service-omni-supervisor-permset-assign

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

service-omni-supervisor-permset-assign

Assign the Salesforce-shipped standard

ContactCenterSupervisor

PermissionSet to existing supervisor users via

PermissionSetAssignment

. The classic Omni-Channel Supervisor UI (Command Center) requires supervisors to hold contact-center supervisor permissions before

service-omni-supervisor-config-deploy

can bind them. The skill uses detect-before-POST idempotency and treats

DUPLICATE_VALUE

as an already-satisfied assignment.

Licensing. The supervisor system permissions (

IsContactCenterSupervisor

OmniSupervisorManageQueue

ViewOmnichnlAnlytDshbrd

) are gated by a permission-set license. The standard

ContactCenterSupervisor

set carries its own license linkage and assigns cleanly on a Service-Cloud-enabled org, so it is the default and supported path — a hand-rolled custom set that re-declares these permissions fails with

FIELD_INTEGRITY_EXCEPTION

. If a specific user's license lacks the underlying entitlement, the assignment surfaces that same exception so the operator can move the user to a profile/license that carries it.

That custom-permission-set warning does not mean assigning the existing Salesforce-shipped

ContactCenterSupervisor

set removes access or rewrites the set. This skill only creates a missing

PermissionSetAssignment

; it never creates, edits, or replaces the permission set itself.

通过

PermissionSetAssignment

将Salesforce自带的标准

ContactCenterSupervisor

PermissionSet分配给现有主管用户。经典的Omni-Channel主管UI（指挥中心）要求主管拥有联络中心主管权限，之后

service-omni-supervisor-config-deploy

才能绑定他们。本技能采用“先检测后POST”的幂等性机制，并将

DUPLICATE_VALUE

视为已完成的分配。

许可说明。主管系统权限（

IsContactCenterSupervisor

、

OmniSupervisorManageQueue

、

ViewOmnichnlAnlytDshbrd

）受权限集许可证限制。标准的

ContactCenterSupervisor

权限集自带许可证关联，可在启用Service Cloud的组织中顺利分配，因此是默认且受支持的方案——若手动创建自定义权限集并重新声明这些权限，会触发

FIELD_INTEGRITY_EXCEPTION

异常。如果特定用户的许可证缺少基础权限，分配操作会触发相同异常，以便操作人员将用户转移到具备相应权限的配置文件/许可证。

请注意，上述自定义权限集的警告并不意味着分配Salesforce自带的

ContactCenterSupervisor

权限集会移除现有访问权限或重写该权限集。本技能仅会创建缺失的

PermissionSetAssignment

；绝不会创建、编辑或替换权限集本身。

Inputs

输入参数

bash

bash scripts/verify-and-assign.sh <org-alias> [count=1] [permission-set-names-csv=ContactCenterSupervisor]

```
org-alias
```
(required).
```
count
```
(optional, default
```
1
```
, range
```
1..5
```
) — must match the supervisor user count.
```
permission-set-names-csv
```
(optional, default
```
ContactCenterSupervisor
```
) — comma-separated for multiple. Every supervisor gets every listed set (cross-product).

bash

bash scripts/verify-and-assign.sh <org-alias> [count=1] [permission-set-names-csv=ContactCenterSupervisor]

```
org-alias
```
（必填）。
```
count
```
（可选，默认值
```
1
```
，范围
```
1..5
```
）——必须与主管用户数量匹配。
```
permission-set-names-csv
```
（可选，默认值
```
ContactCenterSupervisor
```
）——多个权限集用逗号分隔。每位主管会获得列表中的所有权限集（交叉分配）。

Preconditions and safety

前置条件与安全要求

Target org authenticated via
```
sf
```
CLI, Service Cloud license,
```
sf
```
CLI ≥ 2.139.6.
The supervisor users exist and are active; fewer than
```
count
```
active users blocks with a remediation message.
The
```
ContactCenterSupervisor
```
set is Salesforce-shipped and present on any Service-Cloud-enabled org; a custom name that is missing blocks with a Setup click-path.
The executing user has
```
PermissionsAssignPermissionSets
```
(standard on System Administrator) — required even for org admins.
The three-way
```
safe_to_write
```
production guard applies — assigning permission sets on a production org can escalate a real user's privileges, so it blocks with no override.

目标组织已通过
```
sf
```
CLI完成身份验证，具备Service Cloud许可证，且
```
sf
```
CLI版本≥2.139.6。
主管用户已存在且处于激活状态；若激活用户数量少于
```
count
```
，则会触发阻断并显示修复提示信息。
```
ContactCenterSupervisor
```
权限集是Salesforce自带的，在任何启用Service Cloud的组织中都存在；若指定的自定义权限集名称不存在，则会触发阻断并显示设置路径。
执行用户拥有
```
PermissionsAssignPermissionSets
```
权限（系统管理员默认具备）——即使是组织管理员也需要该权限。
启用三方
```
safe_to_write
```
生产环境防护——在生产组织中分配权限集可能会提升真实用户的权限，因此会直接阻断且无法覆盖。

Run

运行流程

verify-and-assign.sh

performs the whole cycle:

