Apologies in advance for the length.
I have rolled onto a project where I'll take over a former colleague's webpage that resides on the client's SharePoint site. The colleague wowed the client by creating a webpage that uses REST to allow users to apply to join the site, submit task requests to the site, and view & update submitted tasks, all on one page, storing the submitted information in a List and only letting approved users see tasks assigned to them, all on one page.
For security reasons, this colleague set the list up so that only users who were assigned List Item permissions would be able to see those list items whenever they visited our page. So, rather than giving people customized list views, he made a method where users fill out a form on our page, which is then sent to a "gateway" list via JQuery POST, and this item is then copied to our list via workflow and then deleted from the gateway list. Users who are considered "privileged" (according to another list whose information is called via REST) are then able to go to our site, see created list items, and "assign" them to other users who fall within that item's portfolio by filling out & submitting a different form.
That "assigning" part is where I'm having trouble. In this case "Assigning" also involves POSTing that form as a line of data to that gateway list with the name of the user or group who is now assigned to an item. A workflow reads that the newly created item is someone assigning a tasker, so it takes the ID of the tasker and adds the included users/groups to have List Item Permissions to view & edit that List Item. It's safe, since users don't need to see any lists to do any of this and they only ever see people in their groups or tasks that they've been given List Item permissions to see.
Unfortunately, it's super buggy. We're stuck using the client's hosting and the client's SharePoint instance online, and at any given time the workflow can just up and decide it doesn't want to work, or that the permissions we set it with aren't high enough anymore. We can't do anything about this, but we now have privileged users who want to assign items to people but at any given time can be stopped from doing so.
What would really help me is the ability to create a form that I can allow our "privileged" users to see that directly sets the List Item permissions for an item without using a gateway list or a workflow.
I'm imagining this as follows:
1. Privileged user clicks a button on my page while viewing an item
2. User is taken to a custom list form that I can create in Designer (the client loaded security software onto their SP instance that breaks InfoPath so I can't even open it) that gives them the ability to select users/groups from a list.
3. Upon clicking Submit/Save, the List Item Permissions for that list are updated. I'll probably send the user to a confirmation page
Please let me know if something like this is possible.