ApexIntermediatetestingsharingsecurity
Test negative sharing scenarios with assert on QueryException
Real World Scenario
Apex test asserts record found but never tests that unauthorized user receives empty result or exception on restricted record.
Expected Answer
• runAs restrictedUser then query expecting empty list or zero count
• AssertUnauthorized or custom assertNoAccess helper in test utility
• Test IDOR: pass other users record Id to controller assert failure
• Separate positive and negative sharing tests per profile tier
• without sharing service tests verify elevated path separately
• Community user tests for object and field level denial
• Document expected access matrix as test case source
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. runAs restrictedUser then query expecting empty list or zero count. AssertUnauthorized or custom assertNoAccess helper in test utility. Pick based on your integration pattern and team capability. Positive-only security tests give false confidence—negative runAs tests are mandatory. Balance speed of delivery with maintainability.
Architect Perspective
Positive-only security tests give false confidence—negative runAs tests are mandatory.