Error when running user is a Guest User

[dnawas]

Describe the bug
I'm running into a INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY error that is getting triggered from the context user. The user is a Guest User (it's a user that is used for a Stripe-Salesforce integration). I have set the rollups to run as a System user, but it still seems to be causing an error. I've also confirmed that the Guest User has permission to create and edit the objects.

I currently have the rollups running in Process Builder mode. The Process Builder and rollups work fine when I'm the running user, but fail when it is a guest user.

To Reproduce
Steps to reproduce the behavior:

1. I create a CO record, Stripe Event, from our website
2. The Stripe Event records are created, but the next process to create a Contact, and some COs fails because of the error above.

Expected behavior
The DLRS rollups to run as the system user and not the context user.

Screenshots

Additional context

[drewpiston]

I am experiencing a similar issue -- a client of mine has a self-registration visualforce page in which a Guest user creates a Contact as well as a CampaignMember for that Contact. There is also a Rollup Summary that rolls up information from the CampaignMember to the Contact. This is set as "Scheduled" (Calculation Mode) and "System" (Calculation Sharing Mode).

In the debug logs I can see that a future method is throwing an "insufficient access rights on cross-reference id" exception. It seems like it is happening right after the insert call on the "dlrs__LookupRollupSummaryScheduleItems__c" record.

This error goes away if I give the Guest user "update" access on the dlrs__LookupRollupSummary__c object. However, that is not a long term solution, since Salesforce appears to be retiring the ability to give the Guest Site user "edit" access on anything (https://releasenotes.docs.salesforce.com/en-us/winter21/release-notes/rn_networks_reduce_object_perms.htm).

Any advice on this?

Here is an excerpt from the debug log.

21:00:18.858 (8999138236)|FATAL_ERROR|System.DmlException: Insert failed. First exception on row 0; first error: CANNOT_INSERT_UPDATE_ACTIVATE_ENTITY, dlrs_CampaignMemberTrigger: execution of AfterInsert

caused by: System.DmlException: Upsert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: []

Class.dlrs.RollupService.updateMasterRollupsTrigger: line 977, column 1
Class.dlrs.RollupService.handleRollups: line 873, column 1
Class.dlrs.RollupService.triggerHandler: line 301, column 1
Trigger.dlrs_CampaignMemberTrigger: line 7, column 1: []

[drewpiston]

Follow-up on this. Another client of mine is experiencing the same issue. A guest site user creates a record (custom object). There's a Scheduled lookup that is set to run in System context, but an exception is thrown unless the guest site user has "edit" access to the Lookup Rollup Summary object:

11:11:57:000 FATAL_ERROR caused by: System.DmlException: Upsert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_OR_READONLY, insufficient access rights on object id: [a1I54000000SeQb]: []

(Note that a1I54000000SeQb is the id of a Lookup Rollup Summary Schedule Item record)

[billerama]

One of my clients has this as well. Using the Guest User account to submit a simple form by creating a record, which then should trigger the roll-up. I tried adding the various permission set object permissions without any change. So long as the trigger was on the child object, it failed. I tried setting to "System". I set the rollup calculation mode to process builder, and which presumably turns off the trigger, but when I invoked it from within the process builder - it failed with the permission error again.

Is this a bug or a configuration issue?

[drewpiston]

@billerama @dnawas
FYI I changed my rollup from "Scheduled" mode to "Realtime" mode and this seemed to fix the problem for us. There is some custom @future apex code that runs for us, so not sure if that affects things.

[AndrewJarrett]

This appears to be the same issue as #987 and is because the guest user is not allowed to update records. The guest user is basically upserting records that are used as a log so the apex job can process and update the records later incrementally. The current workaround is to configure the rollup to run in realtime mode or as a scheduled full recalculate. This is not an ideal workaround for performance reasons - realtime adds more execution time to transactions and full recalc is slow to process and less real-time than the scheduled incremental mode.

[aheber]

Duplicate of #375