Global access modifier used for cross-application access

Question

Often when we read about global access modifiers we come across that it "should be used for any method that needs to be referenced outside of the application". Now I understand that in case of managed package or APIs we do require it. But what I wanted to understand is, is the term 'application' in the quoted text above mean the SF application we are working on like Sales or any custom SF app? Does that mean if I were to make my code visible to the some custom SF app (lets say, ABC) & currently the class I'm working on is part of Sales app, would I require global keyword?

If yes, then how does SF understands that a particular class is part of which app? I don't think there is any metadata to store such info, right?

Answer 1

There's a confusion of terminology (e.g. a Lightning App versus a Classic App versus an installed package, which is also an App...), but I think you're grasping the concept.

Your Salesforce Org is itself one main "app" with many different components (also called Apps). And all of these components can speak to each other just fine with being public. No global access is needed within your own org's code.

Aside from a few specific circumstances, like webservice methods, which require global access, everything in your org should be public if production code, and private if they are unit tests.

Everything that should be public generally includes your Schedulable, Batchable, Queueable, @future methods, Visualforce controllers, etc.

However, keep in mind that global works both ways. If, for some reason, a managed package in its own namespace needs to access one of your classes, the class it wishes to access must be global. This prevents any package from arbitrarily executing your org's code without permission.

The exception to this rule is if a public class implements a global interface from the managed package; at this point, those methods can be accessed through the global interface.

Mind you, because we don't have true reflection, like we do in Java, there's only so much harm that can come from this level of access, but it's still an added layer of protection. You should avoid making your code global unless you mean to.