How to know a profile has been cloned from system admin?

Question

We need to check in our code whether a user has system admin privileges to provide access to a feature. So far, we had been checking that the user matched the profileid of a System admin by querying profile.name='System Administrator'. However, this wouldn't work if the system administrator profile has been cloned to another profile, lets say - 'System admin - 2'

How do I validate that these users are system admin as well?

Answer 1

You should be checking individual permissions, not the profile name. A user is a system administrator if they have Modify All Data and Customize Application. You may also want to consider permission sets. A user therefore is an administrator if they have these permissions from any assigned permission set. Try the following:

Boolean isUserAdmin = 0 < [
  SELECT  COUNT()
  FROM    PermissionSetAssignment
  WHERE   AssigneeId = :UserInfo.getUserId() AND
          PermissionSetId IN (
            SELECT  Id 
            FROM    PermissionSet 
            WHERE   PermissionsModifyAllData = TRUE AND
                    PermissionsCustomizeApplication = TRUE
            )];