CumulusCI
CumulusCI copied to clipboard
Add transform to remove invalid references from profiles
Implemented Functionality to clean profiles and permission sets of invalid references.
Issues (corner cases that are not supported currently)
- Since we are using the approach of parsing the xml files in the source zip and retrieving all entities using package.xml, we are unable to retrieve: i. Couple of sObjects (some of which are not supported, and Document which is a metadata of it's own but comes under ObjectPermissions) ii. Couple of tabs (These tabs are permissioned in the profile but are not present in the TabDefinition table or the tabs page in setup of the org. Most likely these are linked tabs as part of applications or other metadata types) iii. Couple of fields (which are permissioned in the org but are missing in the sObject itself)
- For User Permissions: i. Some UserPermissions are dependent on other UserPermissions. Say permission A depends on B (both A and B are present in the target org). There is no current check to see if B is present when A is present in the profile or permissionset file. Without B, deployment fails when you try to deploy A.
We have created a WI to resolve these issues: W-14363935
Most of the corner cases resolved. There is still an issue with some of the UserPermissions not being retrieved (in certain API versions). This is because in core, these UserPermissions either have a maxApiVersion defined (and our api version is more than that) or has apiAccess=IsSfdcInternal making it unexposed to public API.
The problem occurs because the SOAP call to retrieve the profile/permissionset gives all the UserPermissions regardless of which API Version is mentioned. However when we make a rest/tooling API call to retrieve these UserPermissions, only the ones present in that particular API version are retrieved.
@davidmreed kindly review the PR