Are security policies enforced on returned data from the API?

Question

I'm making an application that interacts with Salesforce Rest API. When logged in as a user, I can execute SOQL on behalf of that user, for example:

SELECT subject from event

However, this will return me all the events in existence, and will not enforce the same security policy that the Salesforce app itself uses. As mentioned in a comment on this answer, when inquiring about which events are shown to a user:

"It first depends on whether or not roles are enabled. It then depends on the security model for contacts, accounts, opps, etc, ownership, opportunity teams, custom objects and many other things as to what someone will see. These things can be affected by sharing groups and record sharing as well. "

How can I only show the Events (and not just events, but other objects) that Salesforce is showing the user based on security and permissions? Must I re-invent the wheel inside my application and manually check security settings, roles, profiles, groups, etc. to determine whether or not to show particular data to a user?

And what about field-level security? Must I check this too when editing an object via the Rest API?

Note: I've worked with other 3rd party application APIs that only return the data you can see based on your logged-in credentials. I'll be suprised if the burden is put on the data-caller.

Answer 1

So it's a little weird...

In general, APEX REST methods are always invoked using System Mode...a.k.a. "God Mode".

Object and Field-Level Security are not enforced so the suggestion is to do some schema describes and determine yourself whether the requester has access to the object/fields/etc.

Sharing rules are enforced as long as you define your class using the with sharing keyword.

See here: Exposing Data with Apex REST Web Service Methods