17

So I have a managed package we'll call Package Core. It has various components, incl custom fields on Account and Contact. It is licensed by user, and works as expected - no license, no access to the custom fields. I have a second package which is an extension of Package Core. That second package includes a VF page which queries fields in Package Core via JS Remote, and displays them on the page. Accessibility to those fields is checked using IsAccessible as required by Security Review.

But when a non-licensed user of Package Core accesses that VF page in the Extension package, they can see data from the Package Core fields, even though they don't have a license to those fields. In effect, my Extension package does not seem to respect license management, which seems wrong to me? What check should I be doing to ensure that if a user doesn't have a license to Package Core, they can't see the fields when they access them from a Extension Package?

7
  • 2
    I'm pretty sure this is a feature, not a bug, but I don't see it in the documentation. – sfdcfox Apr 6 '16 at 17:28
  • Doesn't apex have read access regardless of license - its just when you come to update you'll have problems? I know if you use standard visualforce to surface fields from core in extension (and you're not licensed) you would not see the field. Guessing since you're using remoting you have a HTML/JS UI? – Phil Hawthorn Apr 6 '16 at 17:32
  • 1
    @PhilHawthorn Normally, if you have no access you get no fields. However, I suspect that in this case, since this is an extension package, that having access to the extension will give you access to the "parent" objects. Don't have a solution, though. – Sebastian Kessel Apr 6 '16 at 17:37
  • Maybe I'm thinking triggers then....I know visualforce doesn't but thought apex (e.g. batch apex) did - I stand corrected :) – Phil Hawthorn Apr 6 '16 at 17:40
  • Is your issue that the fields are visible to users who shouldn't see them or that users can edit them when they shouldn't be able to do either see or edit them? @andrewfawcett discusses some of these issues in his book Force.com Enterprise Architecture. As sfdcfox said, I think this may be expected behavior (visibility). – crmprogdev Apr 6 '16 at 18:26
0

You can check with the vendor himself. This seems to be working as expected, since the vendor would have made sure you have access to only those parts of the package that you are supposed to!

1
  • Welcome to SF.SE Manjunath. Please visit the Help center to learn how our Forum works. Your post does not answer the question. The post is from the person who IS THE VENDOR. He's writing the code for the package. – crmprogdev Dec 17 '16 at 13:59
0

Have encountered similar limitations as well. Many operations in the dependent package, such as reading and editing these fields, will not require the managed package license. Some however still will, such as creating a Chatter Feed post related to the record which is in the licensed managed package.

If you need to do a programmatic check to enforce the license in your dependent package, you could add an exception or redirect on page load if the current user context does not have a package license.

For example,

private Boolean userHasPackageLicense() {
   List<UserPackageLicense> licenseAssignments = [
        SELECT
            Id
        FROM
            UserPackageLicense
        WHERE
            UserId = :UserInfo.getUserId()
        AND
            PackageLicense.NamespacePrefix = :'MyCoreNamespace'
    ];
    return !licenseAssignments.isEmpty();
}

...

if (!userHasPackageLicense()) {
   throw new ArrMateyException();
}
1
-1

Is your extension package actually storing the data from the original package fields in another object or fields? If so, that could be your explanation. In our org, when users need a specific value for seeing reports, we use triggers, processes or workflow rules to put those values into our own custom fields to make the data visible.

2
  • Nope - Extension is directly querying the fields in the core package. intereesting thing is that if I remove FLS from fields, then user doesn't see values because IsAccessible check removes field from query - so it is definitely using those fields – BritishBoyinDC Apr 6 '16 at 18:15
  • Huh. That's interesting. Maybe the extension's Apex is "without sharing" and running as an administrator? Not that that helps you if you're trying to hide the values. – Lisa Apr 6 '16 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.