In preparation for the Force.com AppExchange Security Review (see e.g. Requirements Checklist) I have been trying to write unit tests for my application's CRUD security and FLS logic.

The two tests below demonstrate the problem that I have got stuck on. System.runAs can have an impact on the describe call result as isUpdateable is false in the first test class and true in the second. But the first obtained describe data remains cached both within a test method and across the whole test class.

I'm looking for suggestions on how to write CRUD security and FLS tests given this unexpected behavior.

Thanks, Keith

@isTest
private class DescribeFalseTest {

    @isTest
    static void testOne() {
    
        // Observed bizarre behavior: if first call is false rest will be false
        System.runAs(readOnlyUser()) {
            System.assertEquals(false, Account.SObjectType.getDescribe().isUpdateable());
        }

        System.assertEquals(false, Account.SObjectType.getDescribe().isUpdateable());
    }

    @isTest
    static void testTwo() {

        System.assertEquals(false, Account.SObjectType.getDescribe().isUpdateable());
        
        System.runAs(readOnlyUser()) {
            System.assertEquals(false, Account.SObjectType.getDescribe().isUpdateable());
        }
    }
    
    private static User readOnlyUser() {

        Profile p = [select Id, Name from Profile where Name = 'Read Only'];
        User u = new User(
            UserName = 'test-user@test-company.com',
            FirstName = 'Test-First-Name',
            LastName = 'Test-Last-Name',
            Alias = 'test',
            Email = 'test-user@test-company.com',
            EmailEncodingKey = 'UTF-8',
            LanguageLocaleKey = 'en_US',
            LocalesIdKey = 'en_US',
            TimezonesIdKey = 'America/Los_Angeles',
            ProfileId = p.Id
            );
        insert u;
        return u;
    }
}

@isTest
private class DescribeTrueTest {

    @isTest
    static void testOne() {
    
        // Observed bizarre behavior: if first call is true rest will be true
        System.assertEquals(true, Account.SObjectType.getDescribe().isUpdateable());
        
        System.runAs(readOnlyUser()) {
            System.assertEquals(true, Account.SObjectType.getDescribe().isUpdateable());
        }
    }

    @isTest
    static void testTwo() {

        System.runAs(readOnlyUser()) {
            System.assertEquals(true, Account.SObjectType.getDescribe().isUpdateable());
        }

        System.assertEquals(true, Account.SObjectType.getDescribe().isUpdateable());
    }
    
    private static User readOnlyUser() {

        Profile p = [select Id, Name from Profile where Name = 'Read Only'];
        User u = new User(
            UserName = 'test-user@test-company.com',
            FirstName = 'Test-First-Name',
            LastName = 'Test-Last-Name',
            Alias = 'test',
            Email = 'test-user@test-company.com',
            EmailEncodingKey = 'UTF-8',
            LanguageLocaleKey = 'en_US',
            LocalesIdKey = 'en_US',
            TimezonesIdKey = 'America/Los_Angeles',
            ProfileId = p.Id
            );
        insert u;
        return u;
    }
}