Bug in UserRecordAccess and system.RunAs in test methods

Question

Trying to develop some test classes around security and noticed this issue and was curious if anyone else has found this, is it a bug, and have you been able to work around it within the system.runAs in the test methods:

ISSUE:

In test methods when getting the userrecordaccess.maxaccesslevel for ANY record to which the running user only has READ access, the MAXACCESSLEVEL ALWAYS returs 'Transfer'.

This is NOT the case though as the user should only have read access.

Steps to recreate:

1. Create a record to which a user only has READ access.
2. Replace the IDs in the below pseudo code with the user id and record id as appropriate
3. You will see that calling the UserRecordAccess using the userid and recorded outside of the runAs produces the 'Read' result
4. Inside the runAs the result is 'Transfer' and the assertion fails (and yes actually querying the userrecordaccess produces the same 'Transfer' result)

@isTest(SEEALLDATA = TRUE)
private static void test_one(){

    User popAdmin = [Select ID From User Where ID = '005F0000003GluW'];

        UserRecordAccess ura = [Select RecordID, MaxAccessLevel From UserRecordAccess Where UserID = '005F0000003GluW' AND RecordID = '003L000000Lb1cF'];
        system.assertEquals('Read',ura.MaxAccessLevel);


    system.runAs(popAdmin){

        contact c = [Select UserRecordAccess.MaxAccessLevel From Contact Where ID = '003L000000Lb1cF'];
        system.assertEquals('Read',c.UserRecordAccess.MaxAccessLevel);

    }

}

I fail to see why the MAXACCESSLEVEL is being returned as 'Transfer' using the new MaxAccessLevel in the record Query ran inside the runAs block. I am curious to know if this is a bug or is running as expected

Answer 1

Here is the Response from Salesforce Support. I did not realize this being the case...

Correct way to query - SELECT MaxAccessLevel,RecordId FROM UserRecordAccess WHERE RecordId = '003D000000PUnOo' AND UserId = '005D0000001mYlT'

AND NOT SELECT UserRecordAccess.MaxAccessLevel FROM Contact Where ID = '003D000000PUnOo' -> Here you are actually asking the system that whats the max access level on this record and it's saying 'Transfer' which is correct. It doesn't mean that "transfer' is the max access level for the current user. It means "transfer" is the max access level for that contact record.

If you want to find the max level access for that user on that contact record you need to query- SELECT MaxAccessLevel, RecordId FROM UserRecordAccess WHERE RecordId = '003D000000PUnOo' AND UserId = '005D0000001mYlT' -> this says Read is the maximum access level for the given user.

5-30-2014

Here is a link to the bug that salesforce has initiated. If this is happening to you as well click the link and then click the "This Affects Me" button

https://success.salesforce.com/issues_view?id=a1p30000000T4NxAAK