cumulusci-plus 5.0.0__py3-none-any.whl

cumulusci/tasks/salesforce/update_profile.py

@@ -0,0 +1,339 @@
+import os
+from collections import defaultdict
+
+from packaging import version
+
+from cumulusci.core.exceptions import CumulusCIException, TaskOptionsError
+from cumulusci.core.utils import process_bool_arg, process_list_arg
+from cumulusci.tasks.metadata_etl import (
+    MetadataOperation,
+    MetadataSingleEntityTransformTask,
+)
+from cumulusci.tasks.salesforce import BaseSalesforceApiTask
+from cumulusci.utils import CUMULUSCI_PATH
+from cumulusci.utils.xml import metadata_tree
+
+
+class ProfileGrantAllAccess(MetadataSingleEntityTransformTask, BaseSalesforceApiTask):
+    name = "ProfileGrantAllAccess"
+    entity = "Profile"
+
+    task_options = {
+        "package_xml": {
+            "description": "Override the default package.xml file for retrieving the Admin.profile and all objects and classes "
+            "that need to be included by providing a path to your custom package.xml"
+        },
+        "record_types": {
+            "description": "A list of dictionaries containing the required key `record_type` with a value specifying "
+            "the record type in format <object>.<developer_name>.  Record type names can use the token strings {managed} "
+            "and {namespaced_org} for namespace prefix injection as needed.  By default, all listed record types will be set "
+            "to visible and not default.  Use the additional keys `visible`, `default`, and `person_account_default` set to "
+            "true/false to override.  "
+            "Page Layout Support: If you are using the Page Layouts feature, you can specify the `page_layout` key with the "
+            "layout name to use for the record type.  If not specified, the default page layout will be used.  "
+            "NOTE: Setting record_types is only supported in cumulusci.yml, command line override is not supported."
+        },
+        "managed": {
+            "description": "If True, uses the namespace prefix where appropriate.  Use if running against an org with the managed package "
+            "installed.  Defaults to False"
+        },
+        "namespaced_org": {
+            "description": "If True, attempts to prefix all unmanaged metadata references with the namespace prefix for deployment to the "
+            "packaging org or a namespaced scratch org.  Defaults to False"
+        },
+        "namespace_inject": {
+            "description": "If set, the namespace tokens in files and filenames are replaced with the namespace's prefix. "
+            "Defaults to project__package__namespace"
+        },
+        "profile_name": {
+            "description": "Name of the Profile to target for updates (deprecated; use api_names to target multiple profiles).",
+            "default": "Admin",
+        },
+        "include_packaged_objects": {
+            "description": "Automatically include objects from all installed managed packages. "
+            "Defaults to True in projects that require CumulusCI 3.9.0 and greater that don't use a custom package.xml, otherwise False."
+        },
+        "api_names": {"description": "List of API names of Profiles to affect"},
+    }
+
+    def _init_options(self, kwargs):
+        super(ProfileGrantAllAccess, self)._init_options(kwargs)
+
+        self.options["namespace_inject"] = self.options.get(
+            "namespace_inject", self.project_config.project__package__namespace
+        )
+
+        # We enable new functionality to extend the package.xml to packaged objects
+        # by default only if we meet specific requirements: the project has to require
+        # CumulusCI >= 3.9.0 (i.e., creation date or opt-in after release), and it must
+        # not be using a custom `package.xml`
+        min_cci_version = self.project_config.minimum_cumulusci_version
+        if min_cci_version and "package_xml" not in self.options:
+            parsed_version = version.parse(min_cci_version)
+            default_packages_arg = parsed_version >= version.parse("3.9.0")
+        else:
+            default_packages_arg = False
+
+        self.options["include_packaged_objects"] = process_bool_arg(
+            self.options.get("include_packaged_objects", default_packages_arg)
+        )
+
+        # Build the api_names list, taking into account legacy behavior.
+        # If we're using a custom package.xml, we will union the api_names list with
+        # any Profiles specified there.
+        self.api_names = set(process_list_arg(self.options.get("api_names") or []))
+        if "profile_name" in self.options:
+            self.api_names.add(self.options["profile_name"])
+        if not self.api_names and "package_xml" not in self.options:
+            self.api_names.add(
+                "Admin"
+            )  # Don't add a default if using custom package.xml
+
+        if "package_xml" in self.options:
+            self.package_xml_path = self.options["package_xml"]
+        else:
+            self.package_xml_path = os.path.join(
+                CUMULUSCI_PATH, "cumulusci", "files", "admin_profile.xml"
+            )
+
+        if self.org_config is not None:
+            # Set up namespace prefix strings.
