Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I'm still a bit unsure which Apex classes I have to enable in a Permission set.

  1. I guess I don't need to enable Test classes
  2. I definitely need to enable Controller and Controller extensions for enables VF pages
  3. But do I also need to enable all the classes that are indirectly called by those classes
  4. Does the with sharing tell me anything about whether or not to enable a class?
  5. Does it matter wether the class is static or not?
  6. Do I need to enable abstract super classes that are indirectly used?
  7. What about Trigger Handler classes (= classes that hold the triggers code)?

The same in a way applies to Objects and their fields:

  1. If I use a purely technical SObject that is created and deleted by trigger code only. Do I need to enable in the users permission set?
share|improve this question

1 Answer 1

up vote 7 down vote accepted

that's a lot of questions!

1) No, you don't need to enable test class access permissions for users

2) Controllers and their extensions do need to be assigned by permissions (https://help.salesforce.com/HTViewHelpDoc?id=users_profiles_apex_access.htm&language=en_US&release=180.7)

3) No, all classes required by a class to which a user has permission can then be accessed by the user.. (https://help.salesforce.com/apex/HTViewHelpDoc?id=pages_page_level_security.htm&language=en_US)

4) "With sharing" affects only the record access (and SOQL) on a controller, "with sharing" means the class runs with the record access levels of the calling user, not the system. (http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_classes_keywords_sharing.htm) - it bears no relation to whether a user should have access to an Apex class.

5) No, Static has no affect on permissions, however, a lot of static classes/methods end up being called from other classes (in my experience) and so, with point 3 above, they will often find themselves "accessible" due to the cascading effect.

6) Nope, see 2 above!

7) Trigger events are executed at a system level every time they are required, so users do not need permissions for their code, or their associated utility classes

1a) Again, no because as per 7, the Trigger is executed by the system and so will have all the permissions needed to complete DML etc. (note the user may well not have access to the record that has been created though.)

share|improve this answer
2  
A great response, very detailed, regarding point 3, if the classes are packaged and have global visibility (e.g. an Apex API provided by the package suppler) these will need to be added. –  Andrew Fawcett Feb 11 at 10:41
    
Thank you Andrew, and a very good supplementary point! Cheers. –  Simon Lawrence Feb 11 at 10:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.