Preventing access to detail records using CRUD

Question

I have a custom object B that has a master detail relationship to Account. The sharing settings on Account are set to Private. Account CRUD for sys admin and user 1 is create, edit, view, delete. The CRUD on B for the system admin is create, edit, view, delete. The CRUD for user 1 is nothing.

I have a test case that creates an Account in a @testSetup method. In the test case, the code retrieves the account and does a System.runAs(sysadmin) and creates an object of B. Then I have second System.runAs(user1) that simply tries to retrieve the object B. This should fail. In one sandbox it DOES fail. In another sandbox it does NOT fail and I cannot explain it.

@testSetup
public static void setupTests() {
    User u1 = TestDataFactory.createUser(USERNAME_1, ACCT_MGMR);
    User sysadmin = TestDataFactory.createUser(USERNAME_SYSADMIN, SYSTEM_ADMIN);

    Account acc = TestDataFactory.buildAccount(ACCOUNT_NAME);
    insert acc;
}

public static testMethod void testCRUD() {
      User u1 = [SELECT id FROM User WHERE username = :USERNAME_1];
      User sysadmin = [SELECT id FROM User WHERE username = :USERNAME_SYSADMIN];
      Account account = [SELECT id FROM Account where name = :ACCOUNT_NAME];

  MyObjectB__c objB = null;
  System.runAs(sysadmin) {
    objB = new MyObjectB__c(
      Account__c = account.Id,
      user__c = u1.id);
    insert objB;
  }

  System.runAs(u1) {
    try {
      objB = [SELECT Id FROM MyObjectB__c WHERE Account__c =
        :account.Id AND User__c = :u1.id];
      System.assert(false, 'Should have failed.');
    } catch (QueryException dmle) {
      System.assert(true, 'Should fail here. ' + dmle.getMessage());
    }
  }
}

Answer 1

Looks like the issue is that Apex does not respect CRUD.

https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS

https://developer.salesforce.com/page/Testing_CRUD_and_FLS_Enforcement

I would have to use something to effect of:

if (!Schema.sObjectType.Contact.fields.Status__c.isUpdateable()){
  ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL,
                                             'Insufficient access to update status'));
  return null;
}