Assigning Permission Sets

Nebula Logger includes 4 permission sets - these are intended to cover the most common scenarios of granting users partial or full access to the logging system & its related objects.

LoggerLogCreator Permission Set

This permission set provides explicit access to Nebula Logger's top-level Apex classes & metadata that are used to generate logging data through Apex, Lightning Components, Flow, and Process Builder, including:

• The Logger Apex class, used when logging in Apex
• The @InvocableMethod classes FlowCollectionLogEntry, FlowLogEntry, and FlowRecordLogEntry, used when logging in Flow
• The @AuraEnabled class ComponentLogger, used when logging in lightning web components (LWCs) and Aura components

In most cases, this permission set is not needed. Nebula Logger is designed to run in system mode to ensure that logging occurs regardless of the current user's permissions. However, in some situations, the Salesforce platform requires that this permission set be used for logging to work (or some other permission set/profile that grants explicit access). This includes:

• Experience Cloud (Community Cloud): Salesforce requires Experience Cloud users to have explicit access to Apex classes, including guest users/profiles:
  • In the Manage Users and Data Access docs page "Best Practices and Considerations When Configuring the Guest User Profile", it says "add guest user profile access to any @AuraEnabled Apex class used by an Experience Cloud site.
  • In the LWC developers docs page "Secure Apex Classes", it says "an authenticated or guest user can access an @AuraEnabled Apex method only when the user’s profile or an assigned permission set allows access to the Apex class."
  • In the Aura developers docs page "Granting User Access for Apex Classes", it also says "an authenticated or guest user can access an @AuraEnabled Apex method only when the user's profile or an assigned permission set allows access to the Apex class."
• Platform Releases & Changes: Salesforce has previously required explicit Apex class access for internal user (non-Experience Cloud users). At the moment (2024-07), those changes have been reverted by Salesforce (see below), but just in case similar changes are ever re-introduced to the platform, the LoggerLogCreator permission set can be assigned to grant the appropriate access.
  • Require User Access to Apex Classes Invoked by Flow (Release Update, Retired) - at one point, this release update required users to have explicit access to any invocable Apex class used by Flow
  • Disable Rules for Enforcing Explicit Access to Apex Classes (Release Update) - this release update was made to effectively rollback the previous release update

LoggerEndUser Permission Set

This permission provides limited access to Nebula Logger's data, including:

• The same permissions as LoggerLogCreator
• Read-only access (but not view-all access) to any logging records that have been shared with the user
  • By default, users with this permission set would only see their own records + any records that have been manually shared with them
  • Some fields within Nebula Logger's custom objects have intentionally been excluded from this permission set
• This does not provide access to Nebula Logger's console app, but does include access to the custom objects' tabs

LoggerLogViewer Permission Set

This permission set provides read-only access to Nebula Logger's data & custom features, including:

• View-all access (read-only) to all objects, fields, and records within Nebula Logger's data model.
• Read-only access to several custom tabs included within Nebula Logger's console app, which each display a custom LWC
• This does not provide explicit access to generate logging data. But since Nebula Logger runs in system mode, in most cases, users with this permission set can still generate logging data.

LoggerAdmin Permission Set

This permission set provides full control of Nebula Logger's data & custom features, including:

• The same permissions as LoggerLogCreator
• The same view-all permissions as LoggerLogViewer
• Modify-all access to all objects, fields, and records within Nebula Logger's data model
• Edit access to several custom tabs included within Nebula Logger's console app, which each display a custom LWC