Skip to content

fix: avoid webhook workflow to crash when processing user does not have required read permission on notifiable table#9603

Open
warlof wants to merge 1 commit into
microsoft:mainfrom
talent-bs:fix/issue-102318-permission-issue-while-sending-webhook-notification
Open

fix: avoid webhook workflow to crash when processing user does not have required read permission on notifiable table#9603
warlof wants to merge 1 commit into
microsoft:mainfrom
talent-bs:fix/issue-102318-permission-issue-while-sending-webhook-notification

Conversation

@warlof

@warlof warlof commented Jul 20, 2026

Copy link
Copy Markdown

What & why

when user does not have direct read access against notifiable table, emit event 0000EW6 with warning level and related table in attached metadata.

in such situation, assume there are no change to send against third party platform.

add delegated read access on financial tables which end user used to be denied access for confidential purpose.

Linked work

Fixes #8549, AB#102318

How I validated this

  • I read the full diff and it contains only changes I intended.
  • I built the affected app(s) locally with no new analyzer warnings.
  • I ran the change in Business Central and confirmed it behaves as expected.
  • I added or updated tests for the new behavior, or explained below why none are needed.

What I tested and the outcome (required — be specific: scenarios, commands, screenshots for UI changes)

  • No tests added because change are tied to ACL only

Risk & compatibility

Security

Delegate permission have been added to the codeunit to avoid issue when webhook system is used with Entry* tables

  • G/L Entry (read)
  • Item Ledger Entry (read)
  • Cust. Ledger Entry (read)
  • Detailed Cust. Ledg. Entry (read)
  • Vendor Ledger Entry (read)
  • Detailed Vendor Ledg. Entry (read)
  • G/L Register (read)
  • Item Budget Entry (read)
  • Cost Budget Entry (read)
  • G/L Budget Entry (read)
  • Bank Account Ledger Entry (read)

Also, Security Filter have been ignored in IsNullUpdate when the function is attempting to determine if the record still exists in the system.

Telemetry

New Telemetry Event has been introduced to track cases when triggering user do not have enough permission to execute webhook job (missing read access against the notified table).

General dimensions

Dimension Description or value
message User does not have read permission on subscribed table.
severityLevel 2
user_Id The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension Description or value
eventId AL0000EW6
alCategory AL API Webhook
alTableNumber Specifies the ID of the table that includes the changed field.

…ve required read permission on notifiable table

when user does not have direct read access against notifiable table, emit event 0000EW6 with warning level and related table in attached metadata.

in such situation, assume there are no change to send against third party platform.

add delegated read access on financial tables which end user used to be denied access for confidential purpose.

related to microsoft#8549, AB#102318
@warlof
warlof requested a review from a team July 20, 2026 13:21
@github-actions github-actions Bot added From Fork Pull request is coming from a fork Integration GitHub request for Integration area Linked Issue is linked to a Azure Boards work item labels Jul 20, 2026
@github-actions github-actions Bot added this to the Version 29.0 milestone Jul 20, 2026
@github-actions github-actions Bot added needs-approval Workflow runs require maintainer approval to start and removed needs-approval Workflow runs require maintainer approval to start labels Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

From Fork Pull request is coming from a fork Integration GitHub request for Integration area Linked Issue is linked to a Azure Boards work item

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: API Webhook notification are never sent when user do not have direct read access against table to be notified

1 participant