2

I'm trying to find a way to let Customer Community Plus users access the Files attached to an Account.

We are sharing Accounts using manual sharing rules created by Apex (yeah, Apex managed sharing for standard objects please, SF!).

I've created a Lightning Component so that the community users can upload Files to an Account that they have access to. And then they can see their uploads via the same component. But, community users can't see any Files on the Account which were created by internal users. I just cannot find how to enable that sharing. It does work fine for internal users, when they are logged in to the community.

And community users have access to other files: we have some downloads set up for them in Content Libraries which are explicitly shared to them on other pages.

Here's the apex controller of my component which does the file listing:

@AuraEnabled
    public static List<ContentVersion> getContentList(String restaurantId) {
        restaurantId = getRestaurant(restaurantId).Id;

        List<ContentDocumentLink> documentLinks = [SELECT ContentDocumentId 
                                          FROM ContentDocumentLink 
                                          WHERE LinkedEntityId = :restaurantId];

        System.debug('documentLinks: ' + documentLinks);

        Set<Id> documentIds = new Set<Id>();

        for(ContentDocumentLink dl : documentLinks) {
            documentIds.add(dl.ContentDocumentId);
        }
        return [SELECT Id, Title, ContentUrl, Description, FileType, ContentDocumentId, ContentModifiedDate 
             FROM ContentVersion 
             WHERE ContentDocumentId IN :documentIds
             AND IsLatest = true 
             AND PublishStatus = 'P' 
             ORDER BY Title ASC];
    }

The debug there produces this for an internal user, using the community:

documentLinks: (ContentDocumentLink:{ContentDocumentId=0699E0000004fFaQAI, Id=06A9E0000004jAmUAI}, ContentDocumentLink:{ContentDocumentId=0699E0000004fFfQAI, Id=06A9E0000004jArUAI})

And this for a community plus user:

documentLinks: ()

I've checked the profile permissions, and it does have "View Content in Portals". I've read the docs where it says about DocumentLink:

For organizations with Communities enabled, a document can only be shared with users and groups that are a part of the community the file was created in.

But, my community still can't see files that were uploaded by another user in the community to that Account.

Any ideas?

Answers to crmprogdev's questions:

What is the sharing on the Account object? Org-wide default is Public Read/Write for internal users, Private for external users. The other sharing is via AccountShare rules (see later question, below)

Are the community users attempting to share the content with users who are associated with a different Account or the same Account? To just focus on a single point, lets say that internal users are creating Files associated with an Account that the community user has access to.

IOW, are you certain you want to create the content as a child of Account? The files contents are specific to the Account, so it seems like the logical place. For global files, we're using Content Libraries, and that part works fine.

When you say "created by Apex" are you using Apex Managed Sharing or are you using Manual Sharing where the RowCause is Manual? Unless I'm mistaken, you cannot do Apex Managed sharing on standard objects (https://success.salesforce.com/ideaview?id=08730000000BqpyAAC) so it's manual shares created by Apex. We have to do this because each user is related to more than one Account, and the Accounts that they are related to don't fit into hierarchies.

What are your OWD on Content for Internal Users and for External Users? Again, I could be wrong, but I didn't think that Content has Org-Wide Defaults for sharing.

  • Can you check if those are under Notes? – Santanu Boral Mar 30 '17 at 17:32
  • What is the sharing on the Account object? Are the community users attempting to share the content with users who are associated with a different Account or the same Account? IOW, are you certain you want to create the content as a child of Account? – crmprogdev Mar 30 '17 at 17:43
  • @SantanuBoral The files were uploaded under Files, but do also appear under the Notes + Attachments related-list. I'm using the lightning:openFiles event to display the files, so ultimately I'm going to need to refer to them as content. – Aidan Mar 31 '17 at 7:50
  • @crmprogdev Sharing is via manual sharing (created by Apex), accountshare for this user/account is (AccountShare:{Id=00r9E00000BoPeXQAV, AccountAccessLevel=Read, RowCause=Manual}). We want any files on the Account to be visible to anyone who has access to the to the Account. – Aidan Mar 31 '17 at 7:55
  • When you say "created by Apex" are you using Apex Managed Sharing or are you using Manual Sharing where the RowCause is Manual? What are your OWD on Content for Internal Users and for External Users? You still didn't answer my other questions that are very relevant to your issue. Please use the edit button to update your question. – crmprogdev Mar 31 '17 at 13:53
1

Please query the ContentDocumentLink for one of the files which can be seen by internal users but not community users. This behavior is likely because the Visibility field on CDL is set to InternalUsers and not AllUsers.

AllUsers means anyone who can see the record can access the file, including community users.

  • Thanks for the idea, but the result is (ContentDocumentLink:{Id=06A9E0000004jAmUAI, ShareType=I, Visibility=InternalUsers}, ContentDocumentLink:{Id=06A9E0000004jAlUAI, ShareType=I, Visibility=AllUsers}). As far as I understand, those are the correct permissions. – Aidan Mar 31 '17 at 7:48
  • Aidan, the information shows there are 2 CDLs. Important information to include is the LInkedEntityId, however based on this information, I believe the 2nd CDL with Visibility=AllUsers is pointing to a user Id (the file owner) and the first CDL with Visibility=InternalUsers is pointing to the Account, which would lead to the behavior I mentioned so community users can't access the file. – Neil H. Apr 3 '17 at 16:31
  • Spot on, Neil. I hadn't realised the significance of LinkedEntityId and it is exactly as you say. It was linked to AllUsers for when the linked entity was a User and InternalUsers when the linked entity was the account. I've deleted the Account one, and recreated it with AllUsers - now the community user can see the file! Now I can code something up to make it work that way by default, and we're in business. Thanks! – Aidan Apr 4 '17 at 8:16
  • Glad to hear it. When posting a file via feed post UI, you can select "your company" (internal) vs "all users", but if files are added via the related list, you can't choose the visibility. You may be able to add a trigger on ContentDocumentLink to meet your needs, possibly on before insert trying to set the visibility, but I haven't tried this. Note that CDL will file in many cases (whenever a file is created or shared anywhere), so you'd want specific logic checking for shares to records (and possibly more granular conditions). – Neil H. Apr 5 '17 at 18:10
  • Cheers Neil. One you'd tipped me off with the reason, it was a simple before trigger on ContentDocumentLink: for(ContentDocumentLink newLink : newList) { if(newLink.LinkedEntityId.getSObjectType() == Account.sObjectType) { newLink.Visibility = 'AllUsers'; } } – Aidan Apr 6 '17 at 8:22
0

You may find this helpful with your issue. From the Apex Docs

Creating Apex Managed Sharing for Customer Community Plus users Customer Community Plus users are previously known as Customer Portal users. Share objects, such as AccountShare and ContactShare, aren’t available to these users. If you must use share objects as a Customer Community Plus user, consider using a trigger, which operates with the without sharing keyword by default. Otherwise, use an inner class with the same keyword to enable the DML operation to run successfully. A separate utility class can also be used to enable this access.

Granting visibility via manual/apex shares written to the share objects is supported but the objects themselves aren't available to Customer Community Plus users. However, other users can add shares that grant access to Customer Community Plus users.

You can use apex managed sharing on standard objects if you know how to write the code properly (must run in system mode without sharing). You can also use standard reasons, and don't have to use custom reasons with it. The above should presumably help you make some progress. Accounts being public in your org, but private in your community, restricts visibility of related objects in the community which I'd think complicates your issue. IOW, you may not be able to share the content if the user doesn't have access to the account.

It sticks in my mind that Content has some restrictions for distribution in Communities that I don't have time to check at the moment. Will leave that one to you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.