I have a sharing/permission issue I cannot work out simply.
My structure is a top-level object called "Project", which has a Master-Detail (because we need roll-ups) to a child called "Assignment" which connects a contact to that project. We then have "Expense" records, as a Master-Detail of Assignment (again mostly for rollups to be honest).
In a community, we want a Portal user (connected to their contact record) to be able to see their expenses.. but ONLY their expenses. Not the other expenses on assignments in that project. Because of the Master-Detail "controlled by master" access permissions though, we are stuck.
The portal user kinda needs access to certain project information, but as soon as we grant them permission to see the Project (either by Sharing "Public" or manual sharing rules) they get granted access to technically view ALL of the assignment objects and ALL of the expenses objects under them?!!??
I considered making the Project object Private and then trying to share the Costs records manually one by one, but you can't do that because they are still "controlled by parent" - and I really don't want to break a Master-Detail down to a lookup because I will have to do a huge existing-data mapping exercise and write triggers to replicate all my roll-up summaries.
We thought about moving the needed project information to the Assignment and then going "Public" access from that tier down, but we still break all the roll-ups on Project, which is a nightmare.
Is there ANY way to grant access to only certain records under a master-detail? I'm trying to consider using the Role hierarchy, but the portal users don't necessarily "own" their expense records (though if it's possible to make a portal user the owner of a custom object record via a trigger is possible, I guess I could be open to changing the owner if that led to a solution).
(I would also rather not try doing anything hacky like overriding the "View" page with a controller full of custom permission checking, because there are obviously other ways to get to the data)
Here is the problem in picture form: