Unit Test for Record Sharing in Controller Extensions

Question

I would like to assert that User B cannot access a record that User A had created from a visualforce page.

The problem is I can't seem to throw the same exception a user would normally see when navigating through the UI.

My controller and test class seem straightforward to me.

Controller

public with sharing class SampleController {
    public SampleController(ApexPages.StandardController stdController) {
        ...
    }   
}

Test Class

@isTest
public class TestClass {

    static testMethod void test_sharing() {
        Account account1;

        system.runAs(getUserA()) {
            account1 = new Account();
            insert account1;
        }

        system.runAs(getUserB()) {
            try {
                SampleController controller 
                    = new SampleController( 
                        new ApexPages.StandardController(account1) ); 

                system.assert(false, 'Did not throw');
            }           
            catch (Exception e) {
                system.assert(true);
            }
        }       
    }   
}

Answer 1

See this post. Sharing is enforced when querying records (via SOQL). It doesn't prevent references to records from being passed around.

The error your user sees has nothing to do with your controller extension. It's thrown by the Visualforce framework itself when it queries based on the ID in the url to determine what account to create the StandardController with. That always respects sharing.

Answer 2

It doesn't look like you are accessing the record that User A has created, you are only accessing the SObject variable that you created in your test class, which is available to anything within test_sharing(). Wouldn't you want to try querying the record to see if User B has access to it?

Something like this:

@isTest
public class TestClass {

    static testMethod void test_sharing() {
        Account account1;

        system.runAs(getUserA()) {
            account1 = new Account();
            insert account1;
        }

        system.runAs(getUserB()) {
            try {
                Account queryAccount = [Select Id From Account where Id = account1.Id LIMIT 1];

                SampleController controller 
                    = new SampleController( 
                        new ApexPages.StandardController(queryAccount) ); 

                system.assert(false, 'Did not throw');
            }           
            catch (Exception e) {
                system.assert(true);
            }
        }       
    }   
}