedure IsCurrentUserExpenseAgent(): Boolean
+    var
+        AadApplication: Record "AAD Application";
+        EnvironmentInfo: Codeunit "Environment Information";
+    begin
+        if not EnvironmentInfo.IsSaaSInfrastructure() then
+            exit(true);
+
+        if not AadApplication.Get(GetAadAppId()) then
+            exit(false);
+
+        exit(AadApplication."User ID" = UserSecurityId());
+    end;
+
+    internal procedure GetEnabledExpenseAgentUserId(): Guid
+    var
+        AadApplication: Record "AAD Application";
+    begin
+        AadApplication.Get(GetAadAppId());
+        AadApplication.TestField(State, AadApplication.State::Enabled);
+
+        exit(AadApplication."User ID");
+    end;
+
+    internal procedure GetAadAppId(): Text
+    begin
+        exit(ExpenseAgentAadAppIdTxt);
+    end;
+
+    internal procedure VerifyCanDisableAadApplicationForCurrentCompany()
+    begin
+        VerifyCurrentUserCanManageExpenseAgent();
+    end;
+
+    local procedure EnableAadApplicationForCurrentCompanyWithoutAuthorization()
+    var
+        AadApplication: Record "AAD Application";
+    begin
+        GetAadApplication(AadApplication);
+
+        // Enabling creates the application user. Disable it again before changing permissions.
+        if AadApplication.State <> AadApplication.State::Enabled then begin
+            AadApplication.Validate(State, AadApplication.State::Enabled);
+            AadApplication.Modify(true);
+        end;
+
+        if HasPermissionForCurrentCompany(AadApplication) then
+            exit;
+
+        AadApplication.Validate(State, AadApplication.State::Disabled);
+        AadApplication.Modify(true);
+
+        AddPermissionForCompany(AadApplication, GetCurrentCompanyName());
+
+        AadApplication.Validate(State, AadApplication.State::Enabled);
+        AadApplication.Modify(true);
+    end;
+
+    local procedure DisableAadApplicationForCompany(CompanyNameValue: Text[30])
+    var
+        AadApplication: Record "AAD Application";
+        OtherCompanyPermissionExists: Boolean;
+    begin
+        if not AadApplication.Get(GetAadAppId()) then
+            exit;
+
+        OtherCompanyPermissionExists := HasOtherCompanyPermission(AadApplication, CompanyNameValue);
+        RemovePermissionForCompany(AadApplication, CompanyNameValue, not OtherCompanyPermissionExists);
+        if OtherCompanyPermissionExists then
+            exit;
+        if AadApplication.State = AadApplication.State::Disabled then
+            exit;
+
+        AadApplication.Validate(State, AadApplication.State::Disabled);
+        AadApplication.Modify(true);
+    end;
+
+    local procedure VerifyCurrentUserCanManageExpenseAgent()
+    var
+        AggregatePermissionSet: Record "Aggregate Permission Set";
+        AgentSystemPermissions: Codeunit "Agent System Permissions";
+        UserPermissions: Codeunit "User Permissions";
+    begin
+        if UserPermissions.IsSuper(UserSecurityId()) then
+            exit;
+
+        GetAgentAdminPermissionSet(AggregatePermissionSet);
+        if not UserPermissions.HasUserPermissionSetAssigned(
+            UserSecurityId(),
+            GetCurrentCompanyName(),
+            AggregatePermissionSet."Role ID",
+            AggregatePermissionSet.Scope,
+            AggregatePermissionSet."App ID")
+        then
+            Error(PermissionSetRequiredErr, AggregatePermissionSet.Name);
+
+        if not AgentSystemPermissions.CurrentUserHasCanManageAllAgentsPermission() then
+            Error(PermissionSetRequiredErr, AggregatePermissionSet.Name);
+
+        GetExpenseManagementAdminPermissionSet(AggregatePermissionSet);
+        if not UserPermissions.HasUserPermissionSetAssigned(
+            UserSecurityId(),
+            GetCurrentCompanyName(),
+            AggregatePermissionSet."Role ID",
+            AggregatePermissionSet.Scope,
+            AggregatePermissionSet."App ID")
+        then
