Limit SOQL results using 'with sharing' in Controller does not limit returned data for Pricebooks

Question

I am running a SOQL query in a controller where I have declared 'with sharing' at the class level. The returned results are not following the sharing rules setup for the current user. The sharing rules are determined in this case by role. The following is my query and as you can see, I am setting the values of a picklist with the results.

    public List<selectOption> getPricebookSelectOptions(){
    List<SelectOption> options = new List<SelectOption>();
    List<Pricebook2> pBook = new List<Pricebook2>([Select Name, isActive FROM Pricebook2]);
    for(Pricebook2 p : pBook){
        options.add(new SelectOption(p.Id,p.Name));
    }
    return options;
}

Looking for ideas as to why all records are being returned. When I access Pricebook records as the logged in user via the Opportunity I only see the pricebook available to me so I am sure the permissions are created appropriately. Wondering if this is something to do with Pricebook records? Is there is a workaround to limit the data by user?

Answer 1

Looks like a limitation of the platform. From Enforcing Sharing Rules:

There is no guarantee that a class declared as with sharing doesn't call code that operates as without sharing. Class-level security is always still necessary. In addition, all SOQL or SOSL queries that use PriceBook2 ignore the with sharing keyword. All PriceBook records are returned, regardless of the applied sharing rules.

Thanks to Chris Duncombe for your suggestion on the following thread: How to get Pricebook2 Sharing Rules using UserRecordAccess