18

So I have a managed package we'll call Package Core. It has various components, incl custom fields on Account and Contact. It is licensed by user, and works as expected - no license, no access to the custom fields. I have a second package which is an extension of Package Core. That second package includes a VF page which queries fields in Package Core via JS Remote, and displays them on the page. Accessibility to those fields is checked using IsAccessible as required by Security Review.

But when a non-licensed user of Package Core accesses that VF page in the Extension package, they can see data from the Package Core fields, even though they don't have a license to those fields. In effect, my Extension package does not seem to respect license management, which seems wrong to me? What check should I be doing to ensure that if a user doesn't have a license to Package Core, they can't see the fields when they access them from a Extension Package?

Improve this question
7
  • 2
    I'm pretty sure this is a feature, not a bug, but I don't see it in the documentation.
    – sfdcfox
    Apr 6, 2016 at 17:28
  • Doesn't apex have read access regardless of license - its just when you come to update you'll have problems? I know if you use standard visualforce to surface fields from core in extension (and you're not licensed) you would not see the field. Guessing since you're using remoting you have a HTML/JS UI?
    – Phil Hawthorn
    Apr 6, 2016 at 17:32
  • 1
    @PhilHawthorn Normally, if you have no access you get no fields. However, I suspect that in this case, since this is an extension package, that having access to the extension will give you access to the "parent" objects. Don't have a solution, though.
    – Sebastian Kessel
    Apr 6, 2016 at 17:37
  • Maybe I'm thinking triggers then....I know visualforce doesn't but thought apex (e.g. batch apex) did - I stand corrected :)
    – Phil Hawthorn
    Apr 6, 2016 at 17:40
  • Is your issue that the fields are visible to users who shouldn't see them or that users can edit them when they shouldn't be able to do either see or edit them? @andrewfawcett discusses some of these issues in his book Force.com Enterprise Architecture. As sfdcfox said, I think this may be expected behavior (visibility).
    – crmprogdev
    Apr 6, 2016 at 18:26

2 Answers 2

Reset to default
0

Have encountered similar limitations as well. Many operations in the dependent package, such as reading and editing these fields, will not require the managed package license. Some however still will, such as creating a Chatter Feed post related to the record which is in the licensed managed package.

If you need to do a programmatic check to enforce the license in your dependent package, you could add an exception or redirect on page load if the current user context does not have a package license.

For example,

private Boolean userHasPackageLicense() {
   List<UserPackageLicense> licenseAssignments = [
        SELECT
            Id
        FROM
            UserPackageLicense
        WHERE
            UserId = :UserInfo.getUserId()
        AND
            PackageLicense.NamespacePrefix = :'MyCoreNamespace'
    ];
    return !licenseAssignments.isEmpty();
}

...

if (!userHasPackageLicense()) {
   throw new ArrMateyException();
}
Improve this answer
1
-1

Is your extension package actually storing the data from the original package fields in another object or fields? If so, that could be your explanation. In our org, when users need a specific value for seeing reports, we use triggers, processes or workflow rules to put those values into our own custom fields to make the data visible.

Improve this answer
2
  • Nope - Extension is directly querying the fields in the core package. intereesting thing is that if I remove FLS from fields, then user doesn't see values because IsAccessible check removes field from query - so it is definitely using those fields
    – BritishBoyinDC
    Apr 6, 2016 at 18:15
  • Huh. That's interesting. Maybe the extension's Apex is "without sharing" and running as an administrator? Not that that helps you if you're trying to hide the values.
    – Lisa
    Apr 6, 2016 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .