ApexIntermediatetestingsharingsecurity
Use System.runAs to test sharing and FLS in Apex test classes
Real World Scenario
Tests run as system user pass but partner user cannot see records in production. No runAs coverage for community profile.
Expected Answer
• System.runAs(partnerUser) wrapping query and DML assertions
• Create partner user with actual community profile in @TestSetup
• Assert QueryException or empty list for unauthorized access tests
• Separate tests for with sharing vs without sharing service classes
• runAs does not enforce FLS—explicit stripInaccessible tests still needed
• Test manual share creation visibility for runAs target user
• Negative test: user A cannot see user B records via IDOR parameter
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: System.runAs(partnerUser) wrapping query and DML assertions Also consider: Create partner user with actual community profile in @TestSetup In practice: Assert QueryException or empty list for unauthorized access tests Balance speed of delivery with maintainability.
Architect Perspective
System user tests lie about security—every user-facing Apex class needs runAs negative tests.