# Sample test for testing FLS/CRUD

I'm trying to understand FLS/CRUD permissions using a simple test. I have created a user and assigned a no-update,no-delete,no-create permission set on that. In my test I'm trying to run as this new user, but I still see that the object gets updated and the field is updateable. Am I missing something here?

Here is the code:

@isTest
public class sampletest {

static User createuser(){
Profile p = [SELECT Id FROM Profile WHERE Name='Standard User'];
User newuser = new User(Alias = username, Email='u1@testorg.com',
EmailEncodingKey='UTF-8',lastname='Testing',
LanguageLocaleKey='en_US',LocaleSidKey='en_US',
ProfileId = p.Id,  Country='United States',
+ Datetime.now().hour() + Datetime.now().minute()
+ Datetime.now().second() +'@testorg.com');
insert newuser;
system.debug('Creating user: ' + newuser.id);
return newuser;
}

static testmethod void method1(){
User newuser = createUser();
System.runAs(newuser){

String[] strfields = new String[] {'Company', 'FirstName'};
Map<String, Schema.SObjectField> fields = objType.getDescribe().fields.getMap();
system.debug('Fields: ' + fields );

for (String strfield : strfields) {
if(fields.get(strfield).getDescribe().isUpdateable()){
system.debug('Field ' + strfield + ' is updateable');
}
}
}
}

private static void assignObjectPermission(User u, String objectType, Boolean create, Boolean edit, Boolean remove){
PermissionSet ps = new PermissionSet(Name = 'Enable' + objectType, Label = 'Enable ' + objectType);
insert ps;

ObjectPermissions oPerm = new ObjectPermissions(ParentId = ps.Id,
PermissionsCreate = create,
PermissionsEdit = edit,
PermissionsDelete = remove,
SObjectType = objectType);

insert oPerm;
system.debug('permission: ' + oPerm);

PermissionSetAssignment assign = new PermissionSetAssignment(AssigneeId = u.Id, PermissionSetId = ps.Id);
insert assign;
system.debug('assign: ' + assign);
}
}


I see the following logs and upsert is successful:

20:20:46:838 USER_DEBUG [34]|DEBUG|Field FirstName is updateable
20:20:46:838 USER_DEBUG [34]|DEBUG|Field Company is updateable


"Standard User" is the profile which you have assigned to your user.

And if we check lead permission on that then

We found that they already have create and update permission for lead. Using permission set we can't restrict user's permission we can only enhance them.

So if your permission set doesn't allow the lead reate and update still user can update it because there profile allow to do so. If you want to check this then first remove this permission from there profile and then test it.

You can read in more detail about permission set in given reference.

Permission Set Reference

• Thanks I wasn't aware that you cannot restrict user permissions using permission sets. I changed that to a read only user and I get the expected output. However, I still see that the upsert lead went through even though it is running as the newUser. Is that expected behavior? – gerad26 Jan 17 '17 at 7:06
• @gerad26 you need to check object level permission. – Tushar Sharma Jan 17 '17 at 7:12