Field permission in post install script

Question

I want to create 1 permission set for my managed package and in that I need to assign standard Account object permission and its field permission. So here is my query :

• Can we assign field permission for permission set through post install script
• Will permission set will be working fine if created through post install script and package is installed through push upgrade.

Here, I am facing issue that every time my permission set permissions are not assigned same. Is there anything that I should take care of.

Answer 1

So short answer is yes but you may have to justify this to security team

Here is one i copied shamelessly from one of the gist repo available

public class UnmanagedPermissionSet{
 private static void ensureUnmanagedPermissionSet(){

    PermissionSet ps = null;
    try{
        ps = [SELECT Id, Label, (SELECT SObjectType FROM ObjectPerms) FROM PermissionSet WHERE Name = 'EnableEdit'];
    }
    catch(QueryException qe){
        ps = new PermissionSet(Name = 'EnableEdit', Label = 'Enable edit on Standard Objects');
    }
    upsert ps;

    Map<String,ObjectPermissions> oPerms = new Map<String,ObjectPermissions>();
    if(ps.ObjectPerms != null && !ps.ObjectPerms.isEmpty()){
        for(ObjectPermissions oPerm : ps.ObjectPerms){
            oPerms.put(oPerm.SObjectType,oPerm);
        }
    }


    ObjectPermissions campaignPerm = oPerms.get('Campaign');
    if(campaignPerm == null){
        campaignPerm = new ObjectPermissions(SObjectType='Campaign', ParentId=ps.Id);
        oPerms.put('Campaign',campaignPerm);
    }       

    campaignPerm.PermissionsRead = true;
    campaignPerm.PermissionsCreate = true;
    campaignPerm.PermissionsEdit = true;
    campaignPerm.PermissionsDelete = true;

    ObjectPermissions contactPerm = oPerms.get('Contact');
    if(contactPerm == null){
        contactPerm = new ObjectPermissions(SObjectType='Contact', ParentId=ps.Id);
        oPerms.put('Contact',contactPerm);
    }       

    contactPerm.PermissionsRead = true;
    contactPerm.PermissionsCreate = true;
    contactPerm.PermissionsEdit = true;
    contactPerm.PermissionsDelete = true;

    upsert oPerms.values();

   }                                    
 }

Answer 2

I hit the same issue regarding packaging permission sets and standard objects. I use a script that is similar to the answer above, but rather than run it via the post install script, I created a configuration page that the user can access via the configure link on the installed package screen:

The admin user just clicks a button on the VF page which runs the script to create the perm set, and then lets them view the contents of the permission set. This seemed more in line with what the security teams usually want - which is for the user to explicitly know what permission sets they are creating, and who they are being assigned to.