I'm facing a scenario that I believe it is related to some permission that's missing.
I'm calling a invocable method that is called by a Record Triggered flow that doesn't return records, here is the scenario:
- a public VisualForce is called
- it inserts a record in a custom object
- this custom object has a record triggered flow that's called by a entry condition according to the insert
- inside the record triggered flow, theres a call of an invocable method
- inside the invocable method, it calls a helper class that needs to query another custom object
The issue: All the time this query comes empty.
But, if I call the same invocable method via Developer console, it runs as expected. (Here, I'm using admin user)
If I try to query the custom object in the same visual Force controller that starts the transaction, that is, by using the same user that calls all the process, it can query the custom object.
What permission would be missing that's avoiding the helper class (called by invocable method) to access the records of the custom object?
Here is the call hierarchy:
- VisualForcePageController = without sharing
- A record is created
- This creation calls a Record Triggered flow, time based
- A subflow is called
- InvocableClass = with sharing (1st level)
- Helper class = with sharing (2st level)
- SubHelper class = with sharing (third level) => Here is the issue
EDIT: adding a Code snippet
global class with sharing InvocableClass
{
@InvocableMethod
public static List<MyCustomObject> getRecord(List<MyWrapper> data)
{
List<MyCustomObject> dataToReturn = Helper.getRecords(data.get(0).myField);
return dataToReturn ;
}
}
class without sharing Helper
{
public static List<MyCustomObject> getRecords(String myField)
{
// pre-logic
return SubHelper.getRecords(myField);
}
}
class without sharing SubHelper
{
public static List<MyCustomObject> getRecord(String myField)
{
return [SELECT Id, Name FROM MyCustomObject WHERE MyCustomField := myField);
}
}
So, in order to SubHelper accessing the MyCustomObject, I had to change InvocableClass from "with sharing" to "without sharing".
Is there another way to do that?
with sharing
means sharing rules enforced sosubhelper
class runs and enforces record visibility rules; when you ran as admin, you have View All Data; when query was done in the VF controller, you were runningwithout sharing
hence user could see records