[Expense tests] Re-enable reviewed APIs and consolidate Expense fixes

[Prangshuman Das (t-prda)]

Scope

Related authentication and API enablement: AB#646383 (link only; this PR does not resolve the umbrella item).

Fixes AB#653119

Separate test defect: 653119 - Policy snapshot API URL composition and response isolation. This tracks the policy-snapshot test corrections, not production access permissions or unrelated runtime failures.

Expense-first adoption directly against main after the external squash merge of workflow #11891; remaining general APIs follow in #11860.

• Migrate the 11 reviewed Expense API/helper paths to shared authentication and remove exactly 51 existing Expense API exclusions. Preserve exactly nine non-API Expense exclusions; all 19 previously retained API exclusions are now removed.
• Enable the existing enableCleanTestCodeunitExecution boolean. Use existing DisabledTests selectors throughout discovery, ordinary execution and clean-codeunit execution/reruns. No app-name allowlist, new selection setting or runner implementation/test change.
• Include the six-line license-safe WorkDate helper needed by PerDiem, five query-safe policy URL compositions, four independent response clears, and the existing unlimited-approval fixture. Preserve all nine Activity Log tests and upstream assertions.
• Consolidate [Expense] Keep approver filters to exact submitter membership #11453's exact assigned-user filter (no cross-table range compression), true fallback fixture and regressions. Upstream wildcard quoting alone did not fix the range-gap case.
• Consolidate [Expense tests] Correct restricted permission assertions #11451's unique denied-approval error/permission capture and [Spend Request tests] Verify indirect updates and header totals #11454's existing repeated-delta, missing-header-permission, Released-status and real deletion-total regressions, including its internal test-only permission set.
• Do not reintroduce upstream repairs from Repair and re-enable Expense Agent permission and posted-history tests #11654 (three permission-role tests and posted zero-amount fixture), the obsolete date test removed by Expense Agent: travel request expense location, per-traveler reports, activity log and submitter comment #12074, or the production indirect-Modify change already supplied by Align travel request APIs with employee travelers and expense report lifecycle #11333. [Expense tests] Preserve negative fixtures and posted report identity #11452's duplicate deletion helper is absent; existing callers use the upstream shared helper.
• All seven artificial Expense exclusions introduced by the previous uptake are absent here and at every general checkpoint. This is not blanket re-enablement of Expense tests.

This focused review diff has21 paths, using the two existing API exclusion manifests. No NAV selectors, local NST, BC-ExpenseAgent changes, unrelated new test scope or production permission changes.

Exact head: bd3bbc04e13965f967a26eef435bdbf0cbc09ad7; tree: 2b8c47b138846f63bd49d47188f54ea7e86c1f24.

Expense-first sequencing using existing exclusions

The same 193 method-specific temporary exclusions (135 APIV1 +58 APIV2 across12 codeunits) now live in the existing src/DisabledTests/_Exclude_APIV1__Tests/_Exclude_APIV1__Tests.DisabledTest.json and src/DisabledTests/_Exclude_APIV2__Tests/_Exclude_APIV2__Tests.DisabledTest.json. No separate sequencing files remain. Original entries retain their order/style/content; no new duplicate or wildcard/codeunit-wide exclusion is introduced. Unrelated pre-existing APIV2 duplicates are preserved rather than mixed with this change.

#11860 removes the temporary additions from these same existing manifests alongside its already-reviewed authentication uptake. All193 temporary stage entries are removed in #11860, but it makes 192/193 target methods eligible: the independent 139739::TestDeleteInUse exclusion remains until the VAT fixture correction in PR #11224 removes it. From #11224 onward all193 are eligible; eligibility is not runtime success. All general/downstream cumulative trees are exactly byte-identical to the preceding checkpoint; the full checkpoint has none of these193 methods excluded. No app-name allowlist, selection setting, runner/authentication/test/production change or Logiq exclusion is added.

Why these methods started executing: they already required Disabled isolation and were IntegrationTest codeunits. Ordinary typed selection in TestSuiteMgt332–352 selects None|Codeunit; the old extra Disabled pass in RunTestsInBcContainer was UnitTest-only. The clean-execution switch newly reaches Disabled IntegrationTest codeunits and still honors the existing JSON exclusions. These193 methods were not listed in those exclusions. This is a pre-existing selection gap, not a newly introduced product auth bug or proof they never ran in any historical configuration. A complete67-codeunit audit preserves existing UnitTest/Legacy behavior and the ten independently handled Logiq integration tests. Historical baseline run37215976231 at head69df41756d918a516a3c868ca66f45cbfd320428 independently corroborates this: zero of the exact193 methods appear across five inspected W1 result artifacts containing37,626 testcases (Integration, both Legacy buckets, default/unit and Uncategorized). This evidence is limited to that W1 baseline, not every country or historical run. The completed alternate-path audit found no other ordinary configured baseline BCApps lane: APIV1/APIV2 are outside Legacy buckets, Disabled-unit fallback retains UnitTest filtering, discovery skips test procedures, and ordinary PR/CI/CD/rerun routes do not bypass those constraints. Manual or explicitly untyped execution remains possible; no universal historical or NAV absence is claimed.

**Expense scope is unchanged:**51 API reenables, nine non-API exclusions, baseline six cases and all consolidated regressions. The two legacy Spend Requests methods remain conditional on not CLEAN30. Focused #12325 review:21 files, including the two existing exclusion manifests. General #11860 review:159 files.

