Custom Permission Structure in SharePoint?

Question

Here is my requirement: I have a list of region/offices that is used to model the organization structure of a company. This list is used as a lookup in a list of manager users: so each manager is assigned to a region that he/she will manage. That means each of the node below will have manager assigned to them.

Europe Region
--East Europe
----Greece Office
----Turkey Office
--West Europe
----England Office
----Netherlands Office
--North Europe
America Region
...
...

Then I will have another list, that holds the staff(personnel) information for these regions/offices.

Name
Phone
Email
Age
Region (Choice)
Office (Choice)

What I need is to implement some policy so that the managers of the regions/offices will only be able to enter/update the information of their staff.

That means, the manager of Turkey office will not be able to enter data for Greece office. Or the manager of Europe Region will not be able to see the data of America region. Which should need a hierarchial permission structure.

How can i provide this kind of permission structure in SharePoint. The only solution that comes to my mind is developing a custom NewForm and EditForm, then do the permission checks in code-behind.

What are your ideas? Any alternatives come to mind?

Answer 1

Quick idea: since it would seem that you have specific people/groups that should edit a specifi item of the list you should be able to assign a item level permission to an item so that only the espected user may edit it, right?

If that is the case - and if no other better solution is found - you can try to build an item event receiver that will update the item permission set based on the selected region. That way whenever an item is modified, the new permission would be applied.

Would a similar solution be acceptable?

Edit: about the cancel adding event - you could use the item adding event to check the user and redirect to an error page when appropiate. For example:

public override void ItemAdding(SPItemEventProperties properties)
{
    base.ItemAdding(properties);            
    if (!UserCanAddThisItem(.....))
        {
            properties.Status=SPEventReceiverStatus.CancelWithRedirectUrl;               
            properties.RedirectUrl = "/_Layouts/myCustomPage.aspx";           
        }       
 }

This was based on this article: source. As you can see, you can define a custom page and then redirect the user as required. Remember to set the status to CancelWithRedirectUrl.

About the idea of developing a custom page and manage all the security inside that page, as said in the comments you could do it. It all comes down to a compromise: can you afford to constrain your user to use only the custom page? If the answer is yes, you could just remove all write permission from the target list and manage all edit/insert operation in a custom form. You will have to use RunWithElevatedPrivileges, but you would then be sure that no one will be able to add an item outside your managed page (or at last, no super-farm-admin-user will).