Is Describe Information Accurate for the Site Guest User?

Question

As the title states, can describe information be trusted for the site guest user?

Scenario

I want to be able to insert/update tasks against accounts via a public Apex webservice. Yes, I'm aware of the concerns here, but it's for an integration with another service that relies on a webhooks type setup, i.e. it'll issue a GET to a URL and there's no authentication options supported. I'm locking down site guest user access to specific IPs and using a token to verify requests as much as I can.

Setup

1. I grant Site guest profile read access to accounts so that the correct account can be identified
2. FLS for Tasks is configured appropriately — Read/Edit at the object level is not available for this profile
3. Using field describe tokens I check what fields are updatable/creatable and only fill in those that I have access to
4. I end up with tasks with nothing filled in, but owned by the site guest user

Thoughts

Access to the tasks themselves is determined by the polymorphic MD relationship, so outside of the context of a record security is a bit confusing.

Debug logs (yay, we can now log site guest user access without cookies again!) confirm, that none of the fields report as creatable or editable regardless of FLS settings. These are a conglomerate of object level access and FLS though, so perhaps the former is where the issues are.

Prior to me checking whether the user has access I just wrote to the fields and it worked, so...

Detailed Version of the Question

Is the field describe information incorrect for the Task (activity) object when evaluating for a site guest user, and should I just skip these checks for the guest user type ?

Answer 1

If the other system will support it, you may want to look at using Platform Events for this instead. The event handler (trigger) will run in system mode, so no need to worry about the Guest User permissions. Take a look:

Salesforce Platform Events Developer Guide