+            # We can only do this if we actually have an org_config;
+            # i.e. not while freezing steps for metadeploy
+            namespace = self.options["namespace_inject"]
+            namespace_prefix = f"{namespace}__" if namespace else ""
+            self.namespace_prefixes = {
+                "managed": namespace_prefix if self.options["managed"] else "",
+                "namespaced_org": namespace_prefix
+                if self.options["namespaced_org"]
+                else "",
+            }
+            self.api_names = {self._inject_namespace(x) for x in self.api_names}
+
+    def freeze(self, step):
+        # Preserve behavior from when we subclassed Deploy.
+
+        steps = super().freeze(step)
+        for step in steps:
+            if step["kind"] == "other":
+                step["kind"] = "metadata"
+        return steps
+
+    def _generate_package_xml(self, operation):
+        if operation is MetadataOperation.RETRIEVE:
+            with open(self.package_xml_path, "r", encoding="utf-8") as f:
+                package_xml_content = f.read()
+
+            package_xml_content = package_xml_content.format(**self.namespace_prefixes)
+
+            # We need to rewrite the package.xml for one or two reasons.
+            # Either we are using packaged-object expansion, or we're using
+            # a package.xml and need to substitute in profile API names.
+
+            # Convert to bytes because stored `package.xml`s typically have an encoding declaration,
+            # which `fromstring()` doesn't like.
+            package_xml = metadata_tree.fromstring(package_xml_content.encode("utf-8"))
+
+            if self.options["include_packaged_objects"]:
+                self._expand_package_xml(package_xml)
+
+            self._expand_profile_members(package_xml)
+
+            package_xml_content = package_xml.tostring(xml_declaration=True)
+
+            return package_xml_content
+        else:
+            return super()._generate_package_xml(operation)
+
+    def _expand_profile_members(self, package_xml):
+        profile_names = package_xml.find("types", name="Profile")
+        if not profile_names:
+            profile_names = package_xml.append("types")
+            profile_names.append("name", "Profile")
+
+        listed_api_names = {p.text for p in profile_names.findall("members")}
+
+        for profile in self.api_names:
+            if profile not in listed_api_names:
+                profile_names.append("members", text=profile)
+
+        self.api_names.update(listed_api_names)
+
+    def _expand_package_xml(self, package_xml):
+        # Query the target org for all namespaced objects
+        # Add these entities to the package.xml
+
+        results = self.tooling.query_all(
+            "SELECT DeveloperName, NamespacePrefix FROM CustomObject WHERE ManageableState != 'unmanaged'"
+        )
+
+        custom_objects = package_xml.find("types", name="CustomObject")
+        if not custom_objects:
+            raise CumulusCIException(
+                "Unable to add packaged objects to package.xml because it does not contain a <types> tag of type CustomObject."
+            )
+
+        for record in results.get("records", []):
+            custom_objects.append(
+                "members",
+                text=f"{record['NamespacePrefix']}__{record['DeveloperName']}__c",
+            )
+
+        self._expand_package_xml_objects(package_xml)
+
+    def _expand_package_xml_objects(self, package_xml):
+        # Check for any record types specified in the options, but missing from the package.xml
+        # Add these entities to the package.xml
+
+        custom_objects = package_xml.find("types", name="CustomObject")
+
+        # Append custom objects if record types are present but missing from package.xml
+        record_types = self.options.get("record_types") or []
+        rt_objects = {rt["record_type"].split(".")[0] for rt in record_types}
+        listed_custom_objects = {c.text for c in custom_objects.findall("members")}
+
+        for rt in rt_objects:
+            if rt not in listed_custom_objects:
+                self.logger.info('Adding "{}" to package.xml'.format(rt))
+                custom_objects.append(
+                    "members",
+                    text=rt,
+                )
+
+    def _transform_entity(self, tree, api_name):
+        # Custom applications
+        self._set_elements_visible(tree, "applicationVisibilities", "visible")
+        # Apex classes
+        self._set_elements_visible(tree, "classAccesses", "enabled")
+        # Fields
+        self._set_elements_visible(tree, "fieldPermissions", "editable")
+        self._set_elements_visible(tree, "fieldPermissions", "readable")
+        # Visualforce pages
+        self._set_elements_visible(tree, "pageAccesses", "enabled")
+        # Custom tabs
+        self._set_elements_visible(
+            tree,
+            "tabVisibilities",
+            "visibility",
+            false_value="Hidden",
+            true_value="DefaultOn",
+        )
+        # Record Types
+        self._set_record_types(tree, api_name)
+
+        return tree
+
+    def _set_elements_visible(
+        self, tree, outer_tag, inner_tag, false_value="false", true_value="true"
+    ):
+        for elem in tree.findall(outer_tag, **{inner_tag: false_value}):
+            elem.find(inner_tag).text = true_value
+
+    def _strip_namespace_from_record_type(self, record_type):
+        """Strip namespace prefix from record type string.
