I am working on a managed package which will be licensed per user.
The package will include two features:
Feature A: Global Apex Class that publishes platform events (also packaged). Trigger on this platform event will do some stuff: insert custom object (also from the package), some HTTP requests and more.
This feature should be accessible by ALL users, even unlicensed.
Also the subscriber org should be able to add another trigger on that platform event, also accessible by all users.
Feature B: Lightning App (LWC) to query and display the records, configuration etc.
Accessible by licensed users only.
My concerns are gerading the feature A.
I found that the global apex class should be accessible even for the unlicensed users, but will be the publishing of events successful or will it fail because the unlicensed user can't publish a packaged event? Even if this will be successful, will the DML on custom object be successful? And the callout?
So simply my question is: can the unlicensed user via global method publish packaged events and perform insert on the packaged custom object?
If not, is there any workaround for me (as developer of the managed package) to allow this? Does 'without sharing' play any role in this?
Is it possible to assign packaged permission set with object permissions to an unlicensed user?
Is there any way how to test the app as unlicensed/licensed user before publishing the app to AppExchange?
will there be any problems with the security review as I want to allow insert on the custom object by all users, i.e. without enforcing FLS?