with and without sharing with innerclass

Question

I'm working on a project that needs to change a lot of data that the user shouldn't see in the backoffice. So I'm wondering if I should put my entire class "without sharing".

For now I'm creating a "without sharing" inner class for each class, but each soql part is in this part, because the user shouldn't change any data by himself.

@AuraEnabled
public static void deleteTime(SObject t) {
    new InnerTimeManager().deleteSObject(new List<SObject>{t});
}


without sharing class InnerTimeManager {
    public void deleteSObject(List<SObject> listSO) {
        delete listSO;
    }
}

All parts that need soql are like this. And I don't feel that it is useful. Is there any good practice for this kind of case?

FYI : I can't change user permissions and Sharing Settings are private.

Answer 1

Where I work, we have mostly settled on using these access "trampolines" as best practice. We try to avoid top level without sharing classes. The risk is that you put too much logic in the and some code which should have had sharing applied runs instead without. Using trampolines makes your intentions quite clear and keeps scope limited.

Answer 2

The code should run with minimum privileges at initially, and if required elevate them.

Code is not just about getting things done, or what's easier. Sometimes you have to think about the future and implications. Let's assume you made the whole class as without sharing. Then in future, if another dev add a method that needs to be with sharing he/she needs to make a new class as with sharing to achieve the same. ie from Elevated mode you are going to the restricted mode which kinda breaks the paradigm of programming