+        
+        Converts 'namespace__Object__c.namespace__RecordType' to 'Object__c.RecordType'
+        """
+        if not self.options.get("namespace_inject"):
+            return record_type
+            
+        namespace = self.options["namespace_inject"]
+        namespace_prefix = f"{namespace}__"
+        
+        # Split on the dot to handle object and record type separately
+        parts = record_type.split(".", 1)
+        if len(parts) != 2:
+            return record_type
+            
+        object_name, record_type_name = parts
+        
+        # Strip namespace prefix from both object and record type if present
+        if object_name.startswith(namespace_prefix):
+            object_name = object_name[len(namespace_prefix):]
+        if record_type_name.startswith(namespace_prefix):
+            record_type_name = record_type_name[len(namespace_prefix):]
+            
+        return f"{object_name}.{record_type_name}"
+
+    def _set_record_types(self, tree, api_name):
+        # Do namespace injection
+        record_types = self.options.get("record_types") or []
+        for rt in record_types:
+            rt["record_type"] = rt["record_type"].format(**self.namespace_prefixes)
+
+        # If defaults are specified, clear any pre-existing defaults
+        # that apply to the same object
+        defaults = {
+            "default": "default",
+            "person_account_default": "personAccountDefault",
+        }
+        objects_with_defaults = defaultdict(set)
+
+        for option, default_element in defaults.items():
+            for rt in record_types:
+                if option in rt:
+                    objects_with_defaults[option].add(rt["record_type"].split(".")[0])
+
+            for elem in tree.findall("recordTypeVisibilities"):
+                if (
+                    elem.find(default_element)
+                    and elem.recordType.text.split(".")[0]
+                    in objects_with_defaults[option]
+                ):
+                    elem.find(default_element).text = "false"
+
+        # Set recordTypeVisibilities
+        for rt in record_types:
+            # Look for the recordTypeVisibilities element
+            # First try with the original record type
+            elem = tree.find("recordTypeVisibilities", recordType=rt["record_type"])
+            
+            # If not found and we're in a namespaced org, try with namespace stripped 
+            # (since Salesforce may return without namespace in namespaced orgs)
+            if elem is None and self.options.get("namespaced_org"):
+                record_type_without_namespace = self._strip_namespace_from_record_type(rt["record_type"])
+                elem = tree.find("recordTypeVisibilities", recordType=record_type_without_namespace)
+                
+                if elem is None:
+                    raise TaskOptionsError(
+                        f"Record Type {rt['record_type']} (or {record_type_without_namespace}) not found in retrieved {api_name}.profile"
+                    )
+            elif elem is None:
+                raise TaskOptionsError(
+                    f"Record Type {rt['record_type']} not found in retrieved {api_name}.profile"
+                )
+
+            # Set visible
+            elem.visible.text = str(rt.get("visible", "true")).lower()
+
+            # Set default
+            elem.default.text = str(rt.get("default", "false")).lower()
+
+            # Set person account default if element exists
+            pa_default = elem.find("personAccountDefault")
+            if pa_default is not None:
+                pa_default.text = str(rt.get("person_account_default", "false")).lower()
+
+        # Set page layout defaults for record types
+        for rt in record_types:
+            # We need it to look like this:
+            # <layoutAssignments>
+            #   <layout>{page_layout}</layout>
+            #   <recordType>{record_type}</recordType>
+            # </layoutAssignments>
+            layout_option = rt.get("page_layout", None)
+            if layout_option:
+                # Look for page layout definitions in the record type
+                found_layout = False
+                for elem in tree.findall("layoutAssignments"):
+                    if elem.find("recordType").text == rt["record_type"]:
+                        elem.layout.text = layout_option
+                        found_layout = True
+
+                if not found_layout:
+                    assignment = tree.append(tag="layoutAssignments")
+                    assignment.append(tag="recordType", text=rt["record_type"])
+                    assignment.append(tag="layout", text=layout_option)
+
+
+UpdateAdminProfile = UpdateProfile = ProfileGrantAllAccess

cumulusci/tasks/salesforce/users/permsets.py

@@ -0,0 +1,227 @@
+import json
+
+from cumulusci.cli.ui import CliTable
+from cumulusci.core.exceptions import CumulusCIException
+from cumulusci.core.utils import process_list_arg
+from cumulusci.tasks.salesforce import BaseSalesforceApiTask
+
+
+class AssignPermissionSets(BaseSalesforceApiTask):
+    task_docs = """
+Assigns Permission Sets whose Names are in ``api_names`` to either the default org user or the user whose Alias is ``user_alias``. This task skips assigning Permission Sets that are already assigned.
