I have a library with content that is pushed out to a large audience -- read permissions. We have several people who work on developing the content -- contribute permissions.
We've turned on content approval for submitted items. This is great because everyone with read permissions sees the approved content and our contributors can see the new and modified content they are working on.
The problem comes when it is time to review the content with others, lets call them reviewers. These are content experts and other folks who want/need to review the content before it is approved. They aren't they approvers, they just review and advise. We don't want them to have any kind of contribute or edit permissions in our library and we don't want a reviewer to accidentally create, edit, or delete something in the library.
I've created a front-end with REST calls that pulls back all the content and marks which bits are approved and which are pending (reviewers do not need to see rejected items). This all works well when the person using the REST front-end is a contributor, but if they are just a regular reader they don't see any of the pending items.
I've looked at the the custom permissions level and don't see anything that would allow regular readers to only see the pending items when they use the REST front-end.
Is there some way to allow REST calls to behave as if they were contributors regardless of the permissions of the current user? (This is an internal on-prem site so I don't have to worry that someone is going to whip up a devastating ajax-based attack using REST endpoints).
Or is there some other way to allow people to review pending content?