As the title states, can describe information be trusted for the site guest user?
I want to be able to insert/update tasks against accounts via a public Apex webservice. Yes, I'm aware of the concerns here, but it's for an integration with another service that relies on a webhooks type setup, i.e. it'll issue a GET to a URL and there's no authentication options supported. I'm locking down site guest user access to specific IPs and using a token to verify requests as much as I can.
- I grant Site guest profile read access to accounts so that the correct account can be identified
- FLS for Tasks is configured appropriately — Read/Edit at the object level is not available for this profile
- Using field describe tokens I check what fields are updatable/creatable and only fill in those that I have access to
- I end up with tasks with nothing filled in, but owned by the site guest user
Access to the tasks themselves is determined by the polymorphic MD relationship, so outside of the context of a record security is a bit confusing.
Debug logs (yay, we can now log site guest user access without cookies again!) confirm, that none of the fields report as creatable or editable regardless of FLS settings. These are a conglomerate of object level access and FLS though, so perhaps the former is where the issues are.
Prior to me checking whether the user has access I just wrote to the fields and it worked, so...
Detailed Version of the Question
Is the field describe information incorrect for the Task (activity) object when evaluating for a site guest user, and should I just skip these checks for the guest user type ?