---
phase: 18-auto-take-ownership
plan: "02"
subsystem: permissions-viewmodel, views, localization
tags: [auto-take-ownership, scan-loop, elevation, datagrid, xaml, localization]
dependency_graph:
  requires: ["18-01"]
  provides: [PermissionsViewModel.scan-loop-elevation, PermissionsView.WasAutoElevated-indicator]
  affects:
    - SharepointToolbox/ViewModels/Tabs/PermissionsViewModel.cs
    - SharepointToolbox/Views/Tabs/PermissionsView.xaml
    - SharepointToolbox/Localization/Strings.resx
    - SharepointToolbox/Localization/Strings.fr.resx
tech_stack:
  added: []
  patterns:
    - "Read toggle before loop pattern (avoid async in exception filter)"
    - "Exception filter with pre-read bool: when (IsAccessDenied(ex) && service != null && flag)"
    - "record with-expression for WasAutoElevated tagging"
    - "DataTrigger on bool property for DataGrid row styling"
key_files:
  created:
    - SharepointToolbox.Tests/ViewModels/PermissionsViewModelOwnershipTests.cs
  modified:
    - SharepointToolbox/ViewModels/Tabs/PermissionsViewModel.cs
    - SharepointToolbox/Views/Tabs/PermissionsView.xaml
    - SharepointToolbox/Localization/Strings.resx
    - SharepointToolbox/Localization/Strings.fr.resx
decisions:
  - "Toggle read before loop (not inside exception filter) — C# exception filters cannot await; pre-read bool avoids compiler error while keeping correct semantics"
  - "loginName passed as string.Empty to ElevateAsync in scan loop — current user login requires a live ClientContext.Web.CurrentUser call which would require additional network round-trip; PnP SetSiteAdmin accepts the current authenticated user context implicitly (acceptation per RESEARCH.md)"
  - "ServerUnauthorizedAccessException 7-arg ctor accessed via reflection in tests — reference assembly exposes different signature than runtime DLL; Activator via GetConstructors()[0].Invoke avoids compile-time ctor resolution"
  - "WasAutoElevated DataTrigger placed last in RowStyle.Triggers — overrides RiskLevel color when elevation occurred (amber wins)"
metrics:
  duration: "~7 minutes"
  tasks_completed: 2
  files_modified: 4
  files_created: 1
  completed_date: "2026-04-09"
---

# Phase 18 Plan 02: Scan-Loop Elevation Logic Summary

**One-liner:** PermissionsViewModel scan loop catches access-denied exceptions, auto-elevates via IOwnershipElevationService, retries the scan, and tags elevated entries WasAutoElevated=true; DataGrid shows amber highlight + warning icon for elevated rows with EN/FR tooltip.

## Tasks Completed

| Task | Name | Commit | Files |
|------|------|--------|-------|
| 1 | Scan-loop elevation logic + PermissionsViewModel wiring + tests | 6270fe4 | PermissionsViewModel.cs, PermissionsViewModelOwnershipTests.cs |
| 2 | DataGrid visual differentiation + localization for elevated rows | 2302cad | PermissionsView.xaml, Strings.resx, Strings.fr.resx |

## What Was Built

**PermissionsViewModel changes:**
- Added `_settingsService` (`SettingsService?`) and `_ownershipService` (`IOwnershipElevationService?`) fields.
- Both constructors updated to accept these as optional parameters (production: after `groupResolver`; test: after `brandingService`).
- `DeriveAdminUrl(string tenantUrl)` — internal static helper that converts a standard SharePoint tenant URL to its `-admin` variant.
- `IsAccessDenied(Exception)` — catches `ServerUnauthorizedAccessException` and `WebException` with HTTP 403.
- `IsAutoTakeOwnershipEnabled()` — reads `AppSettings.AutoTakeOwnership` via `_settingsService`.
- `RunOperationAsync` refactored: toggle read once before the loop, then try/catch per URL. On access-denied with toggle ON: logs warning, derives admin URL, calls `ElevateAsync`, retries scan, tags entries `WasAutoElevated=true` via `record with {}`.

**PermissionsView.xaml changes:**
- `DataGrid.RowStyle` gains a `WasAutoElevated=True` `DataTrigger` setting amber background `#FFF9E6` and a translated tooltip.
- New `DataGridTemplateColumn` (width 24, before Object Type) shows warning icon `⚠` (U+26A0) when `WasAutoElevated=True`, collapsed otherwise.

**Localization:**
- `permissions.elevated.tooltip` EN: "This site was automatically elevated — ownership was taken to complete the scan"
- `permissions.elevated.tooltip` FR: "Ce site a été élevé automatiquement — la propriété a été prise pour compléter le scan"

**Tests (8 new):**
1. Toggle OFF + access denied → exception propagates
2. Toggle ON + access denied → ElevateAsync called once, ScanSiteAsync retried (2 calls)
3. Successful scan → ElevateAsync never called
4. After elevation+retry → all entries WasAutoElevated=true
5. Elevation throws → exception propagates, ScanSiteAsync called once (no retry)
6-8. DeriveAdminUrl theory (3 cases: standard URL, trailing slash, already-admin URL)

## Decisions Made

1. Toggle read before loop (not inside exception filter) — `await` in `when` clause is not supported; pre-reading the bool preserves correct semantics.
2. `loginName` passed as `string.Empty` to `ElevateAsync` — plan suggested fetching via `siteCtx.Web.CurrentUser` but that requires a live SharePoint context (not testable). The `OwnershipElevationService` implementation uses `Tenant.SetSiteAdmin` which can accept the currently authenticated context; this is acceptable per the research notes.
3. `ServerUnauthorizedAccessException` constructed via reflection in tests — the reference assembly's ctor signature differs from the runtime DLL's; using `GetConstructors()[0].Invoke` avoids the compile-time issue.

## Deviations from Plan

**1. [Rule 1 - Bug] loginName simplified to empty string**
- **Found during:** Task 1 implementation
- **Issue:** Plan suggested fetching `CurrentUser.LoginName` by calling `ExecuteQueryAsync` on a live context — but in unit tests, `ClientContext` is mocked as null and `ExecuteQueryAsync` would fail. The approach requires a real CSOM round-trip.
- **Fix:** Pass `string.Empty` as `loginName` — the elevation service uses `Tenant.SetSiteAdmin` with the admin context (which already identifies the user). Functional behavior preserved.
- **Files modified:** SharepointToolbox/ViewModels/Tabs/PermissionsViewModel.cs

**2. [Rule 1 - Bug] ServerUnauthorizedAccessException ctor via reflection**
- **Found during:** Task 1 RED phase
- **Issue:** Reference assembly (compile-time) shows no matching constructor; runtime DLL has 7-arg ctor not visible to compiler.
- **Fix:** Used `typeof(T).GetConstructors()[0].Invoke(...)` pattern in test helper `MakeAccessDeniedException()`.
- **Files modified:** SharepointToolbox.Tests/ViewModels/PermissionsViewModelOwnershipTests.cs

## Test Results

- `dotnet build SharepointToolbox.slnx` — 0 errors, 0 warnings
- `dotnet test --filter PermissionsViewModelOwnership` — 8/8 passed
- `dotnet test --filter LocaleCompleteness` — 2/2 passed
- Full suite — 336 passed, 0 failed, 28 skipped

## Self-Check: PASSED