2

I have the user user1 assigned to the profile profileA.

Profile profileA does not have create object permission on Account.

Inside text context, with Sytem.runas() method, I am able to make user1 create an Account.

But, if I try to create the Account using Workbench, I receive the expected error due the profile does not have create permission.

So, why it is possible to create under text context? would it be a bug?

Improve this question

1 Answer 1

Reset to default
1

System method runAs enables you to write test methods that change the user context to an existing user or a new user so that the user’s record sharing is enforced. The runAs method doesn’t enforce user permissions or field-level permissions, only record sharing.

Giving permission on object in profile comes under object sharing and runAs only consider record sharing.

Example Code:

@isTest 
private class testSEClass{

    private static testmethod void testSEClass(){

        List<User> users = new List<User>();
        Profile p = [SELECT Id FROM Profile WHERE Name like :'%' + 'std user clone' + '%' Limit 1];

        for (Integer k = 0; k < 50; k++) {

            users.add(new User(Alias = 'standt', Email = '[email protected]', 
                EmailEncodingKey = 'UTF-8', LastName = 'Testing', LanguageLocaleKey = 'en_US', 
                LocaleSidKey = 'en_US', ProfileId = p.Id, TimeZoneSidKey = 'America/Los_Angeles', 
                UserName = 'standarduser' + Math.random() + '@testorg.com'));
        }
        insert users;
        System.runAs(users[0]) {
            //This debug statement returns False.
            System.debug(Account.sObjectType.getDescribe().isAccessible());
            Account a = new Account(name='abcdsss');
            insert a;
            //It successfully inserts account record.
            System.debug(a.id);

        }

    }
}

I tried this code in with sharing mode as well, i got same results. You can externally apply DML checks to check whether any user has object and field level permissions or not.

Resource

Improve this answer
4
  • So, would not be possible at all to test if some profiles can or cannot create certain records?
    – Leandro Ferreira Fernandes
    Commented Jul 18, 2018 at 11:18
  • 1
    @LeandroFerreiraFernandes Check my updated answer. You can apply DML checks to check if user has object and field level access or not.
    – Mr.Frodo
    Commented Jul 18, 2018 at 12:19
  • Good point! Although we can test permission level on object and field, Salesforce still lacks a way to test permission on record level. For example, when a profile attempts to create a record of a specific recordType which is not assigned to it. Even if the profile has object permission, the DML will fail.
    – Leandro Ferreira Fernandes
    Commented Jul 18, 2018 at 15:26
  • 1
    @LeandroFerreiraFernandes For this you can check what record types are available to given user. Finding if which users have a record type available to them
    – Mr.Frodo
    Commented Jul 18, 2018 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .