From 2f616cba7ab7f3f5e905f79654e67921d42463a5 Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Sun, 25 Oct 2026 19:33:35 -0700 Subject: [PATCH] case 4719 - report templates changed only by Business administration Business administration - restricted could create, edit and import report templates, although the roles page uses exactly this as its example of a view-only restricted role. A template's script runs with the rights of whoever renders it (SuperUser for customer notifications), so changing one is an administrator right (F20). Report templates page and changelog updated. Deferred: audit every documented role right against BizRoles. Co-Authored-By: Claude Opus 5.5 --- devdocs/modernization/NET10-PORT.md | 1 + docs/8.0/ayanova/docs/adm-report-templates.md | 4 +--- docs/8.0/ayanova/docs/changelog.md | 1 + server/AyaNova/biz/BizRoles.cs | 4 +++- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/devdocs/modernization/NET10-PORT.md b/devdocs/modernization/NET10-PORT.md index ff27f35c..c3f69625 100644 --- a/devdocs/modernization/NET10-PORT.md +++ b/devdocs/modernization/NET10-PORT.md @@ -275,6 +275,7 @@ Found during the port, out of scope. One line each. - **Own case after the port (John):** the subscription server setup script is hard-coded in `biz-subscription-server.vue`, so every change needs a new Sockeye client build. Make it editable without a rebuild - **Improvement, own case after the port (John to create):** bring back logging of JavaScript error details from report page console errors, as Sockeye's port did. AyaNova logs only `ERROR: {message text}`; the per-argument detail (`arg instanceof Error ? arg.message : arg`) is commented out at `biz/ReportBiz.cs:873-876` since case 4586, because `IJSHandle.ExecutionContext` was removed. Sockeye 8.1.0 (`server/biz/ReportBiz.cs:575`) evaluates on the handle instead: `args.Message.Args.Select(arg => arg.EvaluateFunctionAsync("(arg) => arg instanceof Error ? arg.message : arg"))`, which also needs the console handler to be `async` again - Pre-existing, same in 8.2.4 (found in the 4579 sandbox test, John: Deferred): rendering a report for a record that does not exist (e.g. work order ids 1 and 2 in a trial without sample data) fails the job with a generic `ArgumentNullException` ("Value cannot be null. (Parameter 'o')") from `JObject.FromObject` in `WorkOrderBiz.GetReportData` (`WorkOrderBiz.cs:1030`), instead of skipping the missing record or saying it is not found. Other object types' `GetReportData` likely do the same +- **Roles audit (John, 2026-10-25, found in 4719):** check every object's rights as documented in the manual (each page's "Authorization Roles required" section and `ay-biz-admin-roles.md`) against `biz/BizRoles.cs`. Report templates were changeable by Business administration - restricted although the roles page uses exactly that case as its example of a view-only restricted role (fixed in 4719). If that slipped through there could be others; for each mismatch decide whether the code or the page is wrong - Pre-existing (found in the 4632 IIS test, John: Deferred): emailed report attachments have the content type `application/pdf/pdf`, because `Mailer.cs:51` builds `new MimePart("application/pdf", "pdf")` (media type and subtype) instead of `new MimePart("application", "pdf")`. Mail programs still open the file by its `.pdf` name ## Log diff --git a/docs/8.0/ayanova/docs/adm-report-templates.md b/docs/8.0/ayanova/docs/adm-report-templates.md index c37259b3..356773a7 100644 --- a/docs/8.0/ayanova/docs/adm-report-templates.md +++ b/docs/8.0/ayanova/docs/adm-report-templates.md @@ -22,11 +22,9 @@ Full access - Business administration -- Business administration - restricted - Read only access -- none +- Business administration - restricted ## How to access report templates diff --git a/docs/8.0/ayanova/docs/changelog.md b/docs/8.0/ayanova/docs/changelog.md index eb742b7a..278a4e2c 100644 --- a/docs/8.0/ayanova/docs/changelog.md +++ b/docs/8.0/ayanova/docs/changelog.md @@ -29,6 +29,7 @@ IN PROGRESS - Server: AyaNova now checks the email (SMTP) server's security certificate when sending email. If your mail server uses a self-signed or internal certificate and email notifications stop after upgrading, see [SMTP certificate check](ops-config-smtp-accept-any-certificate.md). - Server: after repeated failed login attempts, further attempts for that login, or from that address, are refused for a few minutes. - Server: new [trusted reverse proxies](ops-config-trusted-proxies.md) setting for a reverse proxy that runs on a different computer from the AyaNova server, so AyaNova sees each user's own address. +- Server: users with the "Business administration - restricted" role can view [report templates](adm-report-templates.md) but no longer create, edit or import them, as described for that [role](ay-biz-admin-roles.md). Give the full "Business administration" role to users who edit report templates. - Server: the server information page at `/api/v8/` no longer shows license details. - Server: business logo uploads must be PNG, JPEG, GIF, WebP or SVG images, and need full rights to global settings. See [business logos](adm-global-logo.md). - Server: when a user's password is reset or set by an administrator, or their login is disabled, they are signed out and must sign in again. diff --git a/server/AyaNova/biz/BizRoles.cs b/server/AyaNova/biz/BizRoles.cs index e3a160ae..3197a54c 100644 --- a/server/AyaNova/biz/BizRoles.cs +++ b/server/AyaNova/biz/BizRoles.cs @@ -873,7 +873,9 @@ namespace AyaNova.Biz // roles.Add(AyaType.Report, new BizRoleSet() { - Change = AuthorizationRoles.BizAdmin | AuthorizationRoles.BizAdminRestricted, + //case 4719: BizAdminRestricted only views templates, as ay-biz-admin-roles.md describes (a template's script runs + //with the rights of whoever renders it, so changing one is an administrator right) + Change = AuthorizationRoles.BizAdmin, ReadFullRecord = AuthorizationRoles.All, Select = AuthorizationRoles.All });