Trim search results based on user permissions

Question

Is it possible to create web part with Sharepoint APIs that will trim search results like this. I would need similar thing to check does user have edit permission on documents retreived from search results.

I guess other option would be developing post trimmer (ISecurityTrimmerPost)?

Answer 1

You can't do it with Search or the query API. A user just needs view rights to an item in SharePoint for the results to show. You would need to develop a solution (probably using an elevated account) to enumerate the items and determine if the current user has Edit rights.

Answer 2

I've managed to make console app with CSOM to get permissions for documents with code blow but to check permissions I need full rights or I get access denied. I will need to move this code to web part and check permissions with elevated rights.

public static void Search()
    {
        using (ClientContext clientContext = new ClientContext("http://server.company.com"))
        {
            KeywordQuery keywordQuery = new KeywordQuery(clientContext);
            keywordQuery.QueryText = ".docx";
            // Title,SiteName,SiteId,WebId,Path,contentclass,isdocument
            keywordQuery.SelectProperties.Add("Title");
            keywordQuery.SelectProperties.Add("SPSiteUrl");
            keywordQuery.SelectProperties.Add("SiteName");
            keywordQuery.SelectProperties.Add("SiteId");
            keywordQuery.SelectProperties.Add("WebId");
            keywordQuery.SelectProperties.Add("Path");
            keywordQuery.SelectProperties.Add("contentclass");
            keywordQuery.SelectProperties.Add("isdocument");
            SearchExecutor searchExecutor = new SearchExecutor(clientContext);

            ClientResult<ResultTableCollection> results = searchExecutor.ExecuteQuery(keywordQuery);
            clientContext.ExecuteQuery();

            foreach (var resultRow in results.Value[0].ResultRows)
            {
                try
                {
                    Console.WriteLine("{0}: {1}", resultRow["Title"], resultRow["Path"]);
                    Web web = clientContext.Site.OpenWebById(new Guid(resultRow["WebId"].ToString()));

                    clientContext.Load(web);
                    clientContext.Load(web.CurrentUser);
                    clientContext.ExecuteQuery();

                    if (web != null)
                    {
                        var url = web.Url;
                        var relurl = web.ServerRelativeUrl;
                        File f = web.GetFileByServerRelativeUrl((relurl.Length > 1 ? relurl : "") + resultRow["Path"].ToString().Remove(0, url.Length));
                        clientContext.Load(f);
                        clientContext.ExecuteQuery();

                        if (f != null)
                        {
                            ListItem item = f.ListItemAllFields;
                            var permissions = item.GetUserEffectivePermissions(web.CurrentUser.LoginName);
                            clientContext.ExecuteQuery();

                            foreach (var permission in Enum.GetValues(typeof(PermissionKind)).Cast<PermissionKind>())
                            {
                                var permissionName = Enum.GetName(typeof(PermissionKind), permission);
                                var hasPermission = permissions.Value.Has(permission);
                                Console.WriteLine("Permission: {0}, HasPermission: {1}", permissionName, hasPermission);
                            }
                        }

                    }
                }
                catch (Exception ex)
                {
                    Console.Write(ex.Message);
                }
            }
            Console.ReadLine();
        }