sf-plugin-permission-sets 0.0.0-dev.73 → 0.0.0-dev.74

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +22 -0
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -15,6 +15,7 @@ Stop clicking through Setup to grant access. Commit a YAML file, open a PR, let
15
15
 
16
16
  - [Why](#why)
17
17
  - [Install](#install)
18
+ - [Org permissions](#org-permissions)
18
19
  - [Quick start](#quick-start)
19
20
  - [Permission files](#permission-files)
20
21
  - [Organizing files](#organizing-files)
@@ -57,6 +58,25 @@ sf plugins install sf-plugin-permission-sets@x.y.z
57
58
 
58
59
  Requires Salesforce CLI (`sf`) and Node.js 22.13+.
59
60
 
61
+ ## Org permissions
62
+
63
+ What the user behind `--target-org` needs:
64
+
65
+ | Command | API Enabled | View Setup and Configuration | View Roles and Role Hierarchy | Assign Permission Sets |
66
+ | --- | :---: | :---: | :---: | :---: |
67
+ | `sf ps check` | - | - | - | - |
68
+ | `sf ps validate` | ✓ | ✓ | ✓ | - |
69
+ | `sf ps plan` | ✓ | ✓ | ✓ | - |
70
+ | `sf ps export` | ✓ | ✓ | ✓ | - |
71
+ | `sf ps apply` | ✓ | ✓ | ✓ | ✓ |
72
+
73
+ ✓ Required, - Not required.
74
+
75
+ Two permission sets, so a pull request job cannot change the org:
76
+
77
+ - [PS_Plugin_Read](setup/permissionsets/PS_Plugin_Read.permissionset-meta.xml): reads permission set assignments.
78
+ - [PS_Plugin_Write](setup/permissionsets/PS_Plugin_Write.permissionset-meta.xml): reads and modifies permission set assignments.
79
+
60
80
  ## Quick start
61
81
 
62
82
  ```bash
@@ -375,6 +395,8 @@ A requested `--user` that has no matching assignments (a typo, or a user who gen
375
395
 
376
396
  Three small workflows that build on each other: check pull requests with no org at all, validate the same files against the real org, then apply on merge.
377
397
 
398
+ Point the pull request workflows at a `PS_Plugin_Read` user and only the merge workflow at `PS_Plugin_Write` (see [Org permissions](#org-permissions)).
399
+
378
400
  **1. Check pull requests to main** (no org, no secrets):
379
401
 
380
402
  ```yaml
package/package.json CHANGED
@@ -126,5 +126,5 @@
126
126
  "exports": "./lib/index.js",
127
127
  "type": "module",
128
128
  "author": "Isaac Ferreira",
129
- "version": "0.0.0-dev.73"
129
+ "version": "0.0.0-dev.74"
130
130
  }