+            Error(PermissionSetRequiredErr, AggregatePermissionSet.Name);
+
+        if not HasSecurityPermission(UserPermissions) then
+            Error(SecurityPermissionRequiredErr);
+
+        GetExpenseAgentPermissionSet(AggregatePermissionSet);
+        if not UserPermissions.HasUserPermissionSetAssigned(
+            UserSecurityId(),
+            GetCurrentCompanyName(),
+            AggregatePermissionSet."Role ID",
+            AggregatePermissionSet.Scope,
+            AggregatePermissionSet."App ID")
+        then
+            Error(PermissionSetRequiredErr, AggregatePermissionSet.Name);
+    end;
+
+    local procedure HasSecurityPermission(UserPermissions: Codeunit "User Permissions"): Boolean
+    var
+        AccessControl: Record "Access Control";
+        NullGuid: Guid;
+    begin
+        exit(UserPermissions.HasUserPermissionSetAssigned(
+            UserSecurityId(),
+            GetCurrentCompanyName(),
+            SecurityPermissionSetLbl,
+            AccessControl.Scope::System,
+            NullGuid));
+    end;
+
+    local procedure HasPermissionForCurrentCompany(AadApplication: Record "AAD Application"): Boolean
+    begin
+        exit(HasPermissionForCompany(AadApplication, GetCurrentCompanyName()));
+    end;
+
+    local procedure HasPermissionForCompany(AadApplication: Record "AAD Application"; CompanyNameValue: Text[30]): Boolean
+    var
+        AccessControl: Record "Access Control";
+        AggregatePermissionSet: Record "Aggregate Permission Set";
+    begin
+        GetExpenseAgentPermissionSet(AggregatePermissionSet);
+
+        SetExpenseAgentPermissionFilters(AccessControl, AadApplication, AggregatePermissionSet);
+        AccessControl.SetRange("Company Name", CompanyNameValue);
+        exit(not AccessControl.IsEmpty());
+    end;
+
+    local procedure HasOtherCompanyPermission(AadApplication: Record "AAD Application"; CompanyNameValue: Text[30]): Boolean
+    var
+        AccessControl: Record "Access Control";
+        AggregatePermissionSet: Record "Aggregate Permission Set";
+    begin
+        GetExpenseAgentPermissionSet(AggregatePermissionSet);
+        SetExpenseAgentPermissionFilters(AccessControl, AadApplication, AggregatePermissionSet);
+        AccessControl.SecurityFiltering(SecurityFilter::Ignored);
+        AccessControl.SetFilter("Company Name", '<>''''&<>%1', CompanyNameValue);
+        exit(not AccessControl.IsEmpty());
+    end;
+
+    local procedure AddPermissionForCompany(AadApplication: Record "AAD Application"; CompanyNameValue: Text[30])
+    var
+        AccessControl: Record "Access Control";
+        AggregatePermissionSet: Record "Aggregate Permission Set";
+    begin
+        if HasPermissionForCompany(AadApplication, CompanyNameValue) then
+            exit;
+
+        GetExpenseAgentPermissionSet(AggregatePermissionSet);
+
+        AccessControl.Init();
+        AccessControl.Validate("User Security ID", AadApplication."User ID");
+        AccessControl.Validate("Role ID", AggregatePermissionSet."Role ID");
+        AccessControl.Validate("App ID", AggregatePermissionSet."App ID");
+        AccessControl.Validate(Scope, AggregatePermissionSet.Scope);
+        AccessControl.Validate("Company Name", CompanyNameValue);
+        AccessControl.Insert(true);
+    end;
+
+    local procedure RemovePermissionForCompany(AadApplication: Record "AAD Application"; CompanyNameValue: Text[30]; RunTrigger: Boolean)
+    var
+        AccessControl: Record "Access Control";
+        AggregatePermissionSet: Record "Aggregate Permission Set";
+    begin
+        GetExpenseAgentPermissionSet(AggregatePermissionSet);
+
+        SetExpenseAgentPermissionFilters(AccessControl, AadApplication, AggregatePermissionSet);
+        AccessControl.SetRange("Company Name", CompanyNameValue);
+        AccessControl.DeleteAll(RunTrigger);
+    end;
+
+    local procedure GetAadApplication(var AadApplication: Record "AAD Application")
+    begin
+        if not AadApplication.Get(GetAadAppId()) then
