Skip to content

revert: docs(AC0032): document CalcSums as a read and the CalcFields limitation (#201) #205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Arthurvdv merged 1 commit into from
Oct 17, 2026
Merged

revert: docs(AC0032): document CalcSums as a read and the CalcFields limitation (#201) #205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions content/docs/analyzers/ApplicationCop/AC0031.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ The following record method calls trigger this diagnostic:

| Permission | Methods |
|---|---|
| Read (`r`) | `Find`, `FindFirst`, `FindLast`, `FindSet`, `Get`, `GetBySystemId`, `IsEmpty`, `Count`, `Next`, `CalcSums` |
| Read (`r`) | `Find`, `FindFirst`, `FindLast`, `FindSet`, `Get`, `GetBySystemId`, `IsEmpty`, `Count`, `Next` |
| Insert (`i`) | `Insert` |
| Modify (`m`) | `Modify`, `ModifyAll`, `Rename` |
| Delete (`d`) | `Delete`, `DeleteAll` |
Expand All @@ -57,10 +57,6 @@ The following record method calls trigger this diagnostic:

Calls through the implicit `Rec` variable inside table objects are included (for example, `Rec.Modify()` in a table procedure).

`CalcSums` is a SQL aggregate over the receiver table, so it counts as a read on that table.

`CalcFields` is not checked. A FlowField is calculated from the table named in its `CalcFormula`, not from the receiver, and a user needs read permission on both tables ([Security considerations](https://learn.microsoft.com/dynamics365/business-central/dev-itpro/security/security-considerations)). Charging the receiver would require the wrong table, and resolving the formula's source table is not supported yet.

`Next` counts as a read even when the record set was positioned by another object. Permissions do not flow through the call stack: when a helper procedure runs `FindSet` on a `var` record parameter and the caller iterates it with `repeat ... until Rec.Next() = 0`, each `Next` call reads the table on behalf of the *calling* object, so the caller needs its own read (`r`) permission.

{{< highlight al >}}
Expand Down
6 changes: 0 additions & 6 deletions content/docs/analyzers/ApplicationCop/AC0032.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,12 +116,6 @@ codeunit 50100 "Customer Processing"
}
{{< /highlight >}}

### Aggregates and FlowFields

`CalcSums` counts as a read (`r`) operation: it is a SQL aggregate over the receiver table, so an object whose only access is `SetRange` followed by `CalcSums` is using its `r` permission and AC0032 does not report it.

`CalcFields` is not traced. The read happens on the table named in the FlowField's `CalcFormula`, not on the receiver, and a user needs read permission on both tables ([Security considerations](https://learn.microsoft.com/dynamics365/business-central/dev-itpro/security/security-considerations)). A permission declared only for a `CalcFields` receiver can therefore still be reported, and the table the formula reads is not recognised as used either.

### RecordRef operations

A `RecordRef` can point to any table, and which table it targets is only known at runtime. When an object contains **any** database operation on a `RecordRef` receiver (`Find`, `FindFirst`, `FindLast`, `FindSet`, `Get`, `GetBySystemId`, `IsEmpty`, `Count`, `Next`, `Insert`, `Modify`, `ModifyAll`, `Rename`, `Delete`, or `DeleteAll`), the rule cannot determine which declared permission that operation consumes. AC0032 is therefore disabled for the entire object: no unused-permission diagnostics are reported, and the code fix is not offered.
Expand Down
Loading