[SalesForce] revoking apex managed sharing permission

I'm using apex managed sharing to grant permissions very similar to how it is done in this example trigger: http://wiki.developerforce.com/page/Using_Apex_Managed_Sharing_to_Create_Custom_Record_Sharing_Logic

However, I also need the ability to revoke or delete this access and having it revert to private. The reason for this is my understanding is that there are only two access options for managed sharing access 'read' or 'edit' with no 3rd option of 'none' or 'private'.

Reference: http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_bulk_sharing_creating_with_apex.htm

I've tried adding the shares to a list and deleting the list and I'm getting the error:
DELETE_FAILED, cannot delete owner or rule share rows,

I also noticed there is a field on the share object 'isDeleted' this field however is not writable.

Does anyone have experience revoking or deleting these permissions once they've been created?

Thanks!

Best Answer

You will need to delete a specific type of sharing record, those with a RowCause value of 'Manual'.

Delete all manual sharing records on a custom object contained in the trigger:

List<MyCustomObject__Share> sharesToDelete = [SELECT Id 
                                                FROM MyCustomObject__Share 
                                                WHERE ParentId IN :trigger.newMap.keyset() 
                                                AND RowCause = 'Manual'];
if(!sharesToDelete.isEmpty()){
    Database.Delete(sharesToDelete, false);
}

Similarly for a standard object (Account):

List<AccountShare> sharesToDelete = [SELECT Id 
                                        FROM AccountShare 
                                        WHERE AccountId IN :trigger.newMap.keyset() 
                                        AND RowCause = 'Manual'];
if(!sharesToDelete.isEmpty()){
    Database.Delete(sharesToDelete, false);
}

Related Solutions

[SalesForce] Using Apex Managed Sharing to share an opportunity

This works in my org (I modified a little to allow for missing variables). Once I commented out the row cause, I was able to compile it...if you do that, does it still fail? If so, what's the error?

Set<Id> oppIds = new Set<Id> ();
Id newOwnerId;
List<OpportunityShare> oppShares = new List<OpportunityShare>();
for(Id i : oppIds) {
   OpportunityShare os = new OpportunityShare();
   os.OpportunityId = i; 
   os.OpportunityAccessLevel = 'Read/Write';
   os.UserOrGroupId = newOwnerId;
  // os.RowCause = 'Manual Sharing';
   oppShares.add(os);
}

Database.SaveResult[] result = Database.insert(oppShares, false);

[SalesForce] Is is possible to grant delete permissions using apex managed sharing

See this answer I had asked another question on this topic because the answer by Ralph Callaway didn't work for me (but I really wanted it to)

I am copying the answer from the original question I asked because I don't want it to be a link only answer. I'm putting it here so others are not misled to think giving Delete access on the object and an edit apex managed share wil let the user delete the record.

The credit for the answer goes to ca_peterson and is reposted here:

The statement from the docs http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_bulk_sharing_understanding.htm

is key here:

This access level can only be granted with Force.com managed sharing.

in reference to the "full control" sharing setting.

Force.com managed sharing is the term for sharing that is granted by the platform itself - so record owner and manager of record owner if you simplify the statement.

Per the docs linked there you need "Full Access" to be allowed to delete.

Pair these two facts together and it turns out that nope - there's no way to grant delete access via apex sharing rules. The only options are to use force.com managed sharing (i.e. change the owner, or be above the owner in the role hierarchy), or grant modify all on the profile/perm set.

The other option would be to make a custom VF page or action that allows deleting the record via without sharing apex if the user has edit rights, but that doesn't allow the normal delete DML event, so has some drawbacks.

Best Answer

Related Solutions

[SalesForce] Using Apex Managed Sharing to share an opportunity

[SalesForce] Is is possible to grant delete permissions using apex managed sharing

Related Topic