Our internal users are using Notes to add comments to a funding request. We would like to keep these notes internal and prevent portal users from viewing them.
The communityFileList component is managed by Grants Management. Is there a way to configure the component so that Notes are not displayed to portal users?
#Grants Management #Grants Administration & Evaluation #NPSP Admins #NPSP
As far as I know, the managed communityFileList component in Grants Management does not expose a setting to exclude Notes, so the practical way to handle this is at the data/visibility level rather than in the component.
Some background that helps here: Lightning (enhanced) Notes are stored as Salesforce Files. Each note is a ContentNote/ContentDocument with FileType = 'SNOTE', and it is linked to the Funding Request through a ContentDocumentLink record, exactly like an uploaded file. That is why a file list component picks them up. Whether an external (portal) user can see a linked file or note is controlled by ContentDocumentLink.Visibility: 'AllUsers' means external users with access to the record can see it, 'InternalUsers' means only internal users can.
Options, from least to most effort:
1. Check the component and the note visibility first. In Experience Builder, open the page with the file list and review the component properties (some versions let you filter by file type or related record). Then on a test note, check its ContentDocumentLink Visibility (for example via Developer Console: SELECT Id, ContentDocument.FileType, Visibility FROM ContentDocumentLink WHERE LinkedEntityId = '<FundingRequestId>'). If notes show as AllUsers, that is the root cause.
2. Automatically make notes internal-only. A small before-insert Apex trigger on ContentDocumentLink can set Visibility = 'InternalUsers' when the linked record is a FundingRequest and the ContentDocument FileType is 'SNOTE'. Existing notes can be fixed with a one-off update of Visibility on their ContentDocumentLink records (Visibility is updatable). Test that the portal still shows the applicant's own uploaded files, which should remain AllUsers.
3. Use a different place for internal comments. If you want a clean separation, capture internal comments on a record/object that portal users have no access to (for example a custom Internal Review Note object or a long text field hidden from the portal profile via field-level security), or use internal-only Chatter posts.
4. If the managed component ignores visibility (for example because it runs in system context), replace it on the portal page with a small custom LWC or a Related List component that only shows files where FileType != 'SNOTE'.
Useful references:
File Visibility and Sharing in Experience Cloud Sites:
https://help.salesforce.com/s/articleView?id=experience.networks_files_visibility_and_sharing.htm&type=5Work with Files in Your Experience Cloud Site:
https://help.salesforce.com/s/articleView?id=experience.networks_files_in_communities.htm&type=5ContentDocumentLink object reference (Visibility field):
https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_contentdocumentlink.htmGrants Management documentation:
https://help.salesforce.com/s/articleView?id=sfdo.Grants_Management.htm&type=5Assumption: I could not find official documentation describing configurable properties of the managed communityFileList component, so I am assuming it respects ContentDocumentLink visibility and the portal user's access. Please validate the approach in a sandbox with a portal test user before rolling it out, and consider raising a case with Salesforce Support if the component shows internal-only notes regardless of visibility.
