Can code or workflow remove item level permissions, then return them back to what they once were?

Question

I have an InfoPath 2007 form that has SPD 2007 workflow attached that uses Useful Sharepoint Designer Custom Workflow Activities from codeplex to grant item level permissions.

Another requirement is that each form have a unique sequential numbering schema that starts over each year, and number must include the year date part i.e. 2013-000, 2013-001 and so on, 2014-000, 2014-001.

The numbering requires that current user can access all items in the library in order to retrieve the last number (to add 1 to it). The problem is not all users have access to all submitted forms. Everyone can create a form, but permissions are retricted by item on submit.

My idea is to remove item level permissions on all items in the library on a first submit of form (keep form open), query for last number, then re-submit form and grant item level permission on current item AS WELL AS restore previous item level permissions to all items in list. I realize this could be a slow process years down the road when the library grows (and maybe bad practise) .

Is my idea feasible? If so what would be best approach?

Custom SharePoint workflow to strip and reset permissions? Is it possible to impersonate a user with Contribute permissions on query step in order to get last value/number in the library?

Answer 1

Setting permissions is a fairly heavy operation - it would be a very bad idea to do that twice for every item in a list on each form submit.

For your specific needs, the best approach would be to create another list that maintains the count by year and increment that on additions to the main list.

For different needs, it is possible to impersonate a user with more priviliges in event receiver code and I assume workflow as well. You need to create a new SPSite object with the user token of a priviliged user (e.g. the System Account). using(SPSite elevated = new SPSite(site.Id, site.SystemAccount.UserToken)), or else you can use SPSecurity.RunWithElevatedPriviliges, which also requires creating new site/web/list/item objects.

(For SP2010 and later, it's better to use SPUserToken.SystemAccount instead of the SystemAccount property on Site).