+    """
+
+    task_options = {
+        "api_names": {
+            "description": "API Names of desired Permission Sets, separated by commas.",
+            "required": True,
+        },
+        "user_alias": {
+            "description": "Target user aliases, separated by commas. Defaults to the current running user."
+        },
+    }
+
+    permission_name = "PermissionSet"
+    permission_name_field = "Name"
+    permission_label = "Permission Set"
+    assignment_name = "PermissionSetAssignment"
+    assignment_lookup = "PermissionSetId"
+    assignment_child_relationship = "PermissionSetAssignments"
+
+    def _init_options(self, kwargs):
+        super()._init_options(kwargs)
+
+        self.options["api_names"] = process_list_arg(self.options["api_names"])
+        self.options["user_alias"] = process_list_arg(
+            self.options.get("user_alias") or []
+        )
+
+    def _run_task(self):
+        users = self._query_existing_assignments()
+        users_assigned_perms = {
+            user["Id"]: self._get_assigned_perms(user) for user in users
+        }
+        perms_by_id = self._get_perm_ids()
+
+        records_to_insert = []
+        for user_id, assigned_perms in users_assigned_perms.items():
+            records_to_insert.extend(
+                self._get_assignments(user_id, assigned_perms, perms_by_id)
+            )
+
+        self._insert_assignments(records_to_insert)
+
+    def _query_existing_assignments(self):
+        if not self.options["user_alias"]:
+            query = (
+                f"SELECT Id,(SELECT {self.assignment_lookup} FROM {self.assignment_child_relationship}) "
+                "FROM User "
+                f"WHERE Username = '{self.org_config.username}'"
+            )
+        else:
+            aliases = "','".join(self.options["user_alias"])
+            query = (
+                f"SELECT Id,(SELECT {self.assignment_lookup} FROM {self.assignment_child_relationship}) "
+                "FROM User "
+                f"""WHERE Alias IN ('{aliases}')"""
+            )
+
+        result = self.sf.query(query)
+        if result["totalSize"] == 0:
+            raise CumulusCIException(
+                "No Users were found matching the specified aliases."
+            )
+        return result["records"]
+
+    def _get_assigned_perms(self, user):
+        assigned_perms = {}
+        # PermissionSetLicenseAssignments actually returns None if there are no assignments instead of an empty list of records.  Wow.
+        if user[self.assignment_child_relationship]:
+            assigned_perms = {
+                r[self.assignment_lookup]
+                for r in user[self.assignment_child_relationship]["records"]
+            }
+        return assigned_perms
+
+    def _get_perm_ids(self):
+        api_names = "', '".join(self.options["api_names"])
+        perms = self.sf.query(
+            f"SELECT Id,{self.permission_name_field} FROM {self.permission_name} WHERE {self.permission_name_field} IN ('{api_names}')"
+        )
+        perms_by_ids = {
+            p["Id"]: p[self.permission_name_field] for p in perms["records"]
+        }
+
+        missing_perms = [
+            api_name
+            for api_name in self.options["api_names"]
+            if api_name not in perms_by_ids.values()
+        ]
+        if missing_perms:
+            raise CumulusCIException(
+                f"The following {self.permission_label}s were not found: {', '.join(missing_perms)}."
+            )
+        return perms_by_ids
+
+    def _get_assignments(self, user_id, assigned_perms, perms_by_id):
+        assignments = []
+        for perm, perm_name in perms_by_id.items():
+            if perm not in assigned_perms:
+                self.logger.info(
+                    f'Assigning {self.permission_label} "{perm_name}" to {user_id}.'
