Does a library exist for securely querying for arbitrary data?

Question

I'm looking for a library we can use from Aura and Lightning Web Components in particular, to take some sort of request and return the data for it, but only if/what the user can see.

Per their secure coding guide, under final recommendations, they state:

There are a number of third party libraries that can help you write SOQL queries. In general, if you want to use these, you should refactor them before you try to use them. It is safest and easiest to verify injection fixes when you are doing field validation in the same function/class that you are performing the database query.

Most libraries will expose a SOQL layer that is easy to use, but does not provide any validation. If you want to use these libraries, you will need to modify them so that the framework level is secure. This will allow you to use the library without having to worry about sanitizing every database call in your code.

And I found this stackexchance, suggesting the REST API is not supported OotB in LWC (though it's quite old).

Does a library (or built-in API) already exist for this, that alters/permits querying based on the Salesforce security model (doing row, field and object level checks)? As the above suggests, I've found the Q library to build queries, but no security. Something to take, say, an object (or list of objects), some filters, perhaps some fields (or dynamically find all fields viewable to a user), or alternatively a list of IDs (perhaps mixed types) and return the data for driving custom UIs (think not just listviews and detail pages, but also a coordinated page spanning several objects and relationships, even if multiple requests are needed to drive it).

Looking at the Lighting Data Service, that only appears to let you build out UIs consisting of existing layouts and forms. The Wire Service seems to want to give you particular records based on ID, but the individual fields need to be imported and/or hardcoded into the controller. My preference is for arbitrary objects returned in JSON without having to couple the UI code so directly to the underlying data schema.

Ideally, I'd like something that for example would take some sort of request (the simplest being just give me lists of an object type):

{objectNames:['Contact', 'Account']}

and returns a list of records, showing just the objects, fields, and rows the executing user has permissions on, e.g. for a User with read on Contact and Account, with some sharing model, who can only see ID and Name, the return might be:

{[
  {ID:abc000000000123, Name:"test Contact"},
  {ID:abc000000000234, Name:"Another Contact"},
  {ID:def000000000123, Name:"test Account"}
]}

Answer 1

Probably the most common library out in the ecosystem is the FFLib Apex Common produced by Andrew Fawcett at Financial Force. Related: blog post. Or you could use the newish System.Security class methods

Answer 2

Since Aura and LWC will make calls to APEX classes eventually to get data, would you be able to leverage this: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm to enforce object and field permissions (+ with sharing keyword)