We have an object, call it MainObject__c that is a master object. There are several other objects with a Master-Detail relationship to it. This is a given and cannot be changed.
One of those objects, Request__c, is available for editing to a small subset of Community users. They have their own Profile and Permission Set.
Among the things they are allowed to edit are files. They can upload and delete files on the Request__c object.
Each user is only allowed to access one or more specific Request__c records. We control this on the frontend via our Angular app, and in the backend via trigger checks on records.
This works well.
What doesn't work so well is the fact that a user can view files uploaded to Request__c records to which they have no access. For example:
Alice will upload a file to a Request__c record to which she has access.
Alice can view this file, and download it via a link like
https://instance.force.com/sfc/servlet.shepherd/document/download/069XXXXXXXXXXXXXXX
Alice can email that link to Bob, who does not have access to Alice's Request__c record, and yet he can download the file she uploaded.
This is a big no-no and we would like to prevent it.
Ideally I'd like to find a way to allow per record sharing access on Request__c object, but I fear that may not be possible due to its Master-Detail relationship and being controlled by parent.
Another possible solution would be to block the download in Apex from an unauthorized user. But I have no idea how (or even if) that can be done.
