My application replicates data from Salesforce to my local disk. Initially, the admin downloads the entire dump. The other users will be able to access the entire dump. However, I wanted to enforce restrictions as Salesforce.com does.

Object level: A particular user may/may not have access to a particular object. This can be solved by calling getSObjects() and then viewing only the required objects from the dump. 1. This approach has a caveat where it is difficult to determine the ownership of the object if it was deleted from Salesforce. Is there a way to retrieve the metadata that shows that the user has access to this particular object?

Object level enforcement is still not sufficient as I would like to enforce the record level access too. For this, I would be needing UserRecordAccess to query. There are a few restrictions such as 200 record per query and it is not entirely retrievable. Is it possible to recreate the record level permissions? The reason is that there may be million of rows per object and querying permissions per id seems tedious.

This is the query that I have to run for record level permissions:

SELECT RecordId, HasReadAccess, HasTransferAccess, MaxAccessLevel
     FROM UserRecordAccess
     WHERE UserId = [xxx]
     AND Record IN [id list]

The problem with UserRecordAccess is that it is basically a view, not a table. In other words, the system calculates, in real-time, what the user's access to the record should be, based on profile permissions, permission sets, sharing rules, implicit sharing, manual sharing, ownership, hierarchy access, territory management, team members, etc.

In other words, it determines the real access level derived from a variety of tables that house all this data. It's a very expensive view to use, which is why its access is relatively limited compared to normal queries. If you wanted to exactly replicate user access records, you'll have to either back them up incrementally ahead of time, which can still be very expensive if you have thousands of users, or you can try to emulate the same behavior offline using the tables. All of the information you need to correctly calculate the sharing model is accessible in various tables.

Alternatively, you might settle for a simplified model, where you just query the Share tables (e.g. AccountShare) and take those values at face value. You'll still have to deal with group expansion, and it won't cover certain features, like territory management (as far as I know). Some users might end up being denied access to records they would have had access to, but at least there shouldn't be any data leaks.

| improve this answer | |
  • Thanks. How do I go about incrementally backing up permissions of the objects that the user has access to? – dmachop Oct 9 '15 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.