Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I'm trying to test user profile which don't have create access to create certain custom objects, even though the profile is setup such that they have read only or NO access at all, but the unit test code is creating the record without any issues. I'm doing the following ex: System.runas(profile).

I found in other thread, CRUD/FLS is used for VF or API Request only

Any thoughts or suggestions?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

From the documentation Using the runAs Method:

The runAs method doesn’t enforce user permissions or field-level permissions, only record sharing.

Try using Schema.DescribeSObjectResult to check the user level access to SObjects and Schema.DescribeFieldResult for the field level access.

share|improve this answer
    
Thanks I want to confirm this behavior. –  realnumber May 12 at 0:41

Additionally:

  • The sharing keyword on a class only affects sharing. It does not affect CRUD or FLS.
  • With the sole exception of ExecuteAnonymous, Apex code does not enforce CRUD or FLS - you must manually interrogate object and field accessibility.

To assert in code that a user profile does not have create access, you need something like:

static testmethod void testCrudSecurity() {
    //build user with appropriate profile
    System.runAs(user) {
        System.assert(!SObjectType.Account.isCreateable());
    }
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.