2

I have the user user1 assigned to the profile profileA.

Profile profileA does not have create object permission on Account.

Inside text context, with Sytem.runas() method, I am able to make user1 create an Account.

But, if I try to create the Account using Workbench, I receive the expected error due the profile does not have create permission.

So, why it is possible to create under text context? would it be a bug?

1 Answer 1

1

System method runAs enables you to write test methods that change the user context to an existing user or a new user so that the user’s record sharing is enforced. The runAs method doesn’t enforce user permissions or field-level permissions, only record sharing.

Giving permission on object in profile comes under object sharing and runAs only consider record sharing.

Example Code:

@isTest 
private class testSEClass{

    private static testmethod void testSEClass(){

        List<User> users = new List<User>();
        Profile p = [SELECT Id FROM Profile WHERE Name like :'%' + 'std user clone' + '%' Limit 1];

        for (Integer k = 0; k < 50; k++) {

            users.add(new User(Alias = 'standt', Email = 'standarduser@testorg.com', 
                EmailEncodingKey = 'UTF-8', LastName = 'Testing', LanguageLocaleKey = 'en_US', 
                LocaleSidKey = 'en_US', ProfileId = p.Id, TimeZoneSidKey = 'America/Los_Angeles', 
                UserName = 'standarduser' + Math.random() + '@testorg.com'));
        }
        insert users;
        System.runAs(users[0]) {
            //This debug statement returns False.
            System.debug(Account.sObjectType.getDescribe().isAccessible());
            Account a = new Account(name='abcdsss');
            insert a;
            //It successfully inserts account record.
            System.debug(a.id);

        }

    }
}

I tried this code in with sharing mode as well, i got same results. You can externally apply DML checks to check whether any user has object and field level permissions or not.

Resource

4
  • So, would not be possible at all to test if some profiles can or cannot create certain records? Jul 18, 2018 at 11:18
  • 1
    @LeandroFerreiraFernandes Check my updated answer. You can apply DML checks to check if user has object and field level access or not.
    – Mr.Frodo
    Jul 18, 2018 at 12:19
  • Good point! Although we can test permission level on object and field, Salesforce still lacks a way to test permission on record level. For example, when a profile attempts to create a record of a specific recordType which is not assigned to it. Even if the profile has object permission, the DML will fail. Jul 18, 2018 at 15:26
  • 1
    @LeandroFerreiraFernandes For this you can check what record types are available to given user. Finding if which users have a record type available to them
    – Mr.Frodo
    Jul 18, 2018 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.