[SalesForce] CRUD and FLS enforcement

I have an Account list and I want to update it.

I want to testing object and field level security enforcement but I'm wondering what I have to test :

1 – if Account object is updatable ? (if it's possible)

2 – if the fields in my select query is updatable ?

3 – only if the Account Name is updatable ?

Here the code for these three propositions :

List<Account> acc = [SELECT Id, Name, BillingStreet FROM Account];
...
// 1 : I don't know if it's possible to test if an object is updatable ?

// 2 : test all the fields in the select query
if (!Schema.sObjectType.Account.fields.Name.isUpdateable() && !Schema.sObjectType.Account.fields.BillingStreet.isUpdateable() ){
    update acc;
}

// 3 : test only the Name
if (!Schema.sObjectType.Account.fields.Name.isUpdateable()){
    update acc;
}

Best Answer

So

  1. Yes its of course possible you can do it in two ways (which essentialy are the same)

    Schema.sObjectType.Account.isUpdateable()

    and

    Account.sObjectType.getDescribe().isUpdateable()

  2. if (!Schema.sObjectType.Account.fields.Name.isUpdateable() &&
    !Schema.sObjectType.Account.fields.BillingStreet.isUpdateable() ){
        update acc; }

    That will check actually even 3 things

    • Edit access to Name field
    • Edit access to BillingStreet field
    • Edit access to Account itself
  3. This will check Name and Account access

Also remember about with sharing and without sharing for class

With sharing checks if the user have access (read, read/write, none) to a RECORD and not object itself. So even if user have access to edit fields/object but doesnt have access to record, that user wont be able to edit record.

There are of course cases when user have view all/modify all on object or view all data/modify all data (system admins).

Without sharing ommits that restrictions but it needs to be used only when you have that kinda specific requirement

Related Topic