Give High Volume Customer Portal User access to Contacts

Question

What I want to achieve

I want to be able have my high volume customer portal users access their own contact record or contacts related to the account linked to them. I want to make this work by redirecting the user to the edit page of their contact record from the portal. So, in the apex code below you will see I am redirecting the user to the edit URL.

What I have tried

I wrote a visualforce page with an edit button which basically redirects the user to the edit page of their contact record. I receive an error here which is listed at the bottom!

Apex Code

public PageReference EditProfile(){
    //contactId is the id of the user's contact record
    PageReference redirect = new PageReference('/'+contactId+'/e');
    return redirect;
}

Query Results

//I ran the following query and got the results pasted below
UserRecordAccess access = [select RecordId, HasEditAccess from UserRecordAccess where UserId = :UserInfo.getUserId() and RecordId =: contactId];

//Results show that the user has edit access on the record
13:48:35.091 (91988000)|USER_DEBUG|[27]|DEBUG|UserRecordAccess:{RecordId=003i000000D7AYPAA3, Id=000000000000000AAA, HasEditAccess=true}

Configuration

1. Added 2 permission sets which gave the user read edit and create access on Account and Contact Object.
2. Under Organization-Wide Defaults I made the Account and Contact settings 'Public Read/Write'

But still, I am unable to make this work. I don't want to be writing the whole page in visualforce. Could you help me identify if I am missing something?

Error Received
Insufficient Privileges
You do not have the level of access necessary to perform the operation you requested. Please contact the owner of the record or your administrator if access is necessary.

Answer 1

Yes, you can do this. But there aren't any settings you can change, you'll need to build a visualforce page and controller to handle making the edits.

For users with limited access to certain objects there are two issues, (1) record access (sharing), and (2) object and field permissions. You'll run into both of these with high volume customer portal users.

To deal with (1) you can use the "without sharing" directive to return any objects. With great power, comes great responsibility. You'll need to handle ensuring the current user only access records they should be able to. In your case his should just mean querying the contacts they have access to based on the logged in users account, as opposed to a url parameter.

public without sharing ProfileEdit {

Fortunately for (2), object and field permissions are only enforced at the front end, so you can't expose any account objects or their fields directly, but you can use text inputs as a go between.

public String firstName { 
  get { return contact.firstName; } 
  set { contact.firstName = value; } 
}