What is the permission that governs reading Custom Permissions? [closed]

Question

Our managed package has some custom permissions that help provide an elevated set of capabilities to some users.

We have recently run into an issue with some people seeing this error message:

"Read" permission to object "CustomPermission" is not allowed for the current user.

I assume that they figured out a way to have a user profile with limited enough rights that it can't read CustomPermissions.

I was able to find ManageCustomPermissions, but I don't want to grant that kind of permission to a normal user.

I tried to see if ReadCustomPermissions was a thing, but when I tried to deploy it, I got the following message back from Salesforce:

Error  deploy/profiles/<managed package name> Standard User.profile  <Managed package name> Standard User  Unknown user permission: ReadCustomPermissions

Does anyone know what the permission is to explicitly allow those users the ability to read the customPermissions?

---

Update, talking about something I tried shortly after posting this questino:

I found this documentation page https://help.salesforce.com/articleView?id=custom_perms_detail.htm&type=5 that refers to the "View Setup and Configuration" permission. Maybe that is it?

I tried to update the permission set that our standard user is using with the following, based on the documentation I found earlier, but when I sent a beta release of the managed package to the team having the issue, there was no change to the errors they were getting, so that wasn't it.

(snippet from <package name>_User.permissionset-meta.xml)
    <userPermissions>
        <enabled>true</enabled>
        <name>ViewRoles</name>
    </userPermissions>
    <userPermissions>
        <enabled>true</enabled>
        <name>ViewSetup</name>
    </userPermissions>

---

Update, explaining how we are getting our custom permissions, as requested by comments:

As mentioned in my comment, we are using a class called "CustomPermissionsReader" to read the custom permissions, which can be found here: https://gist.github.com/afawcett/bc482bfdc840d5ac2858

This is how we are using it:

CustomPermissionsReader cpr = new CustomPermissionsReader(Custom_Object__c.sObjectType);
hasMyCustomPermission = cpr.hasPermission('My_Custom_Permission');

I believe the line in question (from the CustomPermissionsReader) where this error is happening is

List<CustomPermission> customPermissions = [select Id, DeveloperName from CustomPermission where NamespacePrefix = :namespacePrefix];

Answer 1

Per the CustomPermission object documentation's special access rules section, one of these 4 permissions is required after the Spring '20 release.

Special Access Rules

As of Spring '20 and later, only users who have one of these permissions can access this object:

• View Setup and Configuration
• Manage Session Permission Set Activations
• Manage Users
• Assign Permission Sets

Using the FeatureManagement.checkPermission(apiName) method should allow checking of permissions without granting elevated permissions to end users.