CRUD/FLS Enforcement: how to add isAccessible() to the test class for code coverage

Question

I received the result from security review from Salesforce team and it failed. One of the vulnerability shown in the report was CRUD/FLS Enforcement. The report suggest I use the isAccessible() check before accessing data.

I have a controller that does look up on Contact, Account, and Task object. I added the isAccessible check before selecting from the object. Here is one of the method from the controller (after I added isAccessible check)

public String getAllContacts(){
    // Check if the user has read access on the Contact fields
    if (!Schema.sObjectType.Contact.fields.id.isAccessible() &&
        !Schema.sObjectType.Contact.fields.phone.isAccessible() &&
        !Schema.sObjectType.Contact.fields.firstname.isAccessible() &&
        !Schema.sObjectType.Contact.fields.lastname.isAccessible())
    {
      return '';
    }

    allContactList = [SELECT id, phone, firstname, lastname FROM Contact LIMIT 200];
    return JSON.serialize(allContactList);        
}

After adding the check, my code coverage went down to 63%. And I think it is because of the if statement.

How can I include the check for isAccessible in my test class to increase my code coverage?

Here is my test class:

@isTest
public class SoftphoneSearchController_test {
    public static testMethod void validateSoftphoneController() {            
       Test.startTest();     
        SoftphoneSearchController objSoftphone = new SoftphoneSearchController();
        list<SoftphoneSearchController> SoftList = new list<SoftphoneSearchController>();
        String name = 'Jon';
        objSoftPhone.contactName = 'Snow';
        objSoftPhone.accountName = 'United';
        objSoftPhone.phoneNumber='5556667778';            

        list<Contact> ct=new list<Contact>();
        objSoftphone.contactList=ct;
        list<Account> Ac=new list<Account>();
        objSoftphone.accountList=Ac;
        list<task> T=new list<task>();
        objSoftphone.commentList=T;
        list<task> Ta=new list<task>();
        objSoftphone.allCommentList=Ta;
        objSoftphone.getAllComments();
        objSoftphone.getAllContacts();
        objSoftphone.getCurrentUserID();
        //objSoftPhone.searchAccounts();
        objSoftPhone.getContactByName(name);    
        objSoftPhone.getContact('1112223333');
        objSoftPhone.getCommentByParam('12345');

        SoftList.add(objSoftPhone);
        //insert SoftList;
        System.assert(SoftList.size() > 0);

      Test.stopTest();
    }


}

Currently my code coverage is at 63%. Please advise how can I increase my code coverage.

I have looked at

• https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS
• https://developer.salesforce.com/page/Testing_CRUD_and_FLS_Enforcement

These article doesn't have what I am looking for.

Thank you

Answer 1

You need to have 2 profiles, one with accessible to all those fields and other will not have access to those fields.

Now, create users based on those profiles and run the testmethods with System.runAs(user)

public static testMethod void testRunAs() {
      // Setup test data
      // This code runs as the system user
      Profile p = [SELECT Id FROM Profile WHERE Name='Standard User']; 
      User u = new User(Alias = 'standt', Email='[email protected]', 
      EmailEncodingKey='UTF-8', LastName='Testing', LanguageLocaleKey='en_US', 
      LocaleSidKey='en_US', ProfileId = p.Id, 
      TimeZoneSidKey='America/Los_Angeles', UserName='[email protected]');

      System.runAs(u) {
         // The following code runs as user 'u' 
         System.debug('Current User: ' + UserInfo.getUserName());
         System.debug('Current Profile: ' + UserInfo.getProfileId()); 
      }
   }