The official NAV Disable-NAVALTest helper was inspected: it has no destination/app-file parameter, writes NAV's App/DisabledTests using per-codeunit filenames and sorts entries. It cannot safely preserve these BCApps files. A bounded JSON relocation preserved original prefixes/order and checked exact identities, then exercised the unchanged real loader. No new shared helper/framework or NAV selector change was made.

Validation and presentation evidence

Pester117/117 passed independently at the new Expense/general/full heads. Actual existing-loader checks confirm identical effective193-method selection after relocation and preserved51/9 Expense scope. All nine downstream Git tree hashes remain exactly unchanged. Fresh exact-head CI is pending; old-head successes are not substituted for current runtime evidence.

Historical run37330893173 at head88881be reached193 general methods:171 genuine401 failures and22 nominal passes (17 bare-ASSERTERROR cases can accept the wrong error; five local fixtures). Separately, all51 Expense methods passed in13 inspected countries (663 results), and all63 touched API methods yielded819 results; Activity coverage was117/198 at that checkpoint. These are bounded historical results, not a full/current matrix pass. The preceding stage-fix runs hit50 hosted-runner acquisition cancellations; other jobs were active, so this was not a claimed global outage. New pushes schedule fresh CI, not an AL retry. The general SQL-pool NRE and missing warning-reference artifacts remain separate unresolved limitations.

Durable session presentation notes: api-test-enablement-presentation-notes.md, with source-pinned selection proof, fix/coverage inventory, helper limitations and historical-vs-current evidence boundaries. Fresh runtime proof must still establish the51 Expense cases and actual193-case suppression at Expense stage.

AB#646383 (link only). Native stack #12327 remains #12325 → #11860 → #11224 → #11225 → #11226 → #11227 → #11228 → #11229 → #11230 → #11322. Protected merged #10085/#11862/#11891 and validation #11892 are untouched; validation-only #11861/#11455 remain Do Not Merge. No new main integration, native-group/base change, PR merge, queue operation, Actions cancellation or manual retry was made. All prior heads remain ancestors; source publication used backups and an atomic forward-only push with explicit leases.

Exact current head: bd3bbc04e13965f967a26eef435bdbf0cbc09ad7; source tree: 2b8c47b138846f63bd49d47188f54ea7e86c1f24.

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Accept

What this PR does

This change adds shared credentials and cleanup for API tests, enables clean-codeunit execution, and moves the reviewed Expense API suites to the shared authentication provider. It also adds focused approval, permission, status, and amount regressions. The credential lifecycle, disabled-test selection, tenant restore, retry, and result-merging paths are covered by targeted tests, and the Expense API changes keep the existing request and assertion behavior.

Problem-solution fit

Fit: Strong

The change addresses the missing credential path that kept the authenticated API suites disabled. It re-enables the intended Expense API coverage while preserving the unrelated non-API exclusions.

Suggestions

None.

Risk assessment and necessity

Risk: The shared test infrastructure affects country projects and includes credential lifetime, clean-tenant restore, retry, and result-merging logic. The added Pester coverage exercises success and failure paths. The current System Application job failed because AL-Go could not retrieve a baseline artifact for warning comparison (HTTP 404), which is unrelated to the changed code; the remaining country jobs were still running. No report layout, public event surface, or BaseApp publisher dependency changed.

Necessity: The API suites could not authenticate with the pipeline-generated credential, so the affected coverage remained disabled. The shared provider and cleanup hooks are required to restore that coverage safely, and the Expense rollout is appropriately scoped.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12325 round=1 by=alexei-dobriansky at=2026-10-05T14:41:30.8161053Z lastSha=43162697456fffc0199258f5000344d61d5cbcbd reviewKey=c4cc53c46e657fa6ce6df10acfb425fde3d197565b644400178d91a47c9b78fc suggestions=

[github-actions]

Issue #11224 is not valid. Please make sure you link an issue that exists, is open and is approved.

[alexei-dobriansky]

Good Sense Reviewer - Round 2

Recommendation: Accept

What this PR does

The new commits keep 193 not-yet-authenticated general API test methods out of clean-codeunit execution by placing their method-specific selectors in the established APIV1 and APIV2 exclusion manifests. The final selectors exactly match the temporary staging set: 135 APIV1 methods and 58 APIV2 methods. Existing entries remain unchanged, no new duplicate keys were introduced, and every referenced codeunit and method exists.

Status of previous suggestions

None.

New observations (commits since round 1)

None.

Risk assessment and necessity

Risk: The main regression risk is excluding the wrong tests or changing existing selection. The added sets, entry order, existing manifest prefixes, duplicate keys, and source targets were checked and match the intended 193 methods. The completed failures are link-validation metadata checks rather than implementation failures; most code jobs are still running.

Necessity: The method-specific exclusions are needed to enable the authenticated Expense API scope without also starting general API methods before their shared-authentication uptake. Reusing the existing manifests keeps the selection mechanism unchanged and preserves the staged rollout.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12325 round=2 by=alexei-dobriansky at=2026-10-05T22:24:59.3418037Z lastSha=bd3bbc04e13965f967a26eef435bdbf0cbc09ad7 reviewKey=95e93e02053943cc1d850ec99d2e2c3e14e19956efc7249d092bda6a6255b8e2 suggestions= parentRound=1