Standard Tab Visibility on decomposed Permission Sets not recognized

[dschibster]

Summary

When trying to deploy a Permission Set with Standard Tab Visibility turned on (Accounts, Reports, etc.), the files do get recognized after copying them over, however the result of the deployment does not contain the Tab Visibilities. This is using decomposePermissionSetsBeta2, so I know that this is not Safe Haven.

Steps To Reproduce

I do not have a separate repository to reproduce the issue, but I can show you the file structure that is failing to work:

Expected result

Tab Visibilities should get picked up by the Permission Set and be deployed, overriden a "Tab Hidden" on the Profile level.

Actual result

The Tab Visibilities for Custom Objects are deployed, but not the ones on the Permission Set Level. Where previously all tabs were visible, no Standard Tab is visible after the deployment.

CLI:
@salesforce/cli/2.71.6 darwin-arm64 node-v22.9.0

Plugin Version:
@oclif/plugin-autocomplete 3.2.14 (core)
@oclif/plugin-commands 4.1.14 (core)
@oclif/plugin-help 6.2.19 (core)
@oclif/plugin-not-found 3.2.31 (core)
@oclif/plugin-plugins 5.4.22 (core)
@oclif/plugin-search 1.2.17 (core)
@oclif/plugin-update 4.6.18 (core)
@oclif/plugin-version 2.2.18 (core)
@oclif/plugin-warn-if-update-available 3.1.28 (core)
@oclif/plugin-which 3.2.21 (core)
@salesforce/cli 2.71.6 (core)
apex 3.6.8 (core)
api 1.3.2 (core)
auth 3.6.82 (core)
data 3.13.5 (core)
deploy-retrieve 3.16.0 (core)
info 3.4.29 (core)
limits 3.3.43 (core)
marketplace 1.3.7 (core)
org 5.2.11 (core)
packaging 2.4.5 (user)
schema 3.3.45 (core)
settings 2.4.9 (core)
signups 2.0.13 (link) /opt/homebrew/lib/node_modules/@salesforce/plugin-signups
sobject 1.4.46 (core)
telemetry 3.6.27 (core)
templates 56.3.34 (core)
trust 3.7.51 (core)
user 3.6.5 (core)
sfdmu 4.33.17 (user)
sfdx-git-delta 5.40.0 (user)
sfdx-hardis 4.52.0 (user)

SF ENV. VARS.
SF_AUTOUPDATE_DISABLE,true
SF_DISABLE_AUTOUPDATE,true
SF_UPDATE_INSTRUCTIONS,Use "npm update --global @salesforce/cli" to update npm-based installations.

Windows: false
Shell: zsh
Channel: stable

---

Diagnostics

✅ pass - salesforcedx plugin isn’t installed
❌ fail - you have at least one linked plugin
✅ pass - [@salesforce/plugin-deploy-retrieve] sourceApiVersion matches apiVersion
✅ pass - [@salesforce/plugin-deploy-retrieve] default target DevHub max apiVersion matches default target org max apiVersion
✅ pass - [@salesforce/plugin-deploy-retrieve] sourceApiVersion matches default target org max apiVersion
✅ pass - can access: https://test.salesforce.com
❌ unknown - using latest or latest-rc CLI version
✅ pass - can access: https://appexchange.salesforce.com/services/data
✅ pass - can access: https://developer.salesforce.com/media/salesforce-cli/sf/channels/stable/sf-win32-x64-buildmanifest
❌ fail - [@salesforce/plugin-auth] CLI supports v2 crypto

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[dschibster]

Currently I can work around it by enabling the Tabs as Visible on Profile Level, but I would rather control this with Permission Sets.

[shetzel]

@dschibster - is this reproducible when not using the decomposePermissionSetsBeta2 preset?

[dschibster]

@shetzel No, not quite. The profile before I switched to decomposePermissionSetsBeta2 had all Tabs as Hidden, and only revealed them with the right Permission Sets. That has ceased to work now.

[dschibster]

@shetzel Additionally, when converting the Permission Sets containing Standard Tab visibility, they also do not get converted. I had to manually create the tabVisibility Files for Standard Tabs in hopes it's a simple conversion error. Didn't throw errors but also didn't do anything.

[iowillhoit]

@dschibster I think what @shetzel was asking is if you start with a fresh sfdx project (that does not use decomposePermissionSetBeta2) are you seeing this same issue?

[dschibster]

@iowillhoit That I would have to check. However I don't quite understand how a project without decomposePermissionSetBeta2 should even have this issue to begin with. Do you mean that I should set up a project and replicate the error by taking a permission set with the visibilities enabled and then decompose it, to see that it doesn't work?

[iowillhoit]

Hey @dschibster, sorry for the delay. We were just trying to get an idea of if this was an issue with Permission Sets in general or with the Beta Decomposition rules. Sounds like this would just be an issue with the beta feature.

Just like your other issue, it would be really helpful if you were able to put together a repo that reproduces this issue. Our team is a bit low on capacity at the moment, a repro would help us get to this sooner rather than later.

I also want to mention that all of us on the team really appreciate the time you are taking to test this beta feature! Having folks like you poke at new features and report issues is what continues to make the CLI great. Thank you 💯