Dynamic SOQL and Object Permissions

Question

I am hoping someone can shed some light on this for me. I am beyond confused.

I have Lightning Component that has some strings to build out a dynamic query in SOQL. It is against a custom object called 'Images__c'. Else where in the code I am having to query against the same object, but it is not through a dynamic query for various different reasons.

'Sales Person' profile does not have access to this object. When in the Lightning Component and I click the button that ends up making the dynamic query run and I am getting back a list of 'Image__c' objects. When I click the button to make the standard query run I am getting a hard error due to not having access as expected.

My question is does dynamic soql enforce profile object permissions? Why would one query work as expected and the other doesn't?

Edit: I should note that the dynamic soql just returns a list of generic sobjects all the way back to lightning.

Answer 1

SOQL in Apex does not, by default, honor profile permissions. To do so, add WITH SECURITY_ENFORCED. As the documentation says:

Apex generally runs in system context; that is, the current user's permissions, field-level security, and sharing rules aren’t taken into account during code execution. Although performing field- and object-level security checks was possible in earlier releases, this clause substantially reduces the verbosity and technical complexity in query operations. This feature is tailored to Apex developers who have minimal development experience with security and to applications where graceful degradation on permissions errors isn’t required.

As you can see, the default behavior is "system context", where field and object permissions are ignored. If you don't want to use this feature, use describe results instead:

if(sObjectType.Images__c.isAccessible()) {
  // continue doing query //
} else {
  // show an error //
}