Flows Using Apex Sharing

In this chapter, we discuss a very important feature and share records via flows that are not available by any other means other than Apex coding. With Apex sharing, we will be able to write Apex code to share complex and dynamic sharing settings. Now, with flow, we have this feature available where you, as an admin, will be able to perform these actions without code. This topic is a bit advanced for admins. It helps to know that this feature is available in Flow Builder, and a good use case will be to add or remove access to users dynamically.

Before we get into details on flows for Apex sharing, let’s quickly recap the different options that we have in Salesforce to share records with your users. We will discuss this in a custom object context only, as Salesforce provides us with the option to have Apex managed sharing via Apex sharing reasons for individual custom objects.

In this chapter, we will cover the following sections:

• Data-sharing...

Data-sharing options in Salesforce

One of the key requirements for organizations is to have access to and control over business records in their software systems. Your organization should be able to have complete control over who can access your business data. As with all other systems, with Salesforce, you can allow specific users to view an object and restrict the individual records they can see. You can manage record-level access in four ways, and you need a combination of more than one unless you make it public to all objects via Organization-Wide Defaults (OWD).

At a high level, the following are the options to enable access to your users without the need for Apex coding:

• OWD: Specifies the default level of access the users can have to each other’s data (records). We have three options along with the Grant Access Using Hierarchies option. (The Grant Access Using Hierarchies option is an OWD setting to control sharing access using hierarchies for any custom object...

Sharing data using Apex managed sharing

Apex managed sharing provides us with the ability to support specific sharing requirements programmatically through Apex or the SOAP API.

We can do this programmatically with the help of technical team members who are conversant with Apex programming, or we can use flows. Flows using Record-Triggered Flow have the ability to access and make changes to Share objects. So, you now have the power to grant or revoke specialized access to users with a click using flows.

Note

Flows using Apex sharing have nothing to do with Apex code. Before flows, we can share records in one of these four ways (OWD, role hierarchy, sharing rules, or manual sharing) with clicks, and the other option is to share records programmatically by using Apex coding. When creating Apex managed sharing, we need to create Apex sharing reasons for individual custom objects to indicate how and why sharing was implemented for the record. Flows use the same feature used by...

Testing out our practical scenario

To test out the functionality, let’s open the Contact Sensitive Info custom object.

As an admin, I created a record on the Contact Sensitive Info object, as shown in Figure 7.6. I added Tax ID, Data of Birth, Pass Code, and signature verification image values for the existing contact record, King Valkyrie. Let’s call this record King Valkyrie_PII Data.

After I save this record, our record-triggered flow fires and completes, granting access to users to this new record. Now, these users will have access to this sensitive information record. Optionally, you can add notifications to these users from the flow:

Figure 7.6 - Contact Sensitive Info page (sample record)

We would like to grant access to only a limited number of users. Let’s see who has access to this King Valkyrie_PII Data record.

Our requirement is to grant access only to Contact Owner and Account Owner (see Figure 7.7) and no one...

Summary

In this chapter, you got exposed to a unique flow feature that can help us enhance functionality and at the same time automate it. Apex sharing using code follows the same steps as laid out in this chapter, except for Apex code, which we replace with flows.

You learned how to create an Apex sharing reason and how it is useful to grant and/or revoke access to your users for special-case records. You saw how we can update the Share objects using a record-triggered flow. Finally, we saw a real-world example and were able to verify how the data got updated on our Share objects.

For this, you need a deeper understanding of sharing objects and using Workbench and the Developer Console. You need a little bit of practice to get the hang of it. Keep practicing; you will enjoy it.

In the next chapter, we will explore and learn how to use the Flow Builder debug window. We often run into some kind of issue, and you need a tool to be able to understand and find the root cause....

Questions

1. What is the benefit of using flows to share records? And why?
2. How do we identify the reason for record sharing with a user?
3. How do we revoke access to the user for a specific record?

Further reading

• Understanding Sharing | Apex Developer Guide | Salesforce Developers: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_bulk_sharing_understanding.htm
• Workbench (developerforce.com): https://workbench.developerforce.com/login.php