0

I am trying to use Child to Parent Relationship queries, but the documentation! doesn't cover the parent record's accessibility.

Say I am owning a Contact, but I don't have access to its parent record 'Account'. Does this relationship query give access to the parent record 'Account' by passing the security layer?

0

2 Answers 2

2

Your question implicates several different portions of the Salesforce security architecture.

  1. with sharing/without sharing/inherited sharing context, which applies to Apex classes, determines whether or not record-level visibility, such as Organization-Wide Defaults and Sharing Rules, are applied. Because your comment indicates you're running a query via the Bulk API, this wouldn't be in play here, but you would need to be aware of this context if you run the same query in an Apex context, and it's useful information regardless.

  2. Querying over the API is always done in a with sharing context, meaning that record-level sharing and visibility is applied. However, if you're authenticated under a user that has "View All" permission on the relevant objects, or the "View All Data" profile-level permission, record-level sharing is ignored for the objects with that permission and you can conceive of the query as running without sharing.

  3. Sharing and relationship queries. Relationship queries do not per se provide access to records your user doesn't have permission to see, and don't bypass record-level security. However, Salesforce has a notion of "implicit sharing" that can appear as if that's what is taking place.

    Implicit parent/child sharing takes place only between Account and Contact, Case, and Opportunity. Access to the child, such as a Contact in this case, provides implicit Read Only access to the parent (the Account), while access to the parent provides access to the associated child records. You can read a quick summary of implicit sharing behaviors, which also include some facets related to Communities.

It sounds like implicit sharing is the aspect that most directly impacts the behavior you are seeing. If you're operating in a context where the Organization-Wide Default of Account is private, but your Bulk API running user has access to a Contact, you'll find that your relationship query can access the Contact's parent even if you don't own the Account. This is caused by implicit sharing.

2
  • +1 Nicely articulated
    – RedDevil
    Dec 3, 2018 at 17:05
  • Implicit sharing is the deal.
    – sfdcfox
    Dec 3, 2018 at 17:19
0

You will have access if the class is without sharing. The class declaration will take care of that. So if your query is inside a class that don't reinforce access, you will be able to see those records.

Check this link:

2
  • That's good to know. But I am trying to execute the Bulk Query API, what's effect on parent record accessibility?
    – Jai Ganesh
    Dec 3, 2018 at 16:48
  • @JaiGanesh Could you edit your question to include that detail? It's important.
    – David Reed
    Dec 3, 2018 at 16:59

Not the answer you're looking for? Browse other questions tagged .