How to determine if a User has update access to a RecordType programatically

Question

I'm changing the ownerId of a record though Apex to another User. This flow is not through Visualforce or Triggers. The code is running in system context and isn't initiated by a user. Hence even if the user does not have access to the record type, the assignment works.

How do I ensure that the user has update access on this record Type before assigning her as the owner?

Answer 1

A bit unclear on if you are talking about object or record, but if you want to check access on the specific record for a different user

You can query the UserRecordAccess object directly as so to see if user edit has access to the record:

SELECT RecordId
     FROM UserRecordAccess
     WHERE UserId = [single ID]
     AND RecordId = [single ID]      //or Record IN [list of IDs]
     AND HasEditAccess = true

UserRecordAccess

Keep this Known issue in mind

Answer 2

if (Schema.sObjectType.Contact.isUpdateable()) {
   // Update contact 
}

Reference links:

• Enforcing Object and Field Permissions
• DescribeSObjectResult Class

Answer 3

Unfortunately, there is not a fast/easy way to do this (as far as I know).
You will have the use the following classes:
ObjectPermissions
PermissionSet
User

First retrieve the Id of the user you want to assign the Record.

User userTarget = [SELECT Id FROM User WHERE ...];

After that, retrieve all the PermissionSetAssigment for that User (in this class, all types of permission counts: from profile, permission set, custom permission, and so on). Also, store the ids in a set to use them to query.

Set<Id> permissionSets = new Set<Id>(); for(PermissionSetAssignment up : [SELECT PermissionSetId FROM PermissionSetAssignment WHERE AssigneeId = :userTarget.Id]){ permissionSets.add(up.PermissionSetId); }

Finally, get the ObjectPermission of the sObject type you are trying to assign

for(ObjectPermissions objPerm : [SELECT PermissionsCreate FROM ObjectPermissions WHERE ParentId IN :permissionSets ANd sObjectType = 'Account']){ if(objPerm.PermissionsCreate){ System.debug('Account Create access!'); break; } }

Answer 4

Its always better to move code in utility so as to increase the code re-usability. Following is the method which you can use in your apex code to check CRUD permissions and can customize as per your need, I am just giving you an example as there can be multiple instances where you would need to apply CRUD checks in that case it will be helpful.

// Variable Declaration
private static final String ID_STRING = 'Id';

/**
 * @description: Checks if user has save access on the records.
 * @param: 1. sObjectList - List of records to perform update / insert on
 *         2. userId - User for which the record access is checked.
 * @return: Void
 **/
public static void checkSaveAccessForSObject(List<sObject> sObjectList, Id userId ){

    Map<Id, sObject> currentSObjectMap = new Map<Id, sObject>();
    List<sObject> finalSObjectList = new List<sObject>();
    List<UserRecordAccess> listUserRecordAccess = new List<UserRecordAccess>();

    // Iterate over Sobject List
    for(sObject obj : sObjectList) {

        if(obj.get(ID_STRING) != NULL) {
            currentSObjectMap.put( (Id) obj.get(ID_STRING), obj);

        } else {
            finalSObjectList.add(obj);
        }
    } // for

    if(currentSObjectMap != NULL && currentSObjectMap.isEmpty() == false){

        listUserRecordAccess = checkUserAccessForSobject(currentSObjectMap.keySet(), userId);

        for(UserRecordAccess objUserAccess : listUserRecordAccess){
            if(objUserAccess.HasReadAccess && objUserAccess.HasEditAccess )
                finalSObjectList.add(currentSObjectMap.get(objUserAccess.RecordId));
        } // for
    } // if

    //Now you have this Sobject List You can do further manipulation on that
    system.debug('****finalSObjectList****'+finalSObjectList);
} // 

/**
 * @description: Checks if user has access to the set of record ids provided
 * @param: 1. recordIdsSet - Set of record ids to check access of
 *         2. userId - User for which the record access is checked.
 * @return: List<UserRecordAccess> having access values for each record provided
 **/
public static List<UserRecordAccess> checkUserAccessForSobject(Set<Id> recordIdsSet, Id userId ) {

    List<UserRecordAccess> listUserRecordAccess = new List<UserRecordAccess>();

    if(recordIdsSet == NULL
    || recordIdsSet.isEmpty()
    || userId == NULL) {
        return listUserRecordAccess;
    }

    recordIdsSet.remove(NULL);

    if( !recordIdsSet.isEmpty() ) {
        listUserRecordAccess = [SELECT RecordId,
                                       HasReadAccess,
                                       HasEditAccess,
                                       HasDeleteAccess
                                  FROM UserRecordAccess
                                 WHERE UserId =: userId AND
                                       RecordId IN : recordIdsSet];
    }
    return listUserRecordAccess;
} // End checkUserAccessSobject