QuickBooks Connector
QuickBooks Connector
Breadcrumbs

Permission Errors

1.1 FLS / CRUD Errors in Logs

Symptom: Debug logs show System.NoAccessException or records fail to be read/written with no visible error in the UI.

Cause: CMQBConnectorUtility.enforceFLS is true for all standard licensed users. This means the running user must have field-level security (FLS) and object CRUD permissions on all QuickBooks package objects.

The enforceFLS flag is set to false only for user types listed in the GuestUsers setting (AutomatedProcess, CloudIntegrationUser, Guest by default).

Fix:

  1. Assign the CM Finance permission set to the user if not already assigned.

    • Go to Setup → Permission Sets → CM Finance → Manage Assignments.

  2. If the user is of type AutomatedProcess or CloudIntegrationUser (integration/automation users), ensure their user type is listed in the GuestUsers custom setting, which bypasses FLS enforcement.

  3. To check which user types bypass FLS: Setup → Custom Settings → Quickbooks Common Settings → GuestUsers (semicolon-separated list).

1.2 Permission Set Not Assigned After Install

Symptom: Admin users can see the QuickBooks app tabs but regular users cannot, or they see permission errors on the QuickBooks components.

Cause: The RestrictedUsersForPermissionSets setting in Quickbooks_Common_Settings__c lists user types that should never receive the permission set (e.g., AutomatedProcess;CloudIntegrationUser;Guest). If a user's type is on this list, they are excluded from permission set assignment by the setup flow.

Fix:

  1. Manually assign the CM Finance permission set to the user.

  2. If the user type is an integration user that should have access to the package objects but not the UI components, assign object-level access directly through a profile or separate permission set.

1.3 Guest / Site User Cannot Trigger Auth

Symptom: The QBAuthVFPage cannot write to Quickbooks_Credentials__c or fire the QB_Auth__e platform event when accessed by a Guest/Site user.

Cause: For Guest user contexts, enforceFLS = false (the GuestUsers setting includes Guest by default). However, Guest users on Salesforce Sites have very limited DML access by default.

Fix: This page is not designed to be accessed directly by Guest users. Ensure the VF page URL is only opened in a browser session authenticated as a licensed Salesforce user. The QBAuthVFPage should be opened from within the Salesforce application (opened in a new browser tab by the SF UI), not shared as a public URL.