I am working on a lightning application that uses the lightning apex continuation callout pattern found at this link:
The steps we are taking are essentially the same as listed in the article:
1) A lightning "continuation component" contains an
aura:method that allows us to perform apex continuations from other lightning components.
2) The "continuation component" has an embedded iframe visualforce page that listens for messages. When one is received from the parent "continuation component" it calls a remote action to begin the apex continuation.
3) The iframe'd visualforce page's controller has a class header of
global with sharing. Inside of it is a
@RemoteAction annotated method with a
global static method signature.
We are observing that the queries in this remote action run in a system context instead of a user context, returning records the current user doesn't have object level access to. It's not clear to me why this is, and I was wondering if anyone here could explain it.