2

In C# you could allow users to access a SharePoint list they have no access to by using SPSecurity.RunWithElevatedPrivileges(delegate () .....etc. Is there a way achieving the same functionality using TypeScript and SPFx ?

As SPFx and TypeScript / JavaScript run in the browser which runs in the context of the user. How can I create a webpart to, for example, allow a user to update their timesheet without giving everyone modify access to the TimeSheets List ?

Improve this question
3
  • 3
    Doubt that this will ever be a thing, it is waaay to insecure for client side apps to have that level of privilege. This currently does not exist in any of the APIs (CSOM, JSOM, REST). Commented Sep 22, 2016 at 19:36
  • I agree Eric. But how is it possible that the use case can be achieved. I cannot believe that Microsoft have not thought of this. Perhaps the use of AAD is a possibility. There are an awful lot of C# Full Trust solutions that rely on being able to do this. When they get moved across to CSOM / JSOM / REST / SPFx how will the functionality work ? Commented Sep 22, 2016 at 19:45
  • 2
    Most likely as a provider hosted app or something to that extent. You cannot bake something like that into the client side, or everyone and their mother will just impersonate a global administrator. Commented Sep 22, 2016 at 20:03

2 Answers 2

Reset to default
5

As Eric mentioned, no. You can't do this, and you won't be able to do this directly from the browser, as anything the browser can do, anyone else can do. What you would want to do is the following (this will be somewhat complex)

1 - Create an Azure App that has the permissions that you are wanting to elevate to, and hook up the auth flow so that you can authenticate to it from your SharePoint browser as the current user.

2 - From the browser, call into your Azure App

3 - From your Azure App, validate the current user, and then make a call into SharePoint as the app itself, and update the data.

Note that even in this case, the user doesn't have permission to update their own data. Instead, your app verifies who the user is, and performs the action on their behalf.

Improve this answer
1
  • This is fine, but you cannot access Azure AD or Azure from a developer tenancy. If you try to you get asked to sign up to Azure with a credit card. SPFx is not available yet with non-developer tenancies. So you are kind of stuck. But I suspect this is going to be the way to go once SPFx is available in non-development tenancies. Commented Sep 23, 2016 at 14:43
1

As I mentioned in the comments, this will likely never happen*. It is just something that would be so easily abuse-able. The most likely implementation for something like that is a provider hosted app that your SPFX web part calls and it does the updating under impersonation.

Now for your particular use case, this isn't a big deal. If you are using a list in this scenario, which I am assuming you are, you utilize the built in Item level permissions in the Advanced Settings of the list so users can "Create items and edit items that were created by the user".

*my personal opinion, I am not privy to any inside information.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.