Q:

Chatter Group CRUD

I got dinged in a Security Review for not checking the CRUD settings for some code that inserts a record into a Chatter Group. The Group Id is stored in a Custom Setting, but the organization could set up the group to be Private, and not add the user to the group, at which point the code would fail.
But in the response, they suggested something like this:
isCreateable = Schema.sObjectType.FeedItem.isCreateable();

But am I right in thinking that doesn't make sense for a Chatter Group? I believe I have to confirm that that the user is a member of the group, and if they are, they will be able to post to the group? Just want to be sure before I submit it again...

A:

I think I agree with you about their suggestion; I'm not sure how that's helpful.
There are (at least) two scenarios:

The group is public, in which case the user (or Apex running on the user's behalf) need not be a member to post to it.
The group is private, in which case a quick query on CollaborationGroupMember can determine the running user's membership:
CollaborationGroupMember[] membership = [select id 
  from CollaborationGroupMember 
  where collaborationGroupId = :myGroupId and memberid = :myUserId]; 

if( membership.isEmpty() ) {
    // Not a member
} else {
    // Member! Post as normal.
}

Edit: Security may be referring to the fact that the org in question may not be Chatter-enabled, in which case I still don't think their code is helpful -- instead, what I've done previously is perform a global describe and check for the existence of CollaborationGroup.

