1

Background:

I have a form in a community that creates a case, and then sets that case record id on a lightning-file-upload component which allows users to upload files and attach them to the case they just created.

I implemented a lightning-pill-container to display the uploaded files, and set the onitemremove attibute to a function that makes a call out to deleteRecord from this api:

import { deleteRecord } from 'lightning/uiRecordApi';

Problem:

When I test the deletion as an authenticated user, it works, but as a guest user, the file is not deleted, and returns an error of:

INSUFFICIENT_ACCESS_OR_READONLY

Attempts:

  1. I researched and found some trailblazer community posts that you say if you are an owner of a record you should automatically be able to delete it—BUT the guest user is the owner so not the case. (note this post also suggests to give modify all permissions which I don't really need or want to do in this situation)

  2. I found another article that said that if you have edit/delete access to the parent object you should be able to removed attached files so I tried the following:

I tried to modify in sharing settings of Case object but only read only is an option for that profile when I create a sharing rule.

I tried modifying the guest user profile, but for the Case object, read and create are the only options (as in, edit and delete are not even options to enable/check)

I tried creating a permission set that enables Edit/Delete on case, but it seems you cannot assign permission sets to guest user licenses?


Remaining Questions:

Anyways, I am curious if anyone else has had this problem.
Has anyone found a way to allow guest users to delete files that they have uploaded?

Is there some permission somewhere that I am missing?

Thanks!

2

I don't think you can do it due to the external sharing restrictions on the object for the site guest user. Even if you manage to find some workaround using without sharing in apex etc., be mindful of the new security updates coming up for the guest user documented here. That means that as of March 2020 the user will be even more locked down and limited to what it can do (nothing more than creating records). I'd suggest you review the solution and come up with a different way to handle that process.

|improve this answer|||||
  • Thank you for your help and advice! I appreciate it! – Sarah Ganci Dec 5 '19 at 7:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.