Automatically, or at creation, assign a new class to a profile

Question

We are testing the use of the new Integration License for API use. .

We have been using the Admin license for our portal, which automatically gets assigned permissions to any new classes that are created, but are switching to the new license as it frees up a paid license.

With the switch to the new free integration user profile, however, any new classes are NOT assigned permissions automatically. This is causing issues as developers are forgetting to do the class permission assignment for the api user.

Is there any way to set this on the class when it is created, rather than having to remember to go to either the profile and add it there, or to the class in the list of classes under Custom Code and click on the Security link? Or to set this profile as being updated with permissions as admin (in our case it requires access to all classes)?

I don't want to have to go into the orgs after deploying new classes and set this manually on the profile each time. I know I can create a permission set for the profile, but again, it has to be maintained manually, so there's still the problem of a dev forgetting to do so.

Answer 1

Users with Author Apex ignore Apex Class access permissions. That's why Apex Code will always run for those users. You can't have a trigger or something to respond immediately to changes. Further, you can't just give the Salesforce Integration license type Author Apex. However, you could write a script to automate this.

Example:

public class AssignPermissionsForClasses implements Schedulable {
  public void execute(SchedulableContext context) {
    PermissionSet integrationPermissionSet = [
      SELECT Id FROM PermissionSet WHERE Profile.Name = 'Integration User'
    ];
    ApexClass[] classes = [SELECT Id FROM ApexClass];
    SetupEntityAccess[] seas = new SetupEntityAccess[0];
    for(ApexClass klass: classes) {
      seas.add(
        new SetupEntityAccess(
          ParentId=integrationPermissionSet.Id, 
          SetupEntityId=klass.Id
        )
      );
    }
    // Silently ignore failures.
    Database.insert(seas, false);
  }
}

Schedule this to run hourly or whatever. It'll make sure that any classes that aren't assigned to the user will be within the next hour.

You could also write this as a script to run in Execute Anonymous (just take out the first and last two lines of code), or as a SandboxPostCopy script, etc.