+                )
+                assignment = {
+                    "attributes": {"type": self.assignment_name},
+                    "AssigneeId": user_id,
+                    self.assignment_lookup: perm,
+                }
+                assignments.append(assignment)
+            else:
+                self.logger.warning(
+                    f'{self.permission_label} "{perm_name}" is already assigned to {user_id}.'
+                )
+        return assignments
+
+    def _insert_assignments(self, records_to_insert):
+        result_list = []
+        for i in range(0, len(records_to_insert), 200):
+            request_body = json.dumps(
+                {"allOrNone": False, "records": records_to_insert[i : i + 200]}
+            )
+            result = self.sf.restful(
+                "composite/sobjects", method="POST", data=request_body
+            )
+            result_list.extend(result)
+        self._process_composite_results(result_list)
+
+    def _process_composite_results(self, api_results):
+        results_table_data = [["Success", "ID", "Message"]]
+        for result in api_results:
+            result_row = [result["success"], result.get("id", "-")]
+            if not result["success"] and result["errors"]:
+                result_row.append(result["errors"][0]["message"])
+            else:
+                result_row.append("-")
+            results_table_data.append(result_row)
+
+        table = CliTable(
+            results_table_data,
+            title="Results",
+        )
+        table.echo()
+
+        if not all([result["success"] for result in api_results]):
+            raise CumulusCIException(
+                f"Not all {self.assignment_child_relationship} were saved."
+            )
+
+
+class AssignPermissionSetLicenses(AssignPermissionSets):
+    task_docs = """
+Assigns Permission Set Licenses whose Developer Names or PermissionSetLicenseKey are in ``api_names`` to either the default org user or the user whose Alias is ``user_alias``. This task skips assigning Permission Set Licenses that are already assigned.
+
+Permission Set Licenses are usually associated with a Permission Set, and assigning the Permission Set usually assigns the associated Permission Set License automatically.  However, in non-namespaced developer scratch orgs, assigning the associated Permission Set may not automatically assign the Permission Set License, and this task will ensure the Permission Set Licenses are assigned.
+    """
+
+    task_options = {
+        "api_names": {
+            "description": "API Developer Names of desired Permission Set Licenses, separated by commas.",
+            "required": True,
+        },
+        "user_alias": {
+            "description": "Alias of target user (if not the current running user, the default)."
+        },
+    }
+
+    permission_name = "PermissionSetLicense"
+    permission_name_field = ["DeveloperName", "PermissionSetLicenseKey"]
+    permission_label = "Permission Set License"
+    assignment_name = "PermissionSetLicenseAssign"
+    assignment_lookup = "PermissionSetLicenseId"
+    assignment_child_relationship = "PermissionSetLicenseAssignments"
+
+    def _get_perm_ids(self):
+        perms_by_ids = {}
+        api_names = "', '".join(self.options["api_names"])
+        perms = self.sf.query(
+            f"SELECT Id,{self.permission_name_field[0]},{self.permission_name_field[1]} FROM {self.permission_name} WHERE {self.permission_name_field[0]} IN ('{api_names}') OR {self.permission_name_field[1]} IN ('{api_names}')"
+        )
+        for p in perms["records"]:
+            if p[self.permission_name_field[0]] in self.options["api_names"]:
+                perms_by_ids[p["Id"]] = p[self.permission_name_field[0]]
+            else:
+                perms_by_ids[p["Id"]] = p[self.permission_name_field[1]]
+
+        missing_perms = [
+            api_name
+            for api_name in self.options["api_names"]
+            if api_name not in perms_by_ids.values()
+        ]
+        if missing_perms:
+            raise CumulusCIException(
+                f"The following {self.permission_label}s were not found: {', '.join(missing_perms)}."
+            )
+        return perms_by_ids
+
+
+class AssignPermissionSetGroups(AssignPermissionSets):
+    task_docs = """
+Assigns Permission Set Groups whose Developer Names are in ``api_names`` to either the default org user or the user whose Alias is ``user_alias``. This task skips assigning Permission Set Groups that are already assigned.
+    """
+
+    task_options = {
+        "api_names": {
+            "description": "API Developer Names of desired Permission Set Groups, separated by commas.",
+            "required": True,
+        },
+        "user_alias": {
+            "description": "Alias of target user (if not the current running user, the default)."
+        },
+    }
+
+    permission_name = "PermissionSetGroup"
+    permission_name_field = "DeveloperName"
+    permission_label = "Permission Set Group"
+    assignment_name = "PermissionSetAssignment"
+    assignment_lookup = "PermissionSetGroupId"
+    assignment_child_relationship = "PermissionSetAssignments"