I am having trouble putting the different aspects of enforcing CRUD/FLS/Sharing Rules into perspective. Reading through the manuals and doing extensive tests on my own, I came to the following conclusions:
For sharing I deducted the following:
with sharing enforces sharing rules. When a user owns a record or it is shared with the user, he has full access to the object, irrespective of CRUD / FLS settings. So if the user has no read access to the object but a record of this object is shared with him, he cannot access it in the regular Salesforce UI, but via Apex.
For CRUD/FLS I deducted the following:
[sObjectInstance].getDescribe() in combination with
.isAccessible() etc. allows to check for CRUD of a record, while analogously with
[sObjectInstance].getDescribe().getMap() allows to check for FLS of a record. However, if the object is accessible in the users CRUD settings, the OWD are set to private and the record is shared with the user, but the record is not owned by him, I will receive the message that this record is not accessible to the user. In the regular Salesforce UI the user would be able to access the record.
Now, I can combine both functionalities to check CRUD/FLS/sharing to get a picture of whether a user has access to any record. However,
with sharing already "filters out" records I have no access to.
If I want to have access to all records, but make my output based on whether the current user access (meaning he owns it/has sharing access and CRUD/FLS allow access as well), I have to do an SOQL-Query for the Sharing Relation and check for CRUD/FLS with
Are my assessments correct? Am I missing something?
Thank you so much