0

I have set up a user with profile with limited access rights in a Developer Org. I need the user to be able to execute Apex classes, but not to have access to the source code.

Is this possible?

When I log in as the user I've created, I can still see source code, which I do not want to share.

  • Execute Apex classes how? Via Anonymous Apex in the Developer Console? – David Reed Nov 7 '18 at 12:37
  • Sorry, via REST API – NickJ Nov 7 '18 at 13:39
4

In order for your custom profile not to have access to Source code (or any other setup items), you need to disable the View Setup and Configuration permission on the profile. You may also like to disable the Author Apex permissions to make sure the Users on the profile cannot create/edit any apex or triggers.

This is usually a good practice to restrict any custom profile which is not supposed to have administrative privileges.

For Users on that profile to be able to call Apex exposed as REST API (or any other API), the permission that is required is API Enabled.

You will find more details on different permissions on the documentation here.

2

As you would have found out: viewing Apex classes is enabled through "View Setup and Configuration", which in turn is associated with standard profile OOB and other such profiles. If you turn this off, there will be problems in running reports (including those from Veeva - if that is applicable).

There is no standard way through the profile route since no further granularity is available as of today.

I believe the answer lies in second-generation packaging - currently in beta. You could test out the beta and see if that's for you (in the future of course - you cannot install that in production yet). https://releasenotes.docs.salesforce.com/en-us/winter18/release-notes/rn_sfdx_pack2.htm

For casual reference: security is detailed out in https://help.salesforce.com/articleView?id=code_package_security.htm&type=5? :)

  • 1
    P.S. You've linked to the release notes from 3 releases ago. – sfdcfox Nov 7 '18 at 14:11
  • Oops. The release naming convention messes with my mind - sometimes, and I was trying to find out references to what I believed I knew (turns out its not much). Hopefully, the packaging comment stands, since only unlocked packages are made available today. – Prashanth K Nov 8 '18 at 1:53
  • The documentation now reads "You can install the package in any org you can authenticate, including a scratch org." Since it doesn't list any restrictions, you should be able to install to prod now. I don't have a prod I can test with, but it should work these days. I believe they started allowing it at least a release or two ago. – sfdcfox Nov 8 '18 at 3:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.