7

I am checking for field accessibility of an User u whose Profile is p in apex Test class.To this profile field level security is set to Hidden for the field team_name__c.When I run as this user using runAs() method, and check the field accessibility as below, it returns false. 

System.runAs(u){
system.debug('Accessible---> '+Schema.SObjectType.MyCustomObject__c.fields.team_Name__c.isAccessible());
//prints false
}

But according to the doc

The system method runAs enables you to write test methods that change the user context to an existing user or a new user so that the user’s record sharing is enforced. The runAs method doesn’t enforce user permissions or field-level permissions, only record sharing.

Which means field should have been accessible to the User within runAs() method as it doesn't enforce field level permissions.Please correct me if my understanding is wrong.

|improve this question|||||
  • Can you show us more code? Are you double sure the user have right profile? Also did you checked if this profile/user have anything that could oweride this access level? – Artur Kępczyński Mar 28 '14 at 8:04
  • @ArturKępczyński As I mentioned in my question the profile assigned to user has visibility Hidden to the field. – codebandit Mar 28 '14 at 8:26
  • @ArturKępczyński:regarding more code,I am just setting up User and Profile objects and nothing else. – codebandit Mar 28 '14 at 8:29
  • 1
    Some ancient history about platform bugs in this area developer.salesforce.com/forums?id=906F00000008xv9IAA. Later in the thread FLS problems are mentioned, and it sounds like the intention is that System.runAs should allow FLS to be tested. – Keith C Mar 28 '14 at 9:23
  • 1
    That is how I read it, but those (the field level ones) are not comments from salesforce people so it is not definitive. And it sounds like the object-level bug (caching across test methods) may have been present in the field level case too and that may or may not have been fixed. Hopefully someone will answer your question with solid information about what they see today in the platform. – Keith C Mar 28 '14 at 9:50
5

Apex will not enforce CRUD and FLS no matter what you do -- but you can test for CRUD and FLS using the method you documented in your code sample.

You must write your own handling code to 'gracefully degrade' your app should the running user not have the appropriate (read, create, update, delete) on the object or field within the object.

I'm sure you've read these docs a dozen times, but I'm posting it here for completeness of the answer:

https://developer.salesforce.com/page/Testing_CRUD_and_FLS_Enforcement

https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS

developers should consider having graceful degradation within their applications if appropriate for their design.

|improve this answer|||||
  • Nice answer! Note the exception of ExecAnon, which enforces CRUD and FLS :-) – bigassforce May 28 '14 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.