Apex Controller
Date-aware APIs, overlap queries, record association, and user-mode authorization.
ForceCalendarController is declared public with sharing. Queries and writes use Salesforce user-mode enforcement plus explicit validation. Deploy the controller together with the 0.3 LWC and resource.
Current LWC entry points
| Method | Parameters | Result |
|---|---|---|
getEvents | Datetime startDateTime, Datetime endDateTime, Id recordId | List<Map<String,Object>>; cacheable |
createCalendarEvent | String title, Datetime startDateTime, Datetime endDateTime, Boolean isAllDay, Date startDate, Date lastDay, String description, String location, Id recordId | Created Id |
updateCalendarEvent | Id eventId, String title, Datetime startDateTime, Datetime endDateTime, Boolean isAllDay, Date startDate, Date lastDay, String description, String location | void |
deleteEvent | Id eventId | void |
For timed events provide datetime instants. For all-day events provide startDate and inclusive lastDay; the date-aware methods derive Salesforce-native values. lastDay may equal startDate but may not precede it.
Legacy createEvent, createEventForRecord and updateEvent remain available to existing callers following native Salesforce date semantics. Prefer the date-aware APIs for new LWC integrations.
Query contract
Queries include overlapping events, not only events starting in the window. For timed events, an event ending exactly at the range start is excluded; an event starting exactly at the inclusive range end is included. All-day overlap uses native civil-date semantics.
The query is ordered by StartDateTime and limited to 1,000 records. This is a bounded query, not a paginated export of every matching Event. Keep visible windows bounded and evaluate dense-calendar behavior before rollout.
Returned fields include id, title, start, end, allDay, startDate, lastDay, description, location, whoId, whatId, backgroundColor and recurring. startDate/lastDay are supplied for all-day entries. Optional relationship fields can be absent from the query and returned as null when inaccessible.
Authorization and associations
User-mode SOQL/DML enforce object/field access, and sharing remains in force. An inaccessible or unsupported record-page context fails closed. Contact/Lead associations use WhoId; supported other record types use WhatId. The controller checks the related record as the current user before accepting it.
Native recurring events and exceptions are recognized server-side and cannot be edited/deleted through these unsupported mutation paths. This guard is independent of the Interface marker and UI controls.
Permission-set assignment is explicit and additive; see permission scope. Test private Events, restricted readers/editors and related-record access in the target org.
Verification
The source includes ForceCalendarControllerTest and ForceCalendarPermissionsTest. LWC Jest tests mock Apex transport and cannot substitute for those org tests. Live synthetic CRUD verification also does not establish behavior for every intended user's profile. See deployment checks.