7

I have a basic class with no sharing keyword as I want it to inherit the permissions from callee. What would the context be?

I assume it should run as system (aka without sharing) context, but what I am seeing is opposite. I am getting security exceptions that I shouldn't and fixes by upgrading the class to without sharing.

Is this expected behaviour?

  • Whatever you're seeing, it seems likely WAD. – Adrian Larson Feb 27 '17 at 1:59
8

Invocable Actions are called through the REST API. In fact, you can use them outside of flows, such as just calling them in JavaScript, or in Salesforce1, etc. That said, it makes sense that security would be enabled by default, since it can be accessed from any context. In fact, the Invocable Action can't even be called unless the user has profile or permission set access to the class. I don't think you'll find any documentation on it, though.

  • Do we know that Invocable Actions are accessed through a callout to the REST api when used as part of a process builder process? – martin Feb 27 '17 at 3:01
  • So does this mean invocable methods will always run in user context?? – Samir Feb 27 '17 at 3:03
  • @martin I don't think it's literally called via REST call (because you can't callout after DML), but probably acts the same regardless of context in order to maintain the principle of least astonishment. – sfdcfox Feb 27 '17 at 3:17
  • @Samir It appears to do so by default, unless you use without sharing. Again, I don't see it in the docs, but the fact it was designed as a REST API tool seems to suggest it should run with sharing. – sfdcfox Feb 27 '17 at 3:19
  • 1
    @Samir It should still run as "with sharing." I'm pretty sure the only time it doesn't is when you explicitly mark the class as "without sharing." – sfdcfox Feb 27 '17 at 3:29
1

I've confirmed that invocable methods inside classes with inherited sharing will run with sharing when called from Process Builder. Which is unfortunate because Process Builder is supposed to essentially run without sharing. Maybe this was an oversight?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.