There are a few points about add-in user permissions that I am missing.
Please correct me if I am wrong about the following points:
- Installing an add-in creates a
SPWeb, over which add-ins and users have full-control.
- Developers can request permissions over
host webresources using the add-in's manifest file.
- By the time users are prompted to give an app permission, they can only grant permissions they actually have. Therefore, a user who has read-only permissions on the
host webcannot grant writing privileges to an add-in.
My question is, if
spadmin installs an add-in that requests writing privileges over the
host web, would read-only users be able to perform writing operations using that add-in, or would SharePoint deny access to those users and limit usage to a user's own permissions set? What about anonymous users: is it possible to allow anonymous users to use an add-in, and, therefore, inherit the add-in's writing permissions?