3

I have two objects Parent__c and Child__c with parent-child relationship. OWD settings for Parent__c is Public Read/Write and for Child__c it is Private.

The User1 has Read/Write/Delete/Edit access on Parent__c and No Access on Child__c object.

I wrote a simple trigger on Parent__c on update to create a child record Child__c.

When I update the Parent record from User1, a new child record is created with the record owner as User1 ! And for obvious reasons, User1 gets insufficient privileges error when trying to access the child record that he owns.

How can this be possible? Is this implicit access? FYI, there are no Roles or Hierarchy defined.

Edit: The relationship is Lookup. I tried it through process builder and got the same result.

Improve this question
2
  • Ashwani's answer is correct. You also need to check if the user has "Create" access on the child object and if not, do not create it. The with sharing keyword only restricts access for the class to the record level details based on sharing rules, it does not enforce FLS
    – Eric
    Oct 13, 2015 at 13:44
  • Nice question @ForceMars.
    – Rohit Patil
    Oct 14, 2015 at 6:29

2 Answers 2

Reset to default
3

Triggers run on System Mode so, it has access equivalent to system admin so child record was created.

But when you try to access the record, it is user1 context and user don't have access to that object.

Also, when parent-child relationship is master detail you cannot provide OWD access individually to parent and child. Access is controlled by parent. There must be lookup relationship only.

Improve this answer
2
  • It has a look up relationship, I forgot to mention. I tried it through process builder as well and got the same results. Don't you think this shouldn't happen? Or is there any valid reason behind it? No documents found regarding this.
    – ForceMars
    Oct 13, 2015 at 13:34
  • There is a concept of With sharing and Without sharing. All classes/triggers run in system mode by default.
    – Ashwani
    Oct 13, 2015 at 13:42
2

@ashwani is right.

Trigger always run in system context, it is not possible to run it in user context.

There are a couple things you can do to get close to user mode:

Move your trigger logic to a class and use the "with sharing" keywords: https://www.salesforce.com/us/developer/docs/apexcode/Content/apex_classes_keywords_sharing.htm

Get the details of the logged in user using the UserInfo class, then query for his/her permissions https://developer.salesforce.com/blogs/engineering/2012/06/using-soql-to-determine-your-users-permissions-2.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .