How do I find out if a user has access to a visualforce page through apex?

Question

So I have a VF page that calls some other VF pages based on a button click. The button will reroute to a different VF page depending on a value within a dropdown.

Sometimes the logged in user will not have access to the VF page. I want to hide the dropdown item if they don't have access to it. I know you can do this with objects, via {!$ObjectType.objectname.accessible}, but can you do something similar with VF pages?

An alternative solution would be that the controller would throw an error message back to the page, but same issue applies - I still don't know how to get the accessibility of a VF page through apex.

Answer 1

Profile rights can be queried although the data model is bit complex. Actual user's permissions depend on his Profile and any Permission Sets that were assigned to him on top of the Profile.

Start by looking at the data model: http://www.salesforce.com/us/developer/docs/api/Content/sforce_api_erd_profile_permissions.htm

Your data is hidden in the SetupEntityAccess and that help page lists some useful examples. Especially the last one looks very promising:

SELECT Id, SetupEntityId, SetupEntityType
FROM SetupEntityAccess
WHERE ParentId
IN
   (SELECT PermissionSetId 
   FROM PermissionSetAssignment
   WHERE AssigneeId = '005D0000001QOzF')
AND (SetupEntityId = '02uD0000000GIiMIAW')

Substitute the hardcoded variables with

• UserInfo.getUserId()
• result of SELECT Id FROM ApexPage WHERE Name = 'Foobar' AND NamespacePrefix = null

Answer 2

I want to supplement eyescream's answer to avoid an additional SOQL-query, which returns Id of a page. So, the final block of SOQL-code may also look like this:

SetupEntityAccess[] accessSettings = [SELECT Id FROM SetupEntityAccess WHERE
    SetupEntityId IN (SELECT Id FROM ApexPage
        WHERE NamespacePrefix = :your_namespace AND Name = :your_page)
    AND
    ParentId IN (SELECT PermissionSetId FROM PermissionSetAssignment
        WHERE AssigneeId = :UserInfo.getUserId())
    LIMIT 1];

Description of system objects:

• SetupEntityAccess stores mappings between setup entities (like, ApexPage, ApexClass and etc.) and PermissionSets.
• PermissionSet object keeps not only real permission sets, but also permissions which come from profiles.
• PermissionSetAssignment stores mappings between a user and PermissionSet.

Description of the logic:

We need to select all SetupEntityAccess-mappings for the passed page, which also refer to assignments related with the user. These assignments may come from permission sets or from the user's profile.

Answer 3

You can definitely check from setup --> Page --> security from the UI. As far as checking with apex I was not able find any direct param that lets you know the accessibility, but I think this could work:

1) Create a custom setting that has the list of profile that have access to the page you are redirecting the user.

2) See if the user.ProfileId (or) query to find user profile name is one of the custom setting values and disable the button that redirects the user/ pop up a visualforce error message instead of redirecting them to the "Insufficient privileges" page.

This is managing a duplicate list of security to the page and every time a new profile is given access to the page you need to update the custom setting.