3

I have a special requirement to protect a custom object from admins modifying through all channels like API, workbench, standard platform feature etc but should be able to view through all channels but update the custom object through a particular VF page only. I can't use without sharing keyword since it will let them see all records of custom object which also is violation visibility, not all admins can all records but only relevant to them. There will be sharing rule to share specific records with each admin.

  1. Currently I'm thinking about creating special user and use System.runas in regular apex controller to execute the code as special user solve this problem (non test mode), wondering this will work or not?

or

  1. Simple trigger preventing all DML and control that trigger through static variable to execute only when an update made from VF Page

Thanks

Improve this question
1
  • Daniels answer is correct, but if you simply don't allow updates on the object for all users, they will still be able to use the VF page to update the record. You cannot use <apex:inputField> elements though, you have to create variables in your class and assign them to the SObject fields in a custom save method. [EDIT; I just noticed that this is a 3 year old question...]
    – user254875486
    Aug 15, 2018 at 19:36

1 Answer 1

Reset to default
6

The official line for System.runAs is:

You can use runAs only in test methods
Using the runAs Method

So to your direct question of will it work. No, it will not for production code outside of a test context.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .