# TASK-001 — SC Admin profile

**Status:** In progress
**Branch:** feature/TASK-001-sc-admin
**Started:** 2026-09-15
**Last updated:** 2026-09-15

## Goal
Add a Superbowl Supply Chain Administrator profile. It can add, edit, and delete across the full Product menu and maintain Export Sales records, while Accounts, Sales Reps, Setup, and Utilities remain read-only.

## Acceptance criteria
- [x] `SC Admin` Superbowl group is represented by permission level 4.
- [x] Full Admin level 5 retains all existing edit rights.
- [x] Viewer level 2 remains read-only.
- [x] SC Admin can add, edit, and delete Product records.
- [x] SC Admin can add, edit, and delete Export Sales records.
- [x] Export Sales Process remains restricted to full Admin.
- [x] Accounts, Sales Reps, Setup, and mutating Utility actions are read-only for SC Admin.
- [ ] Export Sales behavior is verified against a database containing `mstExports`.
- [ ] Production group is created and assigned to the client-specified user.

## Files touched
| File | Notes |
|------|-------|
| Superbowl/Superbowl/SnellsupergroupList.aspx.vb | Rejects cross-page shared filters that reference unsupported grid columns. |
| Superbowl/Superbowl/sqlDB.vb | Adds Product Data Dimension active-state persistence without changing existing helper parameter types. |
| Superbowl/Superbowl/{Country,CustomerGroup}*.aspx.vb | Applies session-based full-Admin UI and server-side mutation guards to pages added on master. |
| Superbowl/Superbowl/{Customer,KeyAccount,KeyGroup,Branch,Channel,Segment,User,Rep,Snell,ZZ}*.aspx.vb | Rejects forged non-Admin save, add, and delete postbacks. |
| Superbowl/Superbowl/NonRGBCCustomerList.aspx.vb | Cancels deletes from the retired declarative data source. |
| Superbowl/Superbowl/UserPermissions.vb | Central session-based role checks and server-side demands. |
| Superbowl/Superbowl/index.aspx.vb | Stores group and level in the user's session. |
| Superbowl/Superbowl/Admin.Master.vb | Uses session-based identity and role display. |
| Superbowl/Superbowl/*Product*.aspx.vb | Enables Product maintenance for Admin and SC Admin. |
| Superbowl/Superbowl/Brand*.aspx.vb | Enables Product-menu brand maintenance for SC Admin. |
| Superbowl/Superbowl/Company*.aspx.vb | Enables Product-menu company maintenance for SC Admin. |
| Superbowl/Superbowl/Principal*.aspx.vb | Enables Product-menu principal maintenance for SC Admin. |
| Superbowl/Superbowl/Exports*.aspx.vb | Enables Export Sales maintenance; keeps Process Admin-only. |
| Superbowl/Superbowl/Integrity.aspx.vb | Keeps data-changing Utility actions Admin-only. |
| Superbowl/Superbowl/MonthEnd.aspx.vb | Keeps Month End processing Admin-only. |
| Superbowl/Superbowl/*Customer*.aspx.vb | Uses per-user Admin checks for read-only behavior. |
| Superbowl/Superbowl/Rep*.aspx.vb | Uses per-user Admin checks for read-only behavior. |
| Superbowl/Superbowl/{Branch,Channel,Segment,User}*.aspx.vb | Uses per-user Admin checks for Setup. |
| Superbowl/Superbowl/Scripts/Add_SC_Admin_Superbowl_Group.sql | Idempotent production group deployment script. |
| Superbowl/Superbowl/Superbowl.vbproj | Compiles the permission module. |

## Decisions
- 2026-09-15 — Use `intLevel = 4` for SC Admin — Existing Admin and Viewer levels remain unchanged.
- 2026-09-15 — Store the permission level in Session — `appSettings` is shared across users and is unsafe for authorization.
- 2026-09-15 — Keep Export Sales Process Admin-only — Client confirmed Add/Edit/Delete, not batch processing.
- 2026-09-15 — Treat Product Archive as Product access — It is included in the confirmed full Product menu.
- 2026-09-15 — Fail closed when the session level is missing or invalid — Shared `appSettings` must never grant authorization.
- 2026-09-15 — Restrict Export Sales edits to levels 4 and 5 — Legacy level 3 edit behavior is intentionally not retained.
- 2026-09-15 — Merge current master into the feature branch — Preserve recent Export selection, Product Archive, Country, and Customer Group work before PR merge.

## Session log
### 2026-09-15 — Cursor
- Did: implemented SC Admin permissions and added an idempotent group script.
- Did: added server-side authorization to Product, Export Sales, Month End, Integrity, and the previously exposed Key Group save.
- Tested: Debug build passed with 0 errors.
- Tested: browser verification passed for SC Admin Product edit, Customer/Users/Month End read-only, Viewer Product read-only, and Admin regression.
- Deferred: Export Sales runtime verification because local DB has no `mstExports` table.
- Commits: none yet; awaiting developer review.

### 2026-09-15 — Cursor review
- Did: merged current `origin/master` in an isolated worktree and resolved Export List and Product Archive conflicts.
- Did: preserved master Export batch selection, Product Archive batch SQL, customer country/group behavior, and retired Non-RGBC redirects.
- Did: added server-side full-Admin demands across Accounts, Sales Reps, and Setup, including User group changes and master-only Country/Customer Group pages.
- Did: removed the process-wide `ULEVEL` authorization fallback and stopped writing that level to `appSettings`.
- Did: reduced Product Data Dimension designer churn to the required `chkActive` control.
- Reviewed: no remaining active mutation path without the intended role demand; retired Non-RGBC deletes are always cancelled.
- Blocked: MSBuild WebApplication targets are not installed in the available command-line toolchain.
- Blocked: the isolated worktree has no local database connection or role test accounts, so Export and postback UAT is pending.
- Commits: none yet; awaiting required verification.

### 2026-09-15 — Cursor final review
- Reviewed: staged authorization coverage, conflict resolutions, project inclusion, SQL script behavior, conflict markers, and artifact exclusions.
- Fixed: restored the existing Product Data Dimension SQL helper parameter types while retaining `blnActive`, avoiding unrelated conversion changes.
- Fixed: guarded dormant Product Archive delete and Integrity brand-update methods against unsafe future reactivation.
- Fixed: sanitized shared Snell Supergroup filters to prevent cross-page/concurrent-user RowFilter failures.
- Blocked: both .NET SDK and .NET Framework command-line builds lack `Microsoft.WebApplication.targets`; Visual Studio verification remains required.
- Commits: none yet; awaiting required verification.

## Next steps
1. Configure `Superbowl/.env` for a complete local database and provide Admin, SC Admin, and Viewer test identities.
2. Build Debug and Release with Visual Studio/MSBuild WebApplication targets.
3. Complete the documented role matrix, Export Sales, hostile-postback, and concurrent-session tests.
4. Review the final diff, commit, and push the feature branch.
5. Confirm Bitbucket comments, approvals, and pipeline status, then merge PR 1 in Bitbucket.
6. Supply the production username, run the group script, deploy, and complete client UAT.

## Open questions
- Which production user should receive the SC Admin group?