In the previous post, there was a quick video of how otherwise shared emails could be protected using a few relatively simple plugins.
Just to re-cap, why would you want to do this?
The scenario we are talking about is:
- We want to keep everyone in the know of the email correspondence with the client (on the contact timeline, for example)
- At the same time, there could be different business groups involved, and some of them might feel that their emails have sensitive information that should not be shared with others
Both of those statements apply to the attachments, too.
So, for a user who only has limited access only, we would want the system to hide email message and, also, to prevent such user from downloading email attachments.
Which, in the end, is totally doable with a relatively simple plugin. Whether it’s worth it or not depends, but, really, if yo can’t get the requirements changed, you may, in the end, have to change the system:
Here is how we can do it with a plugin.
We need to intervene at 4 different points in the execution pipeline:
On create of the email, as well as on update of the emails, we need to store original email body in a secured entity, and we need to update email body with a “this email is protected” message.
On retrieve of the email, we need to substitute “protected” email body with the actual message from the secured entity for those users who have access, and we should display “please contact the owner…” for those who have no access.
Finally, whenever a user tries to download an attachment, we need to see if the user has access to the protected email to start with. Which is another “retrieve” plugin.
For this to work, we’ll need to add a new table (Secure Data), we’ll need to create a lookup column on the email table (it’ll be a lookup to that new table), and, then, we need to have some sort of trigger/identifier of the secure emails. Which I did by adding a “Yes/No” column to the email entity, but there might be other ways.
Basically, the plugin, so far, assumes that, once the value of that column is “Yes”, the email is supposed to be protected. That column could be updated manually be the owner, or it could be updated through a Power Automate Flow, or through another plugin – that depends on whether emails should be protected automatically, manually, or if it should work both ways.
You will find complete source code on github; however, just to get you going, here is an example of the “Retrieve” code:
The plugin is running under the interactive user account in this case, so it’s running in the same security context. Which means if it can’t access “Secure Data” record through the lookup, it’ll fail, and, then, it’ll replace email body with a message advising the user to contact email owner for the details of that email.
And the rest of the plugin is more or less all about creating and managing that secure data record.
Have fun!
Awesome