We are developing our application as managed package. And there are few custom setting which should not be visible to the client when the package is installed, e.g. Amazon bucket credentials etc. To achieve this we've declared such settings as protected.
This approach works pretty well, but our application also includes mobile app, which communicates with SF using REST API reading/creating/updating data from package data structure.
Despite that mobile app is a part of our application from business and human perspective, for Salesforce it's just some external service trying to access something in client orgs, i.e. SF doesn't treat it as part of the package, of course.
That's why protected custom settings are not available for our mobile app to read. So far we've ended up with using Apex web service to let mobile app read those settings, but it looks like security hole to me.
The question here would be - how could we allow external service which is logically (but not physically) part of our app to access different protected artifacts? What other options except custom webservice do we have? And in general, is there any way to say SF - "Hey, this mobile app should be treated as a part of managed package, don't apply all that protection to it" ?
Any thoughts and ideas would be appreciated.
And thanks in advance for you help.