Unable to upload new attachments or view already uploaded attachment related to a record once the Owner is changed

Question

Issue:

I have a Custom Object Application__c and to the records of this object I am uploading attachments after logging in to our application. In this scenario it works fine. I am able to upload attachments and view the attachment by constructing this URL /servlet/servlet.FileDownload?file=${attachmentId}

But in our application there is a functionality where when the user clicks on a submit button, the owner of record changes to a Queue.

Once the Owner changes to the Queue, the logged in user can no more upload attachment and throws error INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY. And the user is not able to even view the file by hitting the url /servlet/servlet.FileDownload?file=${attachmentId}

Requirement:

The solution I am looking for is such that even if the record owner changes to queue, specifically the user who created the record (CreatedBy) should still be able to upload attachments and view the uploaded file, but no other user should have access to perform this action other than created by user.

Please let me know if there is any way by which we can solve this issue.

Any help would be highly appreciated.

Note: I am using connection.js for uploading, can't use apex because of heap size issue.

Answer 1

Per the documentation, only a user with sharing rights to a record can see attachments on that record.

You might need to use a trigger on the Attachment object and share the record through Apex. An example trigger that would do this:

trigger AttachmentTriggerTest on Attachment(after insert) {

    List<Application__Share> appShares = new List<Application__Share>();

    for (Attachment att : Trigger.new) {
        // Create new sharing object for the Application__c object
        Application__Share appShare = new Application__Share();

        // The ParentID should be the Application__c record: att's parent
        appShare.ParentId = att.ParentId;

        // ID of user being granted access
        appShare.UserOrGroupId = att.CreatedByID;

        // Access level to the Application__c record (read, edit, all)
        appShare.AccessLevel = 'Read';

        // Set rowCause to 'manual' for manual sharing
        appShare.RowCause = Schema.Application__Share.RowCause.Manual;

        appShares.add(appShare);
    }

    // Insert all of the newly created Share records and capture save result
    Database.SaveResult[] appShareSaveResult = Database.insert(appShares, false);
}

Sources:

Sharing a Record Using Apex (SF official documentation)

Apex based record sharing in Salesforce (Jitendra Zaa's blog)