Merge pull request #20 from SalesforceLabs/fix/file-privacy

fix: File Sharing Privacy

Author: paull10au

.DS_Store

@@ -2,3 +2,4 @@
 /IlluminatedCloud/File_Explorer___Dev/OfflineSymbolTable.zip
 /.idea/
 File Explorer - Dev.iml
+.DS_Store

.gitignore

@@ -12,6 +12,7 @@ global with sharing class qsydFileExplorerTest {
     private static qsyd_FileList fileItemList;
     private static qsyd_Folder folderItem;
     private static qsyd_FolderList folderItemList;
+    private static User standardUser;
 
     @TestSetup
     private static void setupTestData() {
@@ -27,7 +28,8 @@ global with sharing class qsydFileExplorerTest {
                 Title = 'Penguins',
                 PathOnClient = 'Penguins.jpg',
                 VersionData = Blob.valueOf(SIG_B64),
-                IsMajorVersion = true
+                IsMajorVersion = true,
+                SharingPrivacy = 'P' // set it to private on records
         );
         insert contentVersion;
         List<ContentDocument> contentDocumentList = [
@@ -64,6 +66,44 @@ global with sharing class qsydFileExplorerTest {
                 'tags',
                 contentDocumentList[0].ContentSize,
                 null);
+
+        
+        createStandardUser();
+        
+    }
+
+    @future
+    private static void createStandardUser() {
+        String uniqueUserName = 'standarduser' + DateTime.now().getTime() + '@file-explorer.dev';
+        
+        Profile p = [
+                SELECT Id 
+                FROM Profile 
+                WHERE Name = 'Standard User'
+        ];
+
+        standardUser = new User(
+                Alias = 'stduser', 
+                Email='standarduser@file-explorer.dev',
+                EmailEncodingKey='UTF-8', 
+                LastName='Test', 
+                LanguageLocaleKey='en_US',
+                LocaleSidKey='en_US', 
+                ProfileId = p.Id,
+                TimeZoneSidKey='Australia/Sydney',
+                UserName = uniqueUserName
+        );
+        insert standardUser;
+
+        PermissionSet ps = [
+                SELECT Id 
+                FROM PermissionSet 
+                WHERE Name = 'File_Explorer_Permission_Set'];
+
+        insert new PermissionSetAssignment(
+                AssigneeId = standardUser.id, 
+                PermissionSetId = ps.Id
+        );
     }
 
     @IsTest
@@ -150,4 +190,23 @@ global with sharing class qsydFileExplorerTest {
 
         System.assertEquals(2, canonicalFolders.size());
     }
+
+    @IsTest
+    private static void given_fileSetToPrivateOnRecords_when_fileRetreieved_success() {
+        List<FileExplorerFile__c> fileExplorerFileList;
+
+        setupTestData();
+
+        System.runAs(standardUser) {
+                fileExplorerFileList = fileItemList
+                        .retrieve(a.Id)
+                        .convertToCanonical()
+                        .getCanonicalList();
+
+                // does not return any file
+                // as only the owner can see this file
+                // https://help.salesforce.com/s/articleView?id=sf.collab_files_make_private_on_record.htm&type=5
+                System.assertEquals(0, fileExplorerFileList.size());
+        }
+    }
 }

src/classes/qsydFileExplorerTest.cls

@@ -51,6 +51,33 @@ global inherited sharing class qsyd_FileList implements qsyd_IItemList {
      */
     global qsyd_FileList retrieve(String recordId) {
 
+        List<ContentDocumentLink> cdlList = [
+            SELECT 
+                ContentDocumentId
+            FROM ContentDocumentLink
+            WHERE ContentDocument.IsDeleted = FALSE
+            AND IsDeleted = FALSE
+            AND LinkedEntityId = :recordId
+        ];
+
+        List<Id> contentDocumentIds = new List<Id>();
+        for (ContentDocumentLink cdl : (List<ContentDocumentLink>)Security.stripInaccessible(AccessType.READABLE, cdlList).getRecords()) {
+            contentDocumentIds.add(cdl.ContentDocumentId);
+        }
+
+        List<ContentVersion> contentVersionList = [ 
+            SELECT 
+                Id, 
+                ContentDocumentId 
+            FROM ContentVersion 
+            WHERE ContentDocumentId IN :contentDocumentIds
+        ];
+        contentDocumentIds.clear();
+        for (ContentVersion contentVersion : (List<ContentVersion>)Security.stripInaccessible(AccessType.READABLE, contentVersionList).getRecords()) {
+            contentDocumentIds.add(contentVersion.ContentDocumentId);
+        }
+
+
         this.fileExplorerFilesMap = new Map<Id, FileExplorerFile__c>([
                 SELECT Folder__c,
                         Label__c,
@@ -64,7 +91,9 @@ global inherited sharing class qsyd_FileList implements qsyd_IItemList {
                         Tags__c,
                         ContentSize__c
                 FROM FileExplorerFile__c
-                WHERE LinkedEntityId__c = :recordId
+                WHERE 
+                    ContentDocumentId__c IN :contentDocumentIds AND
+                    LinkedEntityId__c = :recordId
                 WITH SECURITY_ENFORCED
                 ORDER BY Label__c
         ]);