2

Current Setup:

I have an Aura controller which uses "with sharing" and a method deletes a lead using the Id.

I set up a user with profile with no Delete access. I have also revoked "view all" and "modify all data" permission.

Sharing setting has Leads set to "public read/write" which apparently has nothing to do with this situation I guess.

Code looks like this:

public with sharing class LeadViewComponentCtlr {
    public static Lead leadInfo {get;set;}

    @AuraEnabled
    public static void deleteLead(String leadId){
        if(leadId != null){
            Lead lead = new Lead(Id=leadId);
            delete lead;
        }
    }
}

Problem:

When the method is invoked by the aura component, the user is able to delete the record without any exception/error. In spite of the controller being "with sharing" and revoking delete permission on object-level security on profile.

1 Answer 1

4

With Sharing and without sharing is not related to CRUD access.

https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm

Regardless of the sharing mode, enforce object-level access and field-level security in your SOQL queries or code. For example, with sharing mechanism doesn’t enforce user’s access to view reports and dashboards. You must explicitly enforce running user’s CRUD (Create, Read, Update, Delete) and field-level security in your code. See Enforcing Object and Field Permissions.

You need to check this lead.getSObjectType().getDescribe().isDeletable();

For CRUD access you need to check DescribeSObjectResult methods isDeletable , isUpdateable , isCreateable.

UPDATE

As per salesforce recent release you can even use Security class to check your create, read, update and upsert access without adding custom logic. But still it lacks delete check.

Code will look something like this for create, read, update and upsert

Security.stripInaccessible(AccessType.CREATABLE, new List<Lead>{lead});
insert lead;

If you have access to lead there wont be any exception, but if there is no access from profile or permission set, then it will throw System.NoAccessException: No access to entity: Lead exception.

2
  • i understand lead.getSObjectType().getDescribe().isDeletable();. This will resolve the problem. and it has. but this check is enforced to avoid the unhandled exceptions. Don't you think apex should be throwing some exception at least? Just because a developer doesn't handle an exception or places a check, apex will do whatever it's asked to do? And it's acting as God mode instead.
    – Fahad Khan
    Commented Sep 9, 2021 at 10:53
  • @FahadKhan This check is not enforced to avoid unhandled exception, this check is for CRUD access. Custom Apex logic always works in System mode. In order to check for CRUD access you need to explicitly check DescribeSObjectResult methods isDeletable , isUpdateable , isCreateable, isReadable Commented Sep 9, 2021 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .