I am trying to replicate salesforce ACL model for a record in an external system by querying Salesforce. What I mean by that is, given a record for an Object(for example: Case), I should be able to tell which all users/groups have access to this record.
- I do not care are field level security, I am fine with ignoring any field level details.
- I only care about who all is able to view/read that record (I do not care about who is the owner or who can edit it)
Given the Salesforce sharing model is quite complex. I came up with a basic approach.
My current approach: I found some sharing tables exist in Salesforce for most of the objects(example: CaseShare) which contains some rows for each record saying which user or group has access to this record. I plan to query this table to get all users and groups who have access. Later, I'll query the group maintainence table to check what all users belong to a particular group.
Queries I plan to use:
SELECT UserOrGroupId FROM AccountShare WHERE AccountId='X'
SELECT Id, Email FROM User WHERE UserRoleId IN (SELECT RelatedId FROM Group WHERE Id IN ( RESULTS_OF_QUERY_1_HERE)) UNION SELECT Id, Email FROM User WHERE Id IN (SELECT UserOrGroupId FROM GroupMember WHERE GroupId IN (RESULTS_OF_QUERY_1_HERE))
My question is:
- Would my approach work in all cases. Considering the salesforce access model is quite complex, does this sharing table capture all details?
- Is there a limit on the number of rows in a sharing table per record. This is needed to plan for capacity in my external system.