case 4719 - report templates changed only by Business administration

Business administration - restricted could create, edit and import report
templates, although the roles page uses exactly this as its example of a
view-only restricted role. A template's script runs with the rights of
whoever renders it (SuperUser for customer notifications), so changing one
is an administrator right (F20). Report templates page and changelog
updated. Deferred: audit every documented role right against BizRoles.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

devdocs/modernization/NET10-PORT.md

@@ -275,6 +275,7 @@ Found during the port, out of scope. One line each.
 - **Own case after the port (John):** the subscription server setup script is hard-coded in `biz-subscription-server.vue`, so every change needs a new Sockeye client build. Make it editable without a rebuild
 - **Improvement, own case after the port (John to create):** bring back logging of JavaScript error details from report page console errors, as Sockeye's port did. AyaNova logs only `ERROR: {message text}`; the per-argument detail (`arg instanceof Error ? arg.message : arg`) is commented out at `biz/ReportBiz.cs:873-876` since case 4586, because `IJSHandle.ExecutionContext` was removed. Sockeye 8.1.0 (`server/biz/ReportBiz.cs:575`) evaluates on the handle instead: `args.Message.Args.Select(arg => arg.EvaluateFunctionAsync("(arg) => arg instanceof Error ? arg.message : arg"))`, which also needs the console handler to be `async` again
 - Pre-existing, same in 8.2.4 (found in the 4579 sandbox test, John: Deferred): rendering a report for a record that does not exist (e.g. work order ids 1 and 2 in a trial without sample data) fails the job with a generic `ArgumentNullException` ("Value cannot be null. (Parameter 'o')") from `JObject.FromObject` in `WorkOrderBiz.GetReportData` (`WorkOrderBiz.cs:1030`), instead of skipping the missing record or saying it is not found. Other object types' `GetReportData` likely do the same
+- **Roles audit (John, 2026-10-25, found in 4719):** check every object's rights as documented in the manual (each page's "Authorization Roles required" section and `ay-biz-admin-roles.md`) against `biz/BizRoles.cs`. Report templates were changeable by Business administration - restricted although the roles page uses exactly that case as its example of a view-only restricted role (fixed in 4719). If that slipped through there could be others; for each mismatch decide whether the code or the page is wrong
 - Pre-existing (found in the 4632 IIS test, John: Deferred): emailed report attachments have the content type `application/pdf/pdf`, because `Mailer.cs:51` builds `new MimePart("application/pdf", "pdf")` (media type and subtype) instead of `new MimePart("application", "pdf")`. Mail programs still open the file by its `.pdf` name
 
 ## Log

docs/8.0/ayanova/docs/adm-report-templates.md

@@ -22,11 +22,9 @@ Full access
 
 -   Business administration
 
--   Business administration - restricted
-
 Read only access
 
--   none
+-   Business administration - restricted
 
 ## How to access report templates
 

docs/8.0/ayanova/docs/changelog.md

@@ -29,6 +29,7 @@ IN PROGRESS
 - Server: AyaNova now checks the email (SMTP) server's security certificate when sending email. If your mail server uses a self-signed or internal certificate and email notifications stop after upgrading, see [SMTP certificate check](ops-config-smtp-accept-any-certificate.md).
 - Server: after repeated failed login attempts, further attempts for that login, or from that address, are refused for a few minutes.
 - Server: new [trusted reverse proxies](ops-config-trusted-proxies.md) setting for a reverse proxy that runs on a different computer from the AyaNova server, so AyaNova sees each user's own address.
+- Server: users with the "Business administration - restricted" role can view [report templates](adm-report-templates.md) but no longer create, edit or import them, as described for that [role](ay-biz-admin-roles.md). Give the full "Business administration" role to users who edit report templates.
 - Server: the server information page at `/api/v8/` no longer shows license details.
 - Server: business logo uploads must be PNG, JPEG, GIF, WebP or SVG images, and need full rights to global settings. See [business logos](adm-global-logo.md).
 - Server: when a user's password is reset or set by an administrator, or their login is disabled, they are signed out and must sign in again.

server/AyaNova/biz/BizRoles.cs

@@ -873,7 +873,9 @@ namespace AyaNova.Biz
             //            
             roles.Add(AyaType.Report, new BizRoleSet()
             {
-                Change = AuthorizationRoles.BizAdmin | AuthorizationRoles.BizAdminRestricted,
+                //case 4719: BizAdminRestricted only views templates, as ay-biz-admin-roles.md describes (a template's script runs
+                //with the rights of whoever renders it, so changing one is an administrator right)
+                Change = AuthorizationRoles.BizAdmin,
                 ReadFullRecord = AuthorizationRoles.All,
                 Select = AuthorizationRoles.All
             });