Compute
```
safe_to_write
```
; derive the 8-char org suffix.
Validate every supplied permission-set name as a well-formed DeveloperName (SOQL-injection guard) before any
```
sf
```
call.
Resolve the
```
supervisor{1..N}.<suffix>@example.com
```
users, filtered to
```
IsActive=true
```
; block if fewer than
```
count
```
are active (an inactive occupant does not satisfy the count).
Resolve each
```
PermissionSet
```
by name; block naming which is missing.
Query existing
```
PermissionSetAssignment
```
for the (user × set) cross-product; compute the missing pairs.
POST one assignment per missing pair (individual POSTs, no
```
allOrNone
```
); treat
```
DUPLICATE_VALUE
```
as reused.
Re-query to confirm final state and emit the report.

verify-and-assign.sh

会执行完整流程：

计算
```
safe_to_write
```
状态；生成8位字符的组织后缀。
在调用任何
```
sf
```
命令前，验证所有提供的权限集名称是否为格式规范的DeveloperName（防止SOQL注入）。
解析
```
supervisor{1..N}.<suffix>@example.com
```
用户，筛选出
```
IsActive=true
```
的用户；若激活用户数量少于
```
count
```
则阻断（非激活用户不计入数量）。
根据名称解析每个
```
PermissionSet
```
；若名称不存在则阻断。
查询现有
```
PermissionSetAssignment
```
中的（用户×权限集）交叉配对；计算缺失的配对。
为每个缺失的配对单独POST分配请求（无
```
allOrNone
```
设置）；将
```
DUPLICATE_VALUE
```
视为已复用。
重新查询以确认最终状态并生成报告。

Behavior

行为说明

Cross-product. Every supervisor gets every listed set; a partial assignment is a failure, not a feature.

Idempotency.

PermissionSetAssignment

has a uniqueness constraint on (AssigneeId, PermissionSetId), so a re-POST raises

DUPLICATE_VALUE

; the skill detects existing pairs first and treats that as reused for concurrent-run safety. POSTs are individual so one error never rolls back its siblings, and it re-queries after all POSTs — a 201 only means the write was accepted; a SOQL confirms it is active.

Non-destructive. Create-only; it never deletes existing assignments (supervisors may hold out-of-band permissions) and derives users from the supervisor pattern rather than an explicit id list.

交叉分配。每位主管会获得列表中的所有权限集；部分分配视为失败，而非功能特性。

幂等性。

PermissionSetAssignment

对（AssigneeId, PermissionSetId）存在唯一性约束，因此重复POST会触发

DUPLICATE_VALUE

错误；本技能会先检测已存在的配对，并将其视为已复用，以确保并发运行的安全性。POST请求是单独发送的，因此一个错误不会回滚其他请求，且所有POST完成后会重新查询——状态码201仅表示写入已被接受；SOQL查询会确认权限是否已激活。

非破坏性。仅创建新分配；绝不会删除现有分配（主管可能拥有额外的权限），且用户是从主管模式派生而来，而非通过显式ID列表指定。

Output contract

输出约定

A single JSON object with

status

∈

assigned

reused

partial

blocked

, the resolved

permission_sets

org_suffix

requested_count

expected_assignment_count

requested_count × len(permission_sets)

), a

before

snapshot,

assigned_this_run

assigned_count

reused_count

, an

after

snapshot,

manual_actions

, and

blocking_issue

```
assigned
```
— at least one new assignment created; all expected pairs exist after.
```
reused
```
— all expected pairs already existed; nothing POSTed.
```
partial
```
— some POSTs failed; final count is below expected.
```
blocked
```
— precondition failed (production org, missing set, missing/inactive users, or a license that does not allow the permission).

assigned_count + reused_count == expected_assignment_count

unless

partial

;

blocking_issue

is non-null only for

blocked

partial

返回单个JSON对象，其中

status

的取值为

assigned

reused

partial

blocked

，包含已解析的

permission_sets

、

org_suffix

、

requested_count

、

expected_assignment_count

（=

requested_count × len(permission_sets)

）、

before

快照、

assigned_this_run

assigned_count

、

reused_count

、

after

快照、

manual_actions

和

blocking_issue

。

```
assigned
```
——至少创建了一个新分配；所有预期配对在操作后均存在。
```
reused
```
——所有预期配对已存在；未执行任何POST操作。
```
partial
```
——部分POST请求失败；最终数量低于预期。
```
blocked
```
——前置条件不满足（生产组织、权限集缺失、用户缺失/未激活、或许可证不支持该权限）。

除非状态为

partial

，否则

assigned_count + reused_count == expected_assignment_count

；仅当状态为

blocked

partial

时，

blocking_issue

不为空。

Limitations

限制说明

Provisioning the user license that the supervisor permset requires is the users-create skill's responsibility, not this one.
Assigns individual PermissionSets only — a
```
PermissionSetGroup
```
is a different sObject and is out of scope.
Create-only; it does not remove assignments.

主管权限集所需的用户许可证配置由用户创建技能负责，而非本技能。
仅分配单个PermissionSet——
```
PermissionSetGroup
```
是不同的sObject，不在本技能的范围内。
仅支持创建操作；不会移除已有的分配。

References

参考文档

File	When to read
`references/api-notes.md`	Before the POST loop — PermissionSetAssignment schema, `DUPLICATE_VALUE` semantics, and why users are derived from the supervisor pattern rather than an explicit id list

文件	阅读时机
`references/api-notes.md`	在POST循环之前阅读——包含PermissionSetAssignment架构、 `DUPLICATE_VALUE` 语义，以及为何用户从主管模式派生而非通过显式ID列表指定的说明