I am writing test case to check withdraw application function. It gives the following error on update application statement.

System.DmlException: Update failed. First exception on row 0 with id a1Hr0000001Y5M8EAK; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: []

Here is my controller class:

public class OnlineApplicationStatusController extends 

    App_BaseController { 

     public OnlineApplicationStatusController() {
        public Application__c application {get; set;}
        public Contact contact {get; set;}

        User currentUser = [SELECT contactId  FROM User WHERE Id = 
        System.debug(System.LoggingLevel.ERROR, 'Current user' + currentUser);

  if(String.isNotBlank(currentUser.ContactId)) {
             contact  = [


                FROM Contact
                WHERE Id = :currentUser.ContactId
                LIMIT 1

            System.debug(System.LoggingLevel.ERROR, 'contact information: ' + contact );

   application = [

                        SELECT Id, Contact__c,Application_Status__c

                        FROM Application__c 
                        WHERE Contact__c =: currentUser.contactId
                        LIMIT 1];

           System.debug(System.LoggingLevel.ERROR, 'application details ' + application );


public pagereference withdrawapplication() {
           PageReference pr = null;
           pr = Page.withdrawapplication;
           pr.getParameters().put('appId', application.Id);
           application.Application_Status__c = 'withdrawn';

           //Here is the problem
           update application;
           return pr;


Here is my test class:


  public with sharing class ApplicationStatusControllerTest {
  @isTest static void saveAndContinue_Test() {

      Profile ownerProfile = [select id from profile where name='System Administrator']; 
    UserRole ownerRole = [SELECT id from UserRole where name = 'Admin'];
    User ALOProfile= [SELECT id,ProfileId, name, phone, email  from User where name = 'ALO Test02'];

    User ownerUser = new User();
      ownerUser.firstname      ='James';
      ownerUser.lastname      ='Dobb';
      ownerUser.email         ='[email protected]';
      ownerUser.username      ='[email protected]';
      ownerUser.alias        ='asdddsdf';
      ownerUser.TimeZoneSidKey  ='GMT';
      ownerUser.LocaleSidKey    ='en_US';
      ownerUser.emailencodingkey  ='UTF-8';
      ownerUser.languagelocalekey  ='en_US';
      ownerUser.ProfileId     = ownerProfile.Id;
      ownerUser.userroleid     = ownerRole.Id;
      insert ownerUser;
      system.debug('owner user' + ownerUser);

    User counselor = new User();
      counselor.lastname ='01';
      counselor.email='[email protected]';
      counselor.username      ='[email protected]';
      counselor.alias        ='abcdef';
      counselor.TimeZoneSidKey  ='GMT';
      counselor.LocaleSidKey    ='en_US';
      counselor.emailencodingkey  ='UTF-8';
      counselor.languagelocalekey  ='en_US';
      counselor.ProfileId     = ownerProfile.Id;

    User liasion = new User();
      liasion.lastname ='Test01';
      liasion.email='[email protected]';
      liasion.username      ='[email protected]';
      liasion.alias        ='ghijkl';
      liasion.TimeZoneSidKey  ='GMT';
      liasion.LocaleSidKey    ='en_US';
      liasion.emailencodingkey  ='UTF-8';
      liasion.languagelocalekey  ='en_US';
      liasion.ProfileId     = ALOProfile.ProfileId; 


      insert counselor;
      system.debug('counselor' + counselor);



      insert liasion;
      system.debug('liasion' + liasion); 


    Contact contact   = new Contact(); 
    contact.firstName = 'Scott';
    contact.lastName  = 'Petey';
    contact.email     = '[email protected]';
    contact.Owner= counselor;
    //contact.ALO__c= ALOProfile.Id;

      insert contact;
      system.debug('contact' + contact);

    Application__c application= new Application__c();
    application.Contact__c = contact.Id;


      insert application;
      system.debug('application' + application);

    Profile pr = [select id from profile where name='Community Login User']; 
    User u = new User();
      u.firstname      ='James';
      u.lastname      ='Dobb';
      u.email         ='[email protected]';
      u.username      ='[email protected]';
      u.alias        ='asdfasdf';
      u.TimeZoneSidKey  ='GMT';
      u.LocaleSidKey    ='en_US';
      u.emailencodingkey  ='UTF-8';
      u.languagelocalekey  ='en_US';
      u.ProfileId     = pr.Id;
      u.contactId =contact.id;
    insert u;

    system.debug('community user' + u);


      OnlineApplicationStatusController controllerClass = new 
       ApexPages.currentPage().getParameters().put('appId', application.Id);

       // Here is the problem




NOTE: Community User do have the read and edit permission on application object

1 Answer 1


You are trying to have one user (u) update an Application__c record owned by another user (ownerUser) in a test that's executing with sharing. If your Organization-Wide Default on Application__c is Private or Read Only, this is expected behavior, because your class is explicitly asking Salesforce to enforce these sharing rules.

That error is not related to Field-Level Security (CRUD permissions); it's exclusively about sharing (record-level security).

Additionally, you should absolutely remove SeeAllData=true from your class. That annotation is poor practice, makes your tests fragile to changes in org data, and can result in difficult-to-debug issues.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .