We are using angular for front-end and Salesforce is being used for maintaining database. REST APIs have been written on Salesforce to communicate and fetch data to front-end. A custom profile has been created with limited access for End users. SSO OAth settings are also being used in Salesforce. This results in exposing queries on browser console. We are using Custom Settings to store some data and this Custom Setting (Visibility- Protected) is being used in the Rest API.
We have a field (INFO_API_header_key__c) in this Custom Setting (List) which though not included in front-end query but gets accessible if we edit the query and add this field's API name through query call on postman (A direct query is not being made on Custom Setting but they are being as headers which are coming in front-end response). This exposes the stored data.
Since there is no option to set Field-level Security in Custom Settings, can you please help me with a sample code to hide this field's data through Apex code.
My requirement is this field's data should not be accessible on front-end (or postman) in query calls and for external users ,and this field should only be accessible in SalesForce API only through the field names.
REST API-
@RestResource(urlMapping='/v1/getreceiptInfo/*')
global with sharing class REST_GetDocInfo {
@HttpPost
global static postJson doPOST(Details customer) {
RestRequest req = RestContext.request;
RestResponse res = RestContext.response;
postJson response = new postJson();
validateInput(customer, response);
if(response.status != 'Failure') {
if(isAuthorizedUser(customer.Id)) {
response.rawRecord.addAll(getResponseModelList(customer, response));
if(response.status != 'Failure') {
response.status = 'Success';
response.errorCode.add('000');
response.message.add('Operation successful');
}
} else {
response.status = 'Failure';
response.errorCode.add('003');
response.message.add('You are not allowed to view the information');
}
}
return response;
}
//this class has the response data fields
global class postJson {
public List<ResponseModel> rawRecord;
public String status;
public String [] message;
public String [] errorCode;
public Boolean leadcustomer;
public postJson(){
rawRecord = new List<ResponseModel>();
message = new List<String>();
errorCode = new List<String>();
}
}
//this is custom response data model
global class ResponseModel {
public String receiptId;
public String customerName;
public String customerNumber;
public String receiptType;
public String valReceipt ;
public String receiptName;
public String leadcustomer;
public Decimal isReceiptListAvailable;
public String recOrderNumber;
public ResponseModel(String receiptId, String customerName, String
customerNumber, String receiptType,
String valReceipt , String receiptName, String leadcustomer, Decimal
isReceiptListAvailable, String recOrderNumber){
this.receiptId = receiptId;
this.customerName = customerName;
this.customerNumber = customerNumber;
this.receiptType = receiptType;
this.valReceipt = valReceipt ;
this.receiptName = receiptName;
this.leadcustomer = leadcustomer;
this.isReceiptListAvailable = isReceiptListAvailable;
this.recOrderNumber = recOrderNumber;
}
public ResponseModel(){}
}
//call to server and return info as string
private static String getInfo(String receipt , postJson response){
String valReceipt ;
JSONToApex jsonRequest = new JSONToApex();
jsonRequest.receiptUrl = receipt ;
Http http = new Http();
HttpRequest req = new HttpRequest();
Custom_Settings__c settings = Custom_Settings__c.getValues('App');
String reqBody= JSON.serialize(jsonRequest);
req.setEndPoint(settings.RECEIPT_URL__c);
req.setMethod('POST');
req.setHeader('content-type','application/json');
req.setHeader('x-api-key', settings.INFO_API_header_key__c);
req.setBody(reqBody);
try {
HTTPResponse res = http.send(req);
valReceipt = res.getBody();
} catch(Exception e) {
valReceipt = 'blank';
response.status = 'Failure';
response.errorCode.add('007');
response.message.add('Not able to get receipt. ' + e);
}
return valReceipt ;
}
}