Getting access denied if a user tries to get role assignments using pnp sp with spfx webpart

Question

I've created a webpart which adds items to a SharePoint list. When the item is submitted I use:

   var theItem = this.state.Id;
      console.log(theItem, 'theItem');
      
      const ler2 = await sp.web.lists.ensure("MyList");
      const getList2: IList = ler2.list;
      await getList2.roleAssignments();
         
      const owner = this.state.PolicyOwnerBackup;
      const rperson = this.state.ResponsiblePersonBackup;
      console.log(owner, 'owner');
      console.log(rperson, 'rperson');
           
      const EditroleDefinition = await sp.web.roleDefinitions.getByName("Edit").get();
      console.log(EditroleDefinition, 'EditroleDefinition');
      const FulControlroleDefinition2 = await sp.web.roleDefinitions.getByName("Full Control").get();
      console.log(FulControlroleDefinition2, 'FulControlroleDefinition');

await sp.web.lists.getByTitle('MyList').items.getById(theItem).breakRoleInheritance(false, false);
   
      const assignments = await sp.web.lists.getByTitle('MyList').items.getById(theItem).roleAssignments();
           
      console.log(assignments, 'assignemnts');

sp.web.siteUsers.getById(rperson).get();
                 
      assignments.forEach(async (entry) => {
            
      const remove = await sp.web.lists.getByTitle('MyList').items.getById(theItem).roleAssignments.remove(entry.PrincipalId,FulControlroleDefinition2.Id );
      console.log(remove);
        
     });

And a very similar process of permissions setting for any files uploaded, using the same form.

I get no errors on workbench, but I get 403 errors (forbidden) when any other user uses it when deployed to the live SPO site. If I elevate that users permissions to Full Control, it sometimes works but, most of the time it doesn't. I have ownership and Full Control of the SPO site, but the other user has only Contribute permissions. Is there something I can do to allow these other users to have permissions, that can apply permissions to any newly created item and file without error? Perhaps harness my permissions while uploading somehow?

I've read the below thinking perhaps it could be related to my issue? https://github.com/pnp/pnpjs/issues/489

NightTom NightTom · Accepted Answer · 2021-01-25T20:22:28

Turns out it's impossible to do client-side. It's not possible to change permissions if the user creating the REST request doesn't have permissions to do such a thing. Yes, makes sense but it's a major limitation. I've been advised the only way to do it is to create something in Azure that would do it.

Getting access denied if a user tries to get role assignments using pnp sp with spfx webpart

1 Answers