0

My 2GP includes a handful of custom fields on the Opportunity object. Users (who already have access to Opportunity) need to be able to see them but we don't care whether they modify them because our Lightning components will overwrite anything they try to enter directly into those fields.

Today, we have the fields listed explicitly in the Permission Set in the 2GP.

As these are fields on a standard object that the users should already have access to, do we really need to explicitly grant the field permissions in our Permission Set?

If the custom fields were not in a managed package, I know I wouldn't need to add them to a permission set. Just wondering if there's something special about namespaced custom fields in a managed package.

1
  • Just having read/write access to an object doesn't grant any access to the fields; these must always be granted as well. Having your perm set seems reasonable to me.
    – Phil W
    Feb 10, 2023 at 18:29

1 Answer 1

2

If you do not grant access to those fields explicitly via a Permission Set, you'll have to have your Apex code ignore FLS on those fields. That means you'll have to explain, in your Security Review, why you are not enforcing FLS as is normally required.

While that may work, since these are intended to be calculated fields, your path is probably smoother if you follow the expected platform idiom and explicitly permission these fields, enforcing that permissioning in your Apex code.

1
  • OK - we have not yet gone through security review. This is a good heads-up for us. Thank you. Feb 10, 2023 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .