Salesforce Advanced: Check User Field Level Security Before DML

According to Salesforce best practice we must check the current user FLS (field level security) before running any DML action. It's sometimes annoying and in many cases in enterprise company no one really enforce it but if you want to develop something to the appexchange and go through the security review then it is must.

Following utility class/method can simplify the process and help understanding how to run this check.

public with sharing class SecurityChecker {

    //Check object access and FLS
    public static set<String> isUserAllowed(String action, list<SObject> l_records){
        set<String> s_errors = new set<String>();
        
        SObjectType objType = l_records.get(0).getSObjectType();
        
        if(action == 'delete' && objType.getDescribe().isDeletable() == false){
            s_errors.add('Missing delete permission on object : ' + objType);
        }
        else if(action == 'insert'){
            if (objType.getDescribe().isCreateable() == false) {
                s_errors.add('Missing create permission on object : ' + objType);
            }
            else {
                Map<String, Schema.SObjectField> fieldMap = objType.getDescribe().fields.getMap();
                
                for (SObject soRecord : l_records) {
            
                    for (String fieldName : soRecord.getPopulatedFieldsAsMap().keySet()) {
                        if (fieldName == 'Id') continue;
                        
                        Schema.SObjectField myField = fieldMap.get(fieldName);
                        if (myField == null) continue;
                        
                        Schema.DescribeFieldResult dfr = myField.getDescribe();
                        
                        if (dfr.isCalculated() == false && dfr.isPermissionable() == true && dfr.isUpdateable() == false) {
                            s_errors.add('Missing create permission on object/field : ' + objType + '/' + myField);
                        } 
                    }
                }
            }
        }
        else if(action == 'update'){
            if (objType.getDescribe().isUpdateable() == false) {
                s_errors.add('Missing update permission on object : ' + objType);
            }
            else {
                Map<String, Schema.SObjectField> fieldMap = objType.getDescribe().fields.getMap();
                
                for (SObject soRecord : l_records) {
            
                    for (String fieldName : soRecord.getPopulatedFieldsAsMap().keySet()) {
                        if (fieldName == 'Id') continue;
                        
                        Schema.SObjectField myField = fieldMap.get(fieldName);
                        if (myField == null) continue;
                        
                        Schema.DescribeFieldResult dfr = myField.getDescribe();
                        
                        if (dfr.isCalculated() == false && dfr.isPermissionable() == true && dfr.isUpdateable() == false) {
                            s_errors.add('Missing update permission on object/field : ' + objType + '/' + myField);
                        } 
                    }
                }
            }
        }
        
        return s_errors;
    }
}

Basically, having this utility class, all you need to do is to invoke it before update.
For instance:

set<String> s_errors = SecurityChecker.isUserAllowed('update', accountList);

if(s_errors.isEmpty()){
 update accountList;
}
else{
 //missing permissions. print errors
}

Hope this is helpful 😯

Salesforce Advanced

Check User Field Level Security Before DML

No comments:

Post a Comment

Retire of Permission on Profiles