6

I am writing a fluent query builder which I hope will pass security review, and I still have a few nagging questions. I will refrain from asking more than one question per question, so right now, what I would like to know is:

If a user can access a given SObjectType, is it guaranteed they can access its Id field?

In other words, if we know:

someSObjectType.getDescribe().isAccessible()

is it then guaranteed that:

someSObjectType.getDescribe().fields.getMap().get('Id').getDescribe().isAccessible() 

It seems like it should be the case, but I'm not 100% certain and haven't yet been able to find any concrete confirmation in writing. The reason I want to know is that one of the steps filters out every field which is not accessible from the SELECT clause, and then if there are none left, I add back in Id.

  • 1
    I would think so as you cannot set fls for the id but can't provide docs. Just my 2 cents – Eric May 6 '17 at 15:35
  • @Eric Yeah that's where I'm at as well. It seems like a reasonable inference but I would like certainty. – Adrian Larson May 6 '17 at 15:38
  • I don't remember where I read it, but non-aggregate SOQL queries implicitly include the ID field (and after some testing, it looks like the RecordTypeID field as well) even if it isn't on the field list. This isn't a definite answer but it seems to suggest anyone with access to an object is intended to be able to view it's ID and RecordTypeID. – IllusiveBrian May 6 '17 at 15:58
  • As a comment, I'd say that I have answered questions about objects with non-unique/missing Id fields, but it'd take me a decent amount of data mining to find the answer of the thousands I've written. – sfdcfox May 6 '17 at 16:00
  • 1
    @AdrianLarson The ID is also implicitly accessible if the person can access the record's detail page, since it's in the URL. – IllusiveBrian May 6 '17 at 16:05
3

All records that you can view in the UI should have an Id, because that's how they're displayed and referenced in the database. There are actually a small handful of objects that either do not have an Id (you can query the field but all values will be null), do not have a unique Id (e.g. the Id field will contain duplicates), or do not have an Id field you can query.

Generally speaking, if you can find the object in the Salesforce documentation, it will have an Id field that is non-null and unique. I have a nagging memory I can't quite place that there may be one or two objects that are documented that don't have an Id, but I can't seem to find them at the moment; virtually every object you use on a daily basis has an Id. The Salesforce WSDL "guarantees" that sObject types have an Id, as the base sObject type in the WSDL has Id defined.

Other objects that we can discover through describe calls, key prefix scanning, etc, may or may not have an Id field, or have non-unique Id values. One such object is the ApexPageInfo object, which is undocumented, may be queried and described, and all records we query have the null Id 000000000000000AAA.

I have occasionally run across other objects that exhibit odd behavior, like refusing to be described, having literally no fields, or other oddities. However, as long as you're limiting yourself to objects that appear in Schema.getGlobalDescribe(), the records should have an Id field that is visible, queryable, not-null, and unique.

If you allow the user to type in any random string instead, a user might stumble across an object that is outside the documentation, and thus subject to unusual behavior.

  • You don't really touch on objects which do have an Id field. Is there something more definitive there? – Adrian Larson May 6 '17 at 16:02
  • 1
    @AdrianLarson Took me a bit, but I found an example of an "odd" object. It seems that anything in the documentation should have an Id, but if you start digging into hidden objects, you'll find some gems that will annoy you. – sfdcfox May 6 '17 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.