Identify in which mode(System/User mode) the class is running

Question

From the Salesforce security review point of view for the the app exchange app, we need to add the access checks while querying and doing DML operations. If we have a requirement that the SOQL/DML needs to be done irrespective of the user's permissions, then we can use the without sharing class.

But let's say we have an inherited class, whose running mode will be defined by the calling class. In this case, how we can correctly add the access checks for SOQL/DML? The class will run in the system mode or user mode depending upon the calling class and we don't want to add the access checks when it is getting called from the class that is marked as without sharing. Is there any methods to identify the class running mode?

Or we don't need to add the access checks when we marked the class as inherited class? Can we add the false/positive for the same?

Answer 1

Sharing is orthogonal to SOQL/DML permissions and should not be conflated with it.

Sharing controls visibility and write access to individual records while permissions control visibility and write access for whole objects and their fields.

All apex, other than Anonymous Apex, implicitly runs in system mode. To apply user mode requirements against SOQL and DML is up to the developer to apply appropriate checks or use appropriate features (e.g. schema checks, stripInaccessible and USER_MODE etc.).

Permission checks must always be applied, for both queries and DML iterations, regardless of Sharing.

For sharing, you can check UserRecordAccess for individual records if desired, either as a standalone query (where CRUD permissions are also considered) or as a related record within the queried objects (where only sharing is considered).

If your code must bypass permission checks you must declare a CRUD/FLS false positive. See this other Q&A for more.