I have an Invoice Object inovice1, A profile sales1.Profile sales1 have no crud permission for invoice1 object not even read. Also OWD for Invoice object is set to private.Still I am able to insert,update,delete the invoice object invoice1 when logged in by sales1 profile in apex class.( without sharing).Grant access using hierarchy is set true but I have removed role from User too.
It's allowing you to delete it because it's a
without sharing class, in which Apex does not enforce sharing permissions. This is correct behaviour. Also recall that object- and field-level permissions are not evaluated in Apex code unless you check them yourself.
with sharing class, you said it is giving no rows found on SOQL. This is also correct behaviour because the user has no record-level permission to see it at all.
Is there something specific you are trying to accomlpish here?