How to check the user's CRUD permissions for an object in Salesforce?

Question

According to a requirement, i have to change the owner of an account if the user does not have read access to a third object.

I need a functionality similar to the isAccessible() method of Describe Field Result, but it is only available for the current logged in user.

Is there any other way to check the user's CRUD permissions for an object in Apex code?

Dehumidify

Answer 1

I wrote an article about this on my blog. There is a feature that was just released in version 24.0 of the API (Spring Release) that will let you do just this on a record by record basis for the current user.

Here is the link to that blog entry that goes into details: How to tell if a user has access to a record

Ramunni

Answer 2

Don't confuse record level access with CRUD - the latter is the ability for a user to Create, Read, Update or Delete an object in general, regardless of sharing rules etc. that might affect the user's access to a particular record.

To check whether a user can create (e.g. Contacts) in general, just use

Schema.sObjectType.Contact.isCreateable()

(returns true or false)

Allodial

Answer 3

Very old post. Since then SF add option to query object permission:

    Select SobjectType ,ParentId, PermissionsEdit, PermissionsRead 
From ObjectPermissions
Order by ParentID, SobjectType ASC

Basically you will need to get the profile and permissionset of the user that you want to check and the relevant object. So it will be something like:

Select SobjectType ,ParentId, PermissionsEdit, PermissionsRead 
From ObjectPermissions
where parentId IN :UserProfileIdAndPermission
AND sObjectType=:objectType
Order by ParentID, SobjectType ASC

Hysteresis

Answer 4

From the documentation. it sounds like you want to use execute anonymously.

Apex generally runs in system context; that is, the current user's permissions, field-level security, and sharing rules aren’t taken into account during code execution.​ The only exceptions to this rule are Apex code that is executed with the executeAnonymous call. executeAnonymous always executes using the full permissions of the current user. For more information on executeAnonymous, see Anonymous Blocks.

Although Apex doesn't enforce object-level and field-level permissions by default, you can enforce these permissions in your code by explicitly calling the sObject describe result methods (of Schema.DescribeSObjectResult) and the field describe result methods (of Schema.DescribeFieldResult) that check the current user's access permission levels. In this way, you can verify if the current user has the necessary permissions, and only if he or she has sufficient permissions, you can then perform a specific DML operation or a query.

For example, you can call the isAccessible, isCreateable, or isUpdateable methods of Schema.DescribeSObjectResult to verify whether the current user has read, create, or update access to an sObject, respectively. Similarly, Schema.DescribeFieldResult exposes these access control methods that you can call to check the current user's read, create, or update access for a field. In addition, you can call the isDeletable method provided by Schema.DescribeSObjectResult to check if the current user has permission to delete a specific sObject.

http://www.salesforce.com/us/developer/docs/apexcode/index_Left.htm#StartTopic=Content/apex_classes_perms_enforcing.htm#kanchor431

Ptolemaic

My problem is like this. I have two objects A and B. If the owner of A record does not have read access to B object, then change the owner to some predefined user. The methods of Schema.DescribeSObjectResult only show whether the current user has access to the sObject. I wanted something like the isAccessible method but showing the access for the user other than the current user. – Dehumidify

Answer 5

Have you tried the runAs() method?

Something like (not verified):

User u = [SELECT Id FROM User WHERE Name='John Doe'];

System.runAs(u) {
  if (Schema.sObjectType.Contact.fields.Email.isAccessible()) {
    // do something
  }
}

Tailored

Thanks for the reply. The runas method can only be used in a test method. I need to check the user access in a class. – Dehumidify

Answer 6

The DescribeSObjectResult class has methods for checking CRUD.

E.g. this allows you to test whether or not the current user can update the account object in general.

Schema.DescribeSObjectResult drSObj = Schema.sObjectType.Account;
Boolean thisUserMayUpdate = drSObj.isUpdateable();

@John De Santiago: your article covers record level access rather than object CRUD (= object level access)

Quidnunc