Repository: SFDO-Tooling/CumulusCI
Pull request #3623 (2023-07-17 12:17:44)

Querying PermissionSetGroups to get list of assigned permission sets


Patch:
diff --git a/cumulusci/core/config/oauth2_service_config.py b/cumulusci/core/config/oauth2_service_config.py
index 98646a8e5..774bd299d 100644
--- a/cumulusci/core/config/oauth2_service_config.py
+++ b/cumulusci/core/config/oauth2_service_config.py
@@ -8,8 +8,8 @@ class OAuth2ServiceConfig(ServiceConfig, ABC):
     """Base class for services that require an OAuth2 Client
     for establishing a connection."""
 
-    @abstractclassmethod
-    def connect(self) -> Dict:
+    @abstractclassmethod  # type: ignore
+    def connect(cls) -> Dict:  # type: ignore
         """This method is called when the service is first connected
         via `cci service connect`. This method should perform the necessary
         OAuth flow and return a dict of values that the service would like
diff --git a/cumulusci/tasks/preflight/permsets.py b/cumulusci/tasks/preflight/permsets.py
index bcf4f9140..c02ff93f9 100644
--- a/cumulusci/tasks/preflight/permsets.py
+++ b/cumulusci/tasks/preflight/permsets.py
@@ -3,10 +3,18 @@ from cumulusci.tasks.salesforce import BaseSalesforceApiTask
 
 class GetPermissionSetAssignments(BaseSalesforceApiTask):
     def _run_task(self):
-        query = f"SELECT PermissionSet.Name FROM PermissionSetAssignment WHERE AssigneeId = '{self.org_config.user_id}'"
-        self.return_values = [
-            result["PermissionSet"]["Name"]
-            for result in self.sf.query_all(query)["records"]
-        ]
-        permsets = "\n".join(self.return_values)
-        self.logger.info(f"Found permission sets assigned:\n{permsets}")
+        query = f"SELECT PermissionSet.Name,PermissionSetGroupId FROM PermissionSetAssignment WHERE AssigneeId = '{self.org_config.user_id}'"
+
+        self.permsets = []
+        for result in self.sf.query_all(query)["records"]:
+            if result["PermissionSet"]["Name"] not in self.permsets:
+                self.permsets.append(result["PermissionSet"]["Name"])
+
+            if result["PermissionSetGroupId"] is not None:
+                psg_query = f"SELECT PermissionSet.Name from PermissionSetGroupComponent where PermissionSetGroupId = '{result['PermissionSetGroupId']}'"
+                for psg_result in self.sf.query_all(psg_query)["records"]:
+                    if psg_result["PermissionSet"]["Name"] not in self.permsets:
+                        self.permsets.append(psg_result["PermissionSet"]["Name"])
+
+        permsets_str = "\n".join(self.permsets)
+        self.logger.info(f"Found permission sets assigned:\n{permsets_str}")


Test patch:
diff --git a/cumulusci/tasks/preflight/tests/test_permset_preflights.py b/cumulusci/tasks/preflight/tests/test_permset_preflights.py
index 17034db49..eded8f95f 100644
--- a/cumulusci/tasks/preflight/tests/test_permset_preflights.py
+++ b/cumulusci/tasks/preflight/tests/test_permset_preflights.py
@@ -8,30 +8,45 @@ class TestPermsetPreflights:
     def test_assigned_permset_preflight(self):
         task = create_task(GetPermissionSetAssignments, {})
         task._init_api = Mock()
-        task._init_api.return_value.query_all.return_value = {
-            "totalSize": 2,
-            "done": True,
-            "records": [
-                {
-                    "PermissionSet": {
-                        "Label": "Document Checklist",
-                        "Name": "DocumentChecklist",
+        task._init_api.return_value.query_all.side_effect = [
+            {
+                "totalSize": 2,
+                "done": True,
+                "records": [
+                    {
+                        "PermissionSet": {
+                            "Label": "Document Checklist",
+                            "Name": "DocumentChecklist",
+                        },
+                        "PermissionSetGroupId": None,
                     },
-                },
-                {
-                    "PermissionSet": {
-                        "Label": "Einstein Analytics Plus Admin",
-                        "Name": "EinsteinAnalyticsPlusAdmin",
+                    {
+                        "PermissionSet": {
+                            "Label": "Einstein Analytics Plus Admin",
+                            "Name": "EinsteinAnalyticsPlusAdmin",
+                        },
+                        "PermissionSetGroupId": "0PG000000000001",
                     },
-                },
-            ],
-        }
+                ],
+            },
+            {
+                "totalSize": 1,
+                "done": True,
+                "records": [
+                    {
+                        "PermissionSet": {
+                            "Label": "Customer Experience Analytics Admin",
+                            "Name": "CustomerExperienceAnalyticsAdmin",
+                        },
+                    },
+                ],
+            },
+        ]
         task()
 
-        task._init_api.return_value.query_all.assert_called_once_with(
-            "SELECT PermissionSet.Name FROM PermissionSetAssignment WHERE AssigneeId = 'USER_ID'"
-        )
-        assert task.return_values == [
+        task._init_api.return_value.query_all.assert_called()
+        assert task.permsets == [
             "DocumentChecklist",
             "EinsteinAnalyticsPlusAdmin",
+            "CustomerExperienceAnalyticsAdmin",
         ]