0

I have a custom object called Banner that I'd like to allow portal users to view and portal administrators to create/edit all records. Currently the admin can create, edit, delete their own records, but not others. I have setup a sharing rule with that should allow members of the "VMS admin" public group Read/Write access, but it doesn't appear to be working.

How do I share all records of a certain type with a particular user/group/or permission set?

Here's my configuration:

The user, VMS admin is assigned the "Employee Portal Approval" profile and is assigned to the VMS Admin public group. The Employee Portal Approval profile has a Customer Community Plus license with CRUD permission on their own banner records.

banner custom object permissions

The Banner object,

  • OWD are set to Internal Public Read Only, External Public Read Only
  • Sharing Rules allow members of the VMS admin group Read/Write access on records with certain field values. Banner object sharing rules

The following is an apex test class. The adminCanEdit method fails with the error, "INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id"

    //Test 3 - VMS admin can add banners
    @isTest
    public static void adminCanCreateEdit(){
        //vmsAdmin_user belongs to the public group "VMS admins"
        User vmsAdmin_user = [SELECT Id from User WHERE username='[email protected]' LIMIT 1];

        Test.startTest();
        System.runAs(vmsAdmin_user){
            Banner__c b1 = new Banner__c(
                application__c = 'vms',
                Title__c = 'test3-11232jkljf',
                Message__c = 'Test insert record on test3-11232jkljf',
                Start_Date__c = Date.newInstance(2022, 3, 3),
                End_Date__c = Date.newInstance(2022, 12, 9)
            );
            insert b1;
            b1.Message__c = 'The VMS admin can change their own banner';
            update b1;
        }
        Test.stopTest();
        
        List<Banner__c> result = [SELECT Id, Message__c, application__c, Start_Date__c FROM Banner__c WHERE Title__c = 'test3-11232jkljf'];
        System.debug(result);
        System.assertEquals(1, result.size(), 'could not find one record');
        
    }

    //Test 4 - VMS admin can update banners
    @isTest
    public static void adminCanEdit(){
        User vmsAdmin_user = [SELECT Id from User WHERE username='[email protected]' LIMIT 1];
        String newMessage = 'The VMS admin should be able to update this banner.';


        Test.startTest();
        System.runAs(vmsAdmin_user){
            List<Banner__c> t4result = [SELECT Id, Message__c, application__c, Title__c FROM Banner__c WHERE Title__c = 'Banner1'];
            t4result[0].Message__c = newMessage;
            
            update t4result;
        }
        Test.stopTest();
        
        List<Banner__c> result = [SELECT Id, Message__c, application__c, Start_Date__c FROM Banner__c WHERE Title__c = 'Banner1'];
        System.debug(result[0]);
        System.assertEquals(newMessage, result[0].Message__c, 'The message was not updated.');
    }

Similar question, but not quite... Sharing Rule is not granting access to a public group

1 Answer 1

1

Are you running into the same problem with functional tests?

Unfortunately, criteria-based sharing rules do not apply in a unit test context. OWD Sharing Settings do apply in tests, however.

To work around this in your tests, you may have to create a manual share record as part of the test to imitate the expected access from the sharing rule.

4
  • Good to know testing won't work.
    – Dave
    Mar 8, 2022 at 15:12
  • I am testing this with a lightning web component. Users in the VMS Admin group are not able to delete other user's Banner records. The lightning web component uses the deleteRecord API. After further investigation, I realize VMS admin users can edit the record just fine, though it seems they still can't delete it. The sharing rule only allows Read/Write. Is it possible deleting a record is not allowed?
    – Dave
    Mar 8, 2022 at 15:20
  • 1
    According to this, sharing rules may not grant delete access to records owned by other users. However, the user can change the record owner. So, maybe a custom apex that changes the record owner then deletes the record?
    – Dave
    Mar 8, 2022 at 15:28
  • Good callout about delete - have run into that same exact issue a few times. This article is helpful to have on hand for delete: help.salesforce.com/s/articleView?id=000327316&type=1 " There are three scenarios in which a User can delete a record: * The User trying to delete the record is the owner. * The User is higher than the owner in the owner's role hierarchy. * The User trying to delete the record has the 'Modify All' permission. " An ownership change is certainly an option, but be careful about the side effects from changing ownership like clearing existing shares Mar 9, 2022 at 20:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .