Our managed package has some custom permissions that help provide an elevated set of capabilities to some users.
We have recently run into an issue with some people seeing this error message:
"Read" permission to object "CustomPermission" is not allowed for the current user.
I assume that they figured out a way to have a user profile with limited enough rights that it can't read CustomPermissions.
I was able to find
ManageCustomPermissions, but I don't want to grant that kind of permission to a normal user.
I tried to see if
ReadCustomPermissions was a thing, but when I tried to deploy it, I got the following message back from Salesforce:
Error deploy/profiles/<managed package name> Standard User.profile <Managed package name> Standard User Unknown user permission: ReadCustomPermissions
Does anyone know what the permission is to explicitly allow those users the ability to read the customPermissions?
Update, talking about something I tried shortly after posting this questino:
I found this documentation page https://help.salesforce.com/articleView?id=custom_perms_detail.htm&type=5 that refers to the "View Setup and Configuration" permission. Maybe that is it?
I tried to update the permission set that our standard user is using with the following, based on the documentation I found earlier, but when I sent a beta release of the managed package to the team having the issue, there was no change to the errors they were getting, so that wasn't it.
(snippet from <package name>_User.permissionset-meta.xml) <userPermissions> <enabled>true</enabled> <name>ViewRoles</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ViewSetup</name> </userPermissions>
Update, explaining how we are getting our custom permissions, as requested by comments:
As mentioned in my comment, we are using a class called "CustomPermissionsReader" to read the custom permissions, which can be found here: https://gist.github.com/afawcett/bc482bfdc840d5ac2858
This is how we are using it:
CustomPermissionsReader cpr = new CustomPermissionsReader(Custom_Object__c.sObjectType); hasMyCustomPermission = cpr.hasPermission('My_Custom_Permission');
I believe the line in question (from the CustomPermissionsReader) where this error is happening is
List<CustomPermission> customPermissions = [select Id, DeveloperName from CustomPermission where NamespacePrefix = :namespacePrefix];