Disable Document Download in Salesforce




Disable downloads for certain users based on the name of the file uploaded to Salesforce.

We can use the following example code inside of a Apex class. This code essentially prevents files whose file name starts off with Kaipu- from being downloaded by anyone whose user role’s developer name is not Kaipu_Sales. Modify this code to suit your own purpose.







Based on Role:

public class ContentDownloadHandlerFactoryImpl implements Sfc.ContentDownloadHandlerFactory {

  public Sfc.ContentDownloadHandler getContentDownloadHandler(List<ID> ids, Sfc.ContentDownloadContext context) {

    // See if the user has the Kaipu Sales role (based on developer name field).

    Boolean isSecretUser = [

      SELECT Id

      FROM UserRole

      WHERE ID = :UserInfo.getUserRoleId()

        AND DeveloperName = 'Kaipu Sales'

    ].size() > 0;

 

    // Get the list of content documents from the ids which are actually content

    // version IDs.

    List<ContentDocument> docs = [

      SELECT Id, Title, FileType, FileExtension

      FROM ContentDocument

      WHERE ID IN (

        SELECT ContentDocumentId

        FROM ContentVersion

        WHERE Id IN :ids

      )

    ];

   

    Sfc.ContentDownloadHandler contentDownloadHandler = new Sfc.ContentDownloadHandler();

   

    // Loop through the documents and disable the download if any start off with

    // "Kaipu-" even though the user doesn't have the Kaipu Sales

    // role.

    for (ContentDocument doc : docs) {

      if (!isSecretUser && doc.Title.startsWith('Kaipu-')) {

        contentDownloadHandler.isDownloadAllowed = false;

        contentDownloadHandler.downloadErrorMessage = 'You do not have permission to download this secret file.';

        return contentDownloadHandler;

      }

    }

         

    contentDownloadHandler.isDownloadAllowed = true;

    return contentDownloadHandler;

  }

}







Based on Profile:

The code prevents files whose name starts off with Kaipu- from being downloaded by anyone whose user profile name doesn’t contain the string Admin




public class ContentDownloadHandlerFactoryImpl implements Sfc.ContentDownloadHandlerFactory {

  public Sfc.ContentDownloadHandler getContentDownloadHandler(List<ID> ids, Sfc.ContentDownloadContext context) {

    // The profile as a list of profiles as long as the name doesn't contain

    // "Admin".

    List<Profile> profiles = [

      SELECT Id, Name

      FROM Profile

      WHERE Id = :UserInfo.getProfileId()

        AND Name NOT LIKE '%Admin%'

    ];

 

    // Indicates if the user's profile is not an admin profile.

    Boolean isNotAdmin = profiles.size() > 0;

 

    // Get the list of the content versions.

    List<ContentVersion> cvs = [

      SELECT Id, Title

      FROM ContentVersion

      WHERE Id IN :ids

    ];

     

    Sfc.ContentDownloadHandler cdh = new Sfc.ContentDownloadHandler();

     

    // Loop through the files and see if any start with "Kaipu-".  If user

    // is not an admin and the file name starts off with "Kaipu-" the user

    // will not have access to download the file.

    for (ContentVersion cv : cvs) {

      if (isNotAdmin && cv.Title.startsWith('Kaipu-')) {

        cdh.isDownloadAllowed = false;

        cdh.downloadErrorMessage = 'You do not have permission to download this file.';

        return cdh;

      }

    }

     

    // If at this point allow the download.

    cdh.isDownloadAllowed = true;

    return cdh;

  }

}