I'm making an application that interacts with Salesforce Rest API. When logged in as a user, I can execute SOQL on behalf of that user, for example:
SELECT subject from event
However, this will return me all the events in existence, and will not enforce the same security policy that the Salesforce app itself uses. As mentioned in a comment on this answer, when inquiring about which events are shown to a user:
"It first depends on whether or not roles are enabled. It then depends on the security model for contacts, accounts, opps, etc, ownership, opportunity teams, custom objects and many other things as to what someone will see. These things can be affected by sharing groups and record sharing as well. "
How can I only show the Events (and not just events, but other objects) that Salesforce is showing the user based on security and permissions? Must I re-invent the wheel inside my application and manually check security settings, roles, profiles, groups, etc. to determine whether or not to show particular data to a user?
And what about field-level security? Must I check this too when editing an object via the Rest API?
Note: I've worked with other 3rd party application APIs that only return the data you can see based on your logged-in credentials. I'll be suprised if the burden is put on the data-caller.