Can I find out if the current user has access to a record without querying?

Question

I run a query from an apex class (with sharing), and I get no results I can be sure the user doesn't have permissions (if I know otherwise that the records do exist).

But can I get this information without running a query?

I was thinking of the <object_name>Share objects but I suppose they aren't created for manual and rule based sharing?

Edit: Why I want no query? Here's my real scenario. In a VF page displaying multiple records, I need to show an 'Edit' button against records for which the current user has edit permissions. My question should've been clearer; sincere apologies.

Answer 1

To find out if a particular user has Edit access to a record, use the UserRecordAccess object. This object is available in API version 24.0 and later. You can use SOQL to query this object to find out if the user has edit access to the record in question.

SELECT RecordId, HasEditAccess 
FROM UserRecordAccess 
WHERE UserId = [single ID] AND RecordId = [single ID]

If you want to check a batch of records you can use

SELECT RecordId 
FROM UserRecordAccess 
WHERE UserId=:UserInfo.getUserId() 
    AND HasReadAccess = true 
    AND RecordId IN :allRecordIds 
LIMIT 200

But make sure that allRecordIds is a LIST of IDs. It doesn't work if allRecordIds is a SET of IDs. I guess that's a bug.

Also, only a maximum amount of 200 recordIds can be checked in one query.

Answer 2

Since API 30.0 you can query an object directly (see Checking for Object Accessibility):

SELECT Id, Name, UserRecordAccess.HasReadAccess, UserRecordAccess.HasTransferAccess, UserRecordAccess.MaxAccessLevel 
  FROM Account

It also works for custom object, but unfortunately it doesn't help myself since it doesn't seem to work for the Task object.

Answer 3

There is Checking for Object Accessibility that shows how to check for access at the object level.

In Visualforce:

{!$ObjectType.Account.accessible}

In Apex (see Understanding Apex Describe Information):

Schema.DescribeSObjectResult accountDescribe = Account.sObjectType.getDescribe();
System.debug('accessible:' + accountDescribe.accessible);

Beyond that, I suspect if you want to check at a per record level you won't be able to avoid the query.

I'm not very familiar with how the Apex managed sharing works, but from what I've read you would just be querying the related sharing object rather than the object in question.

Answer 4

There are multiple programmatic ways of determining access. But a declarative method is to just click the Sharing button on the record and view the users who have access as well as why they have access by clicking the 'Why?' link?