Programmatically check a user access level to a record

Question

I have a strange behavior on my org. The user's profile have no "Delete" permissions for the custom object, only "Read / Create / Edit". So he can not delete any record from this object. But when i query the UserRecordAccess object with that user id and record id i am getting HasDeleteAccess = true.

SELECT RecordId, MaxAccessLevel, HasAllAccess, HasDeleteAccess 
FROM UserRecordAccess 
WHERE UserId = 'XXX'
AND RecordId = 'YYY'

What's the catch? The user profile have no permission sets assigned.

Answer 1

Because the user is also the owner of the record, they are granted Full Access allowing them to view, edit, transfer, share, and delete the record.

Salesforce Documentation: "Record Ownership" - Understanding Sharing

Answer 2

I'm curious, did you test out the 'owner' idea by changing owners and re-running UserRecordAccess to see if they still have delete access?

My understanding of UserRecordAccess is that it does check profile/permission set permissions which is why it's different than just using the Sharing button on the record to determine access. That's at least what I found while writing a blog posting on how to build a custom sharing button (http://www.salesforcehacker.com/2013/09/build-your-own-custom-sharing-button.html) but I'll be curious to see if delete is somehow handled different due to record ownership.

Have you run SOQL to determine whether there is another reason why the user has delete? For instance:

SELECT Assignee.Name, PermissionSet.Id, PermissionSet.isOwnedByProfile, PermissionSet.Profile.Name, PermissionSet.Label
FROM PermissionSetAssignment
WHERE PermissionSetId
IN (SELECT ParentId
    FROM ObjectPermissions
    WHERE SObjectType = 'Account' AND
    PermissionsDelete = true)

This would at least look across your user's profile and all permission sets to determine whether they have an object permission row that grants access.

Answer 3

We have different types of OWD(Organization-Wide Sharing settings)

1. Public
2. Public Read Only
3. Public Read/Write
4. Public Read/Write/ Transfer.

So, in your case, the user have Public Read/Write access. Irrespective of OWD, since the user owns the record, he always have Read/Write/Delete/Transfer access.

NOTE: OWD determines the base level of access to the users for the RECORDS they do NOT own.