I was watching an old Dev 501 video today (#4 Classes & Objects) in which the instructor said profile based sharing rules were only checked at the entry point where apex code begins it's execution. He said profile based sharing of any classes called beyond the entry point wasn't checked by SF to determine whether it should run.
The video is quite old and may no longer apply. SF was at API 15 at the time this was recorded. When I looked at the docs, it was unclear to me on whether sharing is checked following initial entry. Is the video correct or is sharing checked again and respected with each call that follows to another class?
Before posting this, some of the articles I looked at included Without Sharing: Best practices when bypassing Apex sharing rules and object security by Dan Appleman in which he says "CRUD and FLS security is largely part of the user interface infrastructure. Sharing is largely implemented in the database query system." He then goes on to discuss what he refers to as "A Matter of Intent".
One of the questions that had occurred to me was the situation where at the entry point, "without sharing" was specified, a query returned the data to be operated on and a subsequent class to process the data "with sharing" was called. Because of FLS, the user who initiated the transaction might have read only access to some of the fields, yet the 2nd class called might operate on the fields, then perform DML to commit them.
If sharing rules are propagated from the initial User who initiated the transaction, the DML would presumably fail. If they're not propagated, the DML would succeed. I'd like to understand which would be the case and whether it's because of the class's sharing being propagated in the one situation or the user's sharing in the other possible outcome.
Appleman's article didn't discuss propagation of Role based sharing as additional classes are called from the entry point or subsequent classes. It wasn't clear to me whether the calling class's sharing model would be what was respected by subsequent classes, the the User's sharing model who initiated the execution of Apex code or neither of them.
In a single class execution, the answer is clear, but its less obvious in other situations, especially when SOQL or DML isn't involved. For example, if the above mentioned user doesn't have FLS permissions to edit a particular field in Opportunity named
myOppField__c, I wouldn't expect an Apex Class "with sharing" to prevent code from allowing
opp.myOppField__c[i] = opp2[i+1].myOppField__c; from running.
Instead, what I'd hope to be able to expect, would be a problem when an attempt was made to commit the database changes via DML when the revised data was returned to a calling class defined "with sharing" from the subsequent class which had been defined "without sharing" that made the changes to the read only field (for that User).
You could say, that this suggests to me that permissions and security involve more than just DML and SOQL queries, but coding to take those permissions into account as well. I hope this helps clarify the nature of my question. I greatly appreciate the answers I've received thus far.