Enforce User Mode for Database Operations

Apex code runs in system mode by default, which means that it runs with substantially elevated permissions over the user running the code. To enhance the security context of Apex, you can specify user-mode access for database operations. Field-level security (FLS) and object permissions of the running user are respected in user mode, unlike in system mode. User mode always applies sharing rules, but in system mode they’re controlled by sharing keywords on the class. See Using the with sharing, without sharing, and inherited sharing Keywords.

1List<Account> acc = [SELECT Id FROM Account WITH USER_MODE];
2

Salesforce recommends that you enforce Field Level Security (FLS) by using WITH USER_MODE rather than WITH SECURITY-ENFORCED because of these additional advantages.

• WITH USER_MODE accounts for polymorphic fields like Owner and Task.whatId.
• WITH USER_MODE processes all clauses in the SOQL SELECT statement including the WHERE clause.
• WITH USER_MODE finds all FLS errors in your SOQL query, while WITH SECURITY ENFORCED finds only the first error. Further, in user mode, you can use the getInaccessibleFields() method on QueryException to examine the full set of access errors.

1Account acc = new Account(Name='test');
2insert as user acc;

The AccessLevel class represents the two modes in which Apex runs database operations. Use this class to define the execution mode as user mode or system mode. An optional accessLevel parameter in Database and Search methods specifies whether the method runs in system mode (AccessLevel.SYSTEM_MODE) or user mode (AccessLevel.USER_MODE). Use these overloaded methods to perform DML and query operations.

• Database.query method. See Dynamic SOQL.
• Database.getQueryLocator methods
• Database.countQuery method
• Search.query method
• Database DML methods (insert, update, upsert, merge, delete, undelete, and convertLead)
  • Includes the *Immediate and *Async methods, such as insertImmediate and deleteAsync.

These methods require the accessLevel parameter.

• Database.queryWithBinds
• Database.getQueryLocatorWithBinds
• Database.countQueryWithBinds

1@isTest
2public with sharing class ElevateUserModeOperations_Test {
3    @isTest
4    static void objectCreatePermViaPermissionSet() {
5        Profile p = [SELECT Id FROM Profile WHERE Name='Minimum Access - Salesforce'];
6        User u = new User(Alias = 'standt', Email='standarduser@testorg.com',
7            EmailEncodingKey='UTF-8', LastName='Testing', LanguageLocaleKey='en_US',
8            LocaleSidKey='en_US', ProfileId = p.Id,
9            TimeZoneSidKey='America/Los_Angeles',
10            UserName='standarduser' + DateTime.now().getTime() + '@testorg.com');
11
12        System.runAs(u) {
13            try { 
14                Database.insert(new Account(name='foo'), AccessLevel.User_mode); 
15                Assert.fail(); 
16            } catch (SecurityException ex) { 
17                Assert.isTrue(ex.getMessage().contains('Account'));
18            }
19            //Get ID of previously created permission set named 'AllowCreateToAccount'
20            Id permissionSetId = [Select Id from PermissionSet 
21                where Name = 'AllowCreateToAccount' limit 1].Id;
22
23            Database.insert(new Account(name='foo'), AccessLevel.User_mode.withPermissionSetId(permissionSetId)); 
24
25            // The elevated access level is not persisted to subsequent operations
26            try { 
27                Database.insert(new Account(name='foo2'), AccessLevel.User_mode); 
28                Assert.fail(); 
29            } catch (SecurityException ex) { 
30                Assert.isTrue(ex.getMessage().contains('Account')); 
31            } 
32            
33        } 
34    } 
35}
36