Enforcing CRUD / FLS / Sharing in Apex

Question

I am having trouble putting the different aspects of enforcing CRUD/FLS/Sharing Rules into perspective. Reading through the manuals and doing extensive tests on my own, I came to the following conclusions:

For sharing I deducted the following: with sharing enforces sharing rules. When a user owns a record or it is shared with the user, he has full access to the object, irrespective of CRUD / FLS settings. So if the user has no read access to the object but a record of this object is shared with him, he cannot access it in the regular Salesforce UI, but via Apex.

For CRUD/FLS I deducted the following: [sObjectInstance].getDescribe() in combination with .isAccessible() etc. allows to check for CRUD of a record, while analogously with [sObjectInstance].getDescribe().getMap() allows to check for FLS of a record. However, if the object is accessible in the users CRUD settings, the OWD are set to private and the record is shared with the user, but the record is not owned by him, I will receive the message that this record is not accessible to the user. In the regular Salesforce UI the user would be able to access the record.

Now, I can combine both functionalities to check CRUD/FLS/sharing to get a picture of whether a user has access to any record. However, with sharing already "filters out" records I have no access to.

My questions: If I want to have access to all records, but make my output based on whether the current user access (meaning he owns it/has sharing access and CRUD/FLS allow access as well), I have to do an SOQL-Query for the Sharing Relation and check for CRUD/FLS with [sObjectInstance].getDescribe() etc?

Are my assessments correct? Am I missing something?

Thank you so much

Answer 1

With the help of Eric I am going to try to answer my question by myself:

CRUD and FLS is part of metadata, so information about (custom) objects in general. With the Schema Class one should determine CRUD/FLS of objects, not records. Although you can receive the DescribesObjectResult for a record and the results might differ whether you own a record or not, you should use the Schema Class only to describe objects, not records.

Coming to access to records records, one can filter out records the current user has no access to with the with sharing keyword for classes, however this only partially describes record access. with sharing does not describe CRUD/FLS permission, but merely states that a record is owned by or shared with the current user, but not even if the current user has read access.

So if you really want to find out on a record level which access (any) user has to a specific record, a SOQL Query to the table UserRecordAccess is required, further information can be obtained here.

If nobody objects or has further additions, I will mark this as the correct answer in a couple of days.