0

I have Lightning Quickactions for Delete and Clone on a CustomObject__c and I want to ensure that only users with the right permission can use it.

From reading this documentation I understand that I have to check CRUD permissions before doing DML with isDeletable and isCreatable.

But what about sharing? My Controllers use with sharing as recommended but what if my user has ReadOnly Sharing.

  1. Will he be able to delete or clone or do I need to add complicated tests of Sharing tables?
  2. How do Standard Clone and Delete buttons on Lightning Record pages behave?
  3. Will they allow a user with CRUD permission by only ReadOnly Sharing see them and what will happen on click?
Improve this question

2 Answers 2

Reset to default
3

My understanding of ReadOnly is that they would be able to clone if they have IsCreateable permission, but not delete even if they had the CRUD access, because typically, only the owner or someone above the user in the role hierarchy can delete a record

But I usually end up having to verify that via the UI to actually know if that happens.

But I think you probably want to also consider using the UserRecordAccess permission to determine what behavior you want to use. Not sure if you are querying for the record, but if you are, you can then include the values like UserRecordAccess.HasDeleteAccess in order to know if they can delete that particular record without having to navigate the sharing rules, or perhaps the Maximum Access Level field, since that will give you a better idea of their level of access (None,Read,Edit,Delete,Transfer,All)

Improve this answer
1
  1. Sharing Rule only works with Record Level Security, not with Object Level. If the user has delete permission at profile level then the user will be able to delete the record. So, it is recommended to use CRUD Check
  2. If the user does not have Edit/Create Record permission buttons will not appear on the layout.
  3. Sharing rule works with record level security only. Object and Field Level security controlled by Profile.
Improve this answer
1
  • Do you mean no Quickaction at all will be displayed if I can create or edit a record or just a Lightning override of the New / Clone action?
    – Robert Sösemann
    Commented Jul 12, 2018 at 10:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .