Salesforce standard objects accessibility based on org wide share settings and roles

Question

Is there any possible way to fetch the SFDC standard objects such as Accounts, Opportunity, Contacts and Leads based on the accessiblty rules configured in the SFDC using REST API of SFDC? If yes, then how exactly we can pass the user specific details along with passing the admin users access key for connected-app.

Answer 1

So you want single login to API as system administrator but to run queries filtered by Salesforce as if user X would be asking, to take into account org wide defaults, sharing rules etc?

You might want to experiment with UserRecordAccess, simpler than checking AccountShare tables, traversing groups, all that mess. But you might have to do it in 2 steps.

This doesn't work:

SELECT RecordId
FROM UserRecordAccess
WHERE UserId = '005700000012zKY' AND HasReadAccess = true
AND RecordId IN (SELECT Id FROM Account)

But this is promising

Set<Id> ids = new Map<Id, Account>([SELECT Id FROM Account LIMIT 200]).keyset();

System.debug([SELECT RecordId
    FROM UserRecordAccess
    WHERE UserId = '005700000012zKY' AND HasReadAccess = true
    AND RecordId IN :ids
]);

(yes, there's some limit to 200 records)

If this feels too clunky maybe best would be to really not have admin account in the integration but let people log in to SF through your app and "naturally" fetch / edit only what they can see? For current user UserRecordAccess can be used directly in the main query, select id, name, userrecordaccess.haseditaccess from account. You could then even use "scopes" if you have fancy queues setup or territories.