Sharing File attached to an Account in Community

Question

I'm trying to find a way to let Customer Community Plus users access the Files attached to an Account.

We are sharing Accounts using manual sharing rules created by Apex (yeah, Apex managed sharing for standard objects please, SF!).

I've created a Lightning Component so that the community users can upload Files to an Account that they have access to. And then they can see their uploads via the same component. But, community users can't see any Files on the Account which were created by internal users. I just cannot find how to enable that sharing. It does work fine for internal users, when they are logged in to the community.

And community users have access to other files: we have some downloads set up for them in Content Libraries which are explicitly shared to them on other pages.

Here's the apex controller of my component which does the file listing:

@AuraEnabled
    public static List<ContentVersion> getContentList(String restaurantId) {
        restaurantId = getRestaurant(restaurantId).Id;

        List<ContentDocumentLink> documentLinks = [SELECT ContentDocumentId 
                                          FROM ContentDocumentLink 
                                          WHERE LinkedEntityId = :restaurantId];

        System.debug('documentLinks: ' + documentLinks);

        Set<Id> documentIds = new Set<Id>();

        for(ContentDocumentLink dl : documentLinks) {
            documentIds.add(dl.ContentDocumentId);
        }
        return [SELECT Id, Title, ContentUrl, Description, FileType, ContentDocumentId, ContentModifiedDate 
             FROM ContentVersion 
             WHERE ContentDocumentId IN :documentIds
             AND IsLatest = true 
             AND PublishStatus = 'P' 
             ORDER BY Title ASC];
    }

The debug there produces this for an internal user, using the community:

documentLinks: (ContentDocumentLink:{ContentDocumentId=0699E0000004fFaQAI, Id=06A9E0000004jAmUAI}, ContentDocumentLink:{ContentDocumentId=0699E0000004fFfQAI, Id=06A9E0000004jArUAI})

And this for a community plus user:

documentLinks: ()

I've checked the profile permissions, and it does have "View Content in Portals". I've read the docs where it says about DocumentLink:

For organizations with Communities enabled, a document can only be shared with users and groups that are a part of the community the file was created in.

But, my community still can't see files that were uploaded by another user in the community to that Account.

Any ideas?

Answers to crmprogdev's questions:

What is the sharing on the Account object? Org-wide default is Public Read/Write for internal users, Private for external users. The other sharing is via AccountShare rules (see later question, below)

Are the community users attempting to share the content with users who are associated with a different Account or the same Account? To just focus on a single point, lets say that internal users are creating Files associated with an Account that the community user has access to.

IOW, are you certain you want to create the content as a child of Account? The files contents are specific to the Account, so it seems like the logical place. For global files, we're using Content Libraries, and that part works fine.

When you say "created by Apex" are you using Apex Managed Sharing or are you using Manual Sharing where the RowCause is Manual? Unless I'm mistaken, you cannot do Apex Managed sharing on standard objects (https://success.salesforce.com/ideaview?id=08730000000BqpyAAC) so it's manual shares created by Apex. We have to do this because each user is related to more than one Account, and the Accounts that they are related to don't fit into hierarchies.

What are your OWD on Content for Internal Users and for External Users? Again, I could be wrong, but I didn't think that Content has Org-Wide Defaults for sharing.

Answer 1

Please query the ContentDocumentLink for one of the files which can be seen by internal users but not community users. This behavior is likely because the Visibility field on CDL is set to InternalUsers and not AllUsers.

AllUsers means anyone who can see the record can access the file, including community users.

Answer 2

You may find this helpful with your issue. From the Apex Docs

Creating Apex Managed Sharing for Customer Community Plus users Customer Community Plus users are previously known as Customer Portal users. Share objects, such as AccountShare and ContactShare, aren’t available to these users. If you must use share objects as a Customer Community Plus user, consider using a trigger, which operates with the without sharing keyword by default. Otherwise, use an inner class with the same keyword to enable the DML operation to run successfully. A separate utility class can also be used to enable this access.

Granting visibility via manual/apex shares written to the share objects is supported but the objects themselves aren't available to Customer Community Plus users. However, other users can add shares that grant access to Customer Community Plus users.

You can use apex managed sharing on standard objects if you know how to write the code properly (must run in system mode without sharing). You can also use standard reasons, and don't have to use custom reasons with it. The above should presumably help you make some progress. Accounts being public in your org, but private in your community, restricts visibility of related objects in the community which I'd think complicates your issue. IOW, you may not be able to share the content if the user doesn't have access to the account.

It sticks in my mind that Content has some restrictions for distribution in Communities that I don't have time to check at the moment. Will leave that one to you.