Sharing rule does not expand permissions for specified group members

Question

I have a custom object called Banner that I'd like to allow portal users to view and portal administrators to create/edit all records. Currently the admin can create, edit, delete their own records, but not others. I have setup a sharing rule with that should allow members of the "VMS admin" public group Read/Write access, but it doesn't appear to be working.

How do I share all records of a certain type with a particular user/group/or permission set?

Here's my configuration:

The user, VMS admin is assigned the "Employee Portal Approval" profile and is assigned to the VMS Admin public group. The Employee Portal Approval profile has a Customer Community Plus license with CRUD permission on their own banner records.

The Banner object,

• OWD are set to Internal Public Read Only, External Public Read Only
• Sharing Rules allow members of the VMS admin group Read/Write access on records with certain field values.

The following is an apex test class. The adminCanEdit method fails with the error, "INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id"

    //Test 3 - VMS admin can add banners
    @isTest
    public static void adminCanCreateEdit(){
        //vmsAdmin_user belongs to the public group "VMS admins"
        User vmsAdmin_user = [SELECT Id from User WHERE username='[email protected]' LIMIT 1];

        Test.startTest();
        System.runAs(vmsAdmin_user){
            Banner__c b1 = new Banner__c(
                application__c = 'vms',
                Title__c = 'test3-11232jkljf',
                Message__c = 'Test insert record on test3-11232jkljf',
                Start_Date__c = Date.newInstance(2022, 3, 3),
                End_Date__c = Date.newInstance(2022, 12, 9)
            );
            insert b1;
            b1.Message__c = 'The VMS admin can change their own banner';
            update b1;
        }
        Test.stopTest();
        
        List<Banner__c> result = [SELECT Id, Message__c, application__c, Start_Date__c FROM Banner__c WHERE Title__c = 'test3-11232jkljf'];
        System.debug(result);
        System.assertEquals(1, result.size(), 'could not find one record');
        
    }

    //Test 4 - VMS admin can update banners
    @isTest
    public static void adminCanEdit(){
        User vmsAdmin_user = [SELECT Id from User WHERE username='[email protected]' LIMIT 1];
        String newMessage = 'The VMS admin should be able to update this banner.';


        Test.startTest();
        System.runAs(vmsAdmin_user){
            List<Banner__c> t4result = [SELECT Id, Message__c, application__c, Title__c FROM Banner__c WHERE Title__c = 'Banner1'];
            t4result[0].Message__c = newMessage;
            
            update t4result;
        }
        Test.stopTest();
        
        List<Banner__c> result = [SELECT Id, Message__c, application__c, Start_Date__c FROM Banner__c WHERE Title__c = 'Banner1'];
        System.debug(result[0]);
        System.assertEquals(newMessage, result[0].Message__c, 'The message was not updated.');
    }

Similar question, but not quite... Sharing Rule is not granting access to a public group

Answer 1

Are you running into the same problem with functional tests?

Unfortunately, criteria-based sharing rules do not apply in a unit test context. OWD Sharing Settings do apply in tests, however.

To work around this in your tests, you may have to create a manual share record as part of the test to imitate the expected access from the sharing rule.