2

I'm looking for a library we can use from Aura and Lightning Web Components in particular, to take some sort of request and return the data for it, but only if/what the user can see.

Per their secure coding guide, under final recommendations, they state:

There are a number of third party libraries that can help you write SOQL queries. In general, if you want to use these, you should refactor them before you try to use them. It is safest and easiest to verify injection fixes when you are doing field validation in the same function/class that you are performing the database query.

Most libraries will expose a SOQL layer that is easy to use, but does not provide any validation. If you want to use these libraries, you will need to modify them so that the framework level is secure. This will allow you to use the library without having to worry about sanitizing every database call in your code.

And I found this stackexchance, suggesting the REST API is not supported OotB in LWC (though it's quite old).

Does a library (or built-in API) already exist for this, that alters/permits querying based on the Salesforce security model (doing row, field and object level checks)? As the above suggests, I've found the Q library to build queries, but no security. Something to take, say, an object (or list of objects), some filters, perhaps some fields (or dynamically find all fields viewable to a user), or alternatively a list of IDs (perhaps mixed types) and return the data for driving custom UIs (think not just listviews and detail pages, but also a coordinated page spanning several objects and relationships, even if multiple requests are needed to drive it).

Looking at the Lighting Data Service, that only appears to let you build out UIs consisting of existing layouts and forms. The Wire Service seems to want to give you particular records based on ID, but the individual fields need to be imported and/or hardcoded into the controller. My preference is for arbitrary objects returned in JSON without having to couple the UI code so directly to the underlying data schema.

Ideally, I'd like something that for example would take some sort of request (the simplest being just give me lists of an object type):

{objectNames:['Contact', 'Account']}

and returns a list of records, showing just the objects, fields, and rows the executing user has permissions on, e.g. for a User with read on Contact and Account, with some sharing model, who can only see ID and Name, the return might be:

{[
  {ID:abc000000000123, Name:"test Contact"},
  {ID:abc000000000234, Name:"Another Contact"},
  {ID:def000000000123, Name:"test Account"}
]}
6
  • Unfortunately, no. The with sharing keyword enforces row level security IFF the object has an org wide default sharing model of private (or less than fully public). It's something the API or library would certainly need to leverage, but is only part of the solution.
    – pmiller3
    Sep 3, 2020 at 21:04
  • You might want to update the question with these details along with a definition of 'securely'
    – identigral
    Sep 3, 2020 at 21:17
  • That was my intent with the line "Does a library (or built-in API) already exist for this, that alters/permits querying based on the Salesforce security model (doing row, field and object level checks)?" If you think it's helpful, I can go into greater detail, certainly, or provide a concrete example.
    – pmiller3
    Sep 3, 2020 at 21:26
  • 1
    Probably the most common library out in the ecosystem is the FFLib Apex Common produced by Andrew Fawcett at Financial Force. Related: blog post. Or you could use the newish System.Security class methods.
    – Mark Pond
    Sep 3, 2020 at 21:35
  • Wow, not sure how I didn't find that before (I used his DI library quite a bit, it's excellent stuff). That's much more along the lines of what I'm looking for... not quite sure it's exactly it, but it's definitely a strong basis at the very least. Thank you!
    – pmiller3
    Sep 3, 2020 at 21:47

2 Answers 2

2

Probably the most common library out in the ecosystem is the FFLib Apex Common produced by Andrew Fawcett at Financial Force. Related: blog post. Or you could use the newish System.Security class methods

1

Since Aura and LWC will make calls to APEX classes eventually to get data, would you be able to leverage this: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm to enforce object and field permissions (+ with sharing keyword)

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.