Site guest user cannot create ContentDocumentLink - insufficient access rights on cross-reference id

Question

[SOLVED by removing trigger on ContentDocumentLink]

I am implementing uploading files as ContentDocument. For System Administrator all works good, but for non-registered site user it does not work. Creation of ContentVersion is good, but it fails at creation of ContentDocumentLink with exception INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY. Btw site user can successfully create all other objects (Opportunity, Account etc..)

I removed all dml except this one. I hardcoded Ids of existing ContentDocument and existing Opportunity. Owner of ContentDocument and Opportunity records is Site Guest User. And it fails only at creating ContentDocumentLink And Query for both Opportunity and ContentDocuments returns existing data. So User has access to both objects.

// ...       
       ContentDocumentLink link = new ContentDocumentLink(
           ContentDocumentId = 'xxxxxxxxxxx',
           ShareType = 'I',
           LinkedEntityId = 'xxxxxxxxxxxx'
       );
       insert link;
// ...       

Answer 1

Try setting ShareType = 'V' instead of 'I'. The problem may be that Guest Users can only grant view access and not other share types. I've run into similar quirks myself with ShareType when developing Attachment to Files conversion code.

'V': Viewer premission. The user can explicitly view but not edit the shared file.

https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_contentdocumentlink.htm

Answer 2

It works if I remove trigger CDL on ContentDocumentLink (after insert) {...}