Update field permission in permission set via Apex

Question

I am trying to expose a REST API so the field permission of permission set(s) can be updated. I am trying to use MetadataService as below:

@RestResource(urlMapping='/updateFieldPermission')
global class UtilitiesAPI {
    @HttpPost   
    global static String updateFieldPermission(List<FieldPermisionPutRequestWrapper> fieldPermisionPutRequestWrapperList){
        try{
            System.debug('Started updateFieldPermission');
            
            MetadataService.MetadataPort service = new MetadataService.MetadataPort();
            Map<String, FieldAccess> objectFieldToFieldAccessMap = new Map<String, FieldAccess>();
            service.SessionHeader = new MetadataService.SessionHeader_element();
            service.SessionHeader.sessionId = UserInfo.getSessionId();
            
            return null;
        }
        catch(Exception exceptionObject){
            System.debug('Exception occurred. Error message=' + exceptionObject.getMessage());
            System.debug('Stack trace=' + exceptionObject.getStackTraceString());
            return null;
        }
    }
}

But getting error like this:

16:23:51.781 Starting SFDX: Deploy Source to Org

=== Deploy Errors
PROJECT PATH                                     ERRORS                                                     
───────────────────────────────────────────────  ───────────────────────────────────────────────────────────
force-app\main\default\classes\UtilitiesAPI.cls  Invalid type: MetadataService.MetadataPort (7:13)          
force-app\main\default\classes\UtilitiesAPI.cls  Invalid type: MetadataService.SessionHeader_element (9:37)
force-app\main\default\classes\UtilitiesAPI.cls  Variable does not exist: service.SessionHeader (10:13)     
force-app\main\default\classes\UtilitiesAPI.cls  Variable does not exist: service (9:13)                   

16:23:54.589 ended SFDX: Deploy Source to Org

Can someone please help me know what I am missing here or should try other approach?

Answer 1

I have two ways to resolve your problem -

1. Via Metadata Api using the library from FinancialForce, your errors are showing that you haven't imported the library. you can get it at - https://github.com/financialforcedev/apex-mdapi/tree/master/apex-mdapi/src/classes

All you need to do is copy the MetadataService class and save it into your org.

once done add the below method to your UtilitiesAPI class-

    public static MetadataService.MetadataPort createService()
        { 
            MetadataService.MetadataPort service = new MetadataService.MetadataPort();
            service.SessionHeader = new MetadataService.SessionHeader_element();
            service.SessionHeader.sessionId = UserInfo.getSessionId();
            return service;     
        }

Now, your errors will be resolved.

Get the profile and update custom permission -

 

       MetadataService.MetadataPort service = createService(); 
        MetadataService.Metadata[] records = readResult.getRecords();
        MetadataService.Profile prfile =  new MetadataService.Profile();
        prfile.fullName = 'profile name';
        prfile.custom = false;
       MetadataService.ProfileFieldLevelSecurity fieldSec = new MetadataService.ProfileFieldLevelSecurity();
            fieldSec.field='Account.Phone';
            fieldSec.editable=false;
            prfile.fieldPermissions  = new MetadataService.ProfileFieldLevelSecurity[] {fieldSec} ;
                List<MetadataService.SaveResult> results =
                service.updateMetadata(
                    new MetadataService.Metadata[] { prfile });
            handleSaveResults(results[0]);
    
    public static void handleSaveResults(MetadataService.SaveResult saveResult)
        {
            // Nothing to see?
            if(saveResult==null || saveResult.success)
                return;
            // Construct error message and throw an exception
            if(saveResult.errors!=null)
            {
                List<String> messages = new List<String>();
                messages.add(
                    (saveResult.errors.size()==1 ? 'Error ' : 'Errors ') +
                    'occured processing component ' + saveResult.fullName + '.');
                for(MetadataService.Error error : saveResult.errors)
                    messages.add(
                        error.message + ' (' + error.statusCode + ').' +
                        ( error.fields!=null && error.fields.size()>0 ?
                         ' Fields ' + String.join(error.fields, ',') + '.' : '' ) );
                if(messages.size()>0)
                    System.debug(' message '+messages);
            }
            if(!saveResult.success)
                System.debug(' failure ');
        }

2. Via FieldPermission - I can't say this will be a perfect solution but it'll allow you to add and update the permission -

Add Permission -

FieldPermissions fp= new FieldPermissions();
fp.Field='Account.Phone';//the name of new field
fp.ParentId='0PS5g000009W5BH';// id of permission set 
fp.PermissionsEdit=true;//
fp.PermissionsRead=true;
fp.SobjectType='Account';
Insert fp; 

Update Permission -

FieldPermissions fps = [SELECT SobjectType, Field, PermissionsRead, Parent.Name FROM FieldPermissions WHERE SobjectType='Account' AND Field='Account.Phone' AND ParentId='0PS5g000009W5BH' LIMIT 1];
fps.PermissionsEdit = false;
update fps;

To grant a user access to a field, associate a FieldPermissions record with a PermissionSet that’s assigned to a user. FieldPermissions records are only supported in PermissionSet, not in Profile.