Does anyone know how to use SOQL to verify if a profile has permission to View Encrypted Data? The field is not on the Profile object. Some fields such as View Data Categories do reside on the Profile object, but not View Encrypted Data. Thanks!
SELECT p.Id, p.Assignee.Name,p.Assignee.IsActive, p.Assignee.Profile.Name, p.PermissionSet.Label FROM PermissionSetAssignment p WHERE p.PermissionSet.PermissionsViewEncryptedData = true
There's no way access this encrypted state value in Visualforce/Apex Code. It is also unnecessary to know if it is encrypted as long as you remember to use
apex:outputField, which automatically honors the View Encrypted Data permission. If the user doesn't have permission, they will only see the encrypted text, and if they do, they'll see the normal text.
It's important to note that the decrypted value always appears in Apex Code's SOQL results. However, if you try to debug that value, it will appear encrypted to avoid accidentally exposing the value. You can prove that Apex Code sees the decrypted value by copying the value to string and displaying that string on the page, or by using
apex:outputText, which will show the non-encrypted data.
Simply query the field normally. If the field is encrypted, they will see only the masked value. You could also describe their profile and permission sets, and determine if they have permission, although this is largely unnecessary as a practical matter.