+            Error(AadApplicationMissingErr);
+    end;
+
+    local procedure GetCurrentCompanyName(): Text[30]
+    begin
+        exit(CopyStr(CompanyName(), 1, 30));
+    end;
+
+    local procedure GetExpenseAgentPermissionSet(var AggregatePermissionSet: Record "Aggregate Permission Set")
+    begin
+        GetPermissionSet(AggregatePermissionSet, ExpenseAgentPermissionSetLbl);
+    end;
+
+    local procedure GetAgentAdminPermissionSet(var AggregatePermissionSet: Record "Aggregate Permission Set")
+    var
+        BaseApplicationAppId: Guid;
+    begin
+        Evaluate(BaseApplicationAppId, BaseApplicationAppIdTxt);
+        AggregatePermissionSet.Reset();
+        AggregatePermissionSet.SetRange("App ID", BaseApplicationAppId);
+        AggregatePermissionSet.SetRange("Role ID", AgentAdminPermissionSetLbl);
+        if not AggregatePermissionSet.FindFirst() then
+            ErrorPermissionSetMissing(AgentAdminPermissionSetLbl);
+    end;
+
+    local procedure GetExpenseManagementAdminPermissionSet(var AggregatePermissionSet: Record "Aggregate Permission Set")
+    begin
+        GetPermissionSet(AggregatePermissionSet, ExpenseManagementAdminPermissionSetLbl);
+    end;
+
+    local procedure GetPermissionSet(var AggregatePermissionSet: Record "Aggregate Permission Set"; PermissionSetId: Code[20])
+    var
+        ExpenseAgentAppId: Guid;
+    begin
+        AggregatePermissionSet.Reset();
+        Evaluate(ExpenseAgentAppId, ExpenseAgentAppIdTxt);
+        AggregatePermissionSet.SetRange("App ID", ExpenseAgentAppId);
+        AggregatePermissionSet.SetRange("Role ID", PermissionSetId);
+        if not AggregatePermissionSet.FindFirst() then
+            ErrorPermissionSetMissing(PermissionSetId);
+    end;
+
+    local procedure ErrorPermissionSetMissing(PermissionSetId: Code[20])
+    var
+        MissingPermissionSetErrorInfo: ErrorInfo;
+    begin
+        MissingPermissionSetErrorInfo.ErrorType := ErrorType::Internal;
+        MissingPermissionSetErrorInfo.DataClassification := DataClassification::SystemMetadata;
+        MissingPermissionSetErrorInfo.Message := StrSubstNo(PermissionSetMissingErr, PermissionSetId);
+        Error(MissingPermissionSetErrorInfo);
+    end;
+
+    local procedure SetExpenseAgentPermissionFilters(var AccessControl: Record "Access Control"; AadApplication: Record "AAD Application"; AggregatePermissionSet: Record "Aggregate Permission Set")
+    begin
+        AccessControl.SetRange("User Security ID", AadApplication."User ID");
+        AccessControl.SetRange("Role ID", AggregatePermissionSet."Role ID");
+        AccessControl.SetRange(Scope, AggregatePermissionSet.Scope);
+        AccessControl.SetRange("App ID", AggregatePermissionSet."App ID");
+    end;
+
+    var
+        ExpenseAgentAadAppIdTxt: Label 'ee1eb5fd-719b-44f2-97d0-0efd34bc4148', Locked = true;
+        ExpenseAgentAppIdTxt: Label '66efe10c-8033-403b-a86d-77c0887178ba', Locked = true;
+        BaseApplicationAppIdTxt: Label '437dbf0e-84ff-417a-965d-ed2bb9650972', Locked = true;
+        AgentAdminPermissionSetLbl: Label 'Agent - Admin', Locked = true;
+        ExpenseAgentPermissionSetLbl: Label 'Expense Agent', Locked = true;
+        ExpenseManagementAdminPermissionSetLbl: Label 'Expense Mgmt. Admin', Locked = true;
+        SecurityPermissionSetLbl: Label 'SECURITY', Locked = true;
+        AadApplicationMissingErr: Label 'The Expense Agent Microsoft Entra application is not configured.';
+        PermissionSetRequiredErr: Label 'You must be assigned the %1 permission set to manage the Expense Agent Microsoft Entra application.', Comment = '%1 = permission set name';
+        PermissionSetMissingErr: Label 'The %1 permission set is not available.', Comment = '%1 = permission set ID';
+        SecurityPermissionRequiredErr: Label 'You must be assigned either the SUPER or SECURITY permission set to manage the Expense Agent Microsoft Entra application.';
+}