FLS check in 2GP

Question

I've created a new 2GP package. Since it is going to be released to AppExchange, I've implemented a generic CRUD and FLS check for every place I contact with the Database in my Apex code.

e.g.

MyAwsomeObject.getDescribe().isUpdateable();
MyAwesomeField.getDescribe().isUpdateable();

I build a new package version with -c key for Apex test coverage, but the tests fail due to FLS permission checks. CRUD checks pass just fine.

From the documentation, 2GP build goes this way:

1. A new inaccessible scratch org is created.
2. Metadata is pushed to the scratch org.
3. Tests run.
4. The post-install script runs.

So I don't see a way to assign FLS permissions to the user on behalf of who the tests are running.

Building a package without -c or without FLS checks works perfectly.

Is there a way to overcome this FLS check, give FLS access to the running user or any other solution?

Answer 1

So in Apex Tests, you can use the RunAs feature to do this - basically, create a user in the test, assign a basic profile (the new Minimum Access one is helpful for this), and then assign the permission set, and run the test e.g.

Profile p = [SELECT Id FROM Profile WHERE Name = 'Minimum Access - Salesforce '];

User u = new User(Alias = 'standt', Email = '[email protected]',
EmailEncodingKey = 'UTF-8', LastName = 'Testing', LanguageLocaleKey = 'en_US', LocaleSidKey = 'en_US', ProfileId = p.Id,
TimeZoneSidKey = 'America/Los_Angeles', UserName = '[email protected]');

insert u;

PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = 'My Permission Set'];
insert new PermissionSetAssignment(AssigneeId = u.id, PermissionSetId = ps.Id);

But - this assumes you are including the Perm Set in the package. If not, you'll probably need to wait for this new feature (or apply to pilot) which will let you include non=packaged metadata in the package creation process when it builds the scratch org.