Is it possible to have a 'Read-only' Document-set and yet still Contribute Files inside it?

Question

I'm struggling to get my head around how to do something, with the added complication of that fact I don't actually know that is actually possible.

I am setting up a Document Library to contain Project information. Each Project is represented by a custom Document Set in the root of the Library with Project Files to be stored as different content types within each Project Document Set.

Essentially I would like to achieve the following for a user/group accessing the Document Library.

1. The Root of the Document Library is Read-only - this way the user can not create new projects (I have CSOM code for this) , they can not edit the meta-data on the project nor delete it. Essentially they see a read-only list of existing Projects.

2. However when they drill into an individual Project they should be able to Contribute documents to the Project as they wish (so add/edit/delete etc.)

I have some CSOM code which creates the Document Set but whatever I try I can't seem to achieve both 1 and 2 at the same time either through breaking permissions in the code or adjusting permissions in Sharepoint (Online btw).

As I say - I don't even know if this is possible? Any help, advice or alternative suggestions much appreciated.

Answer 1

I assume you are trying to achieve this in CSOM with the user permissions (e.g. Javascript running in the web client).

2 suggestions:

1. Create a custom Permission Level which you set on the Document Sets: Can Change Permissions and Add but not Edit or Delete. Given this permission level you CSOM code can add documents, then break permissions on them and assign a standard edit permission level on the documents.
2. Create a provider hosted app which can run operations with elevated privileges.

Both these solutions don't work with some standard SharePoint functionality, e.g. drag-n-drop files to the Document Set, using the "New" button etc.

Answer 2

I'd probably make each project have it's own document library with all your document set/content types in it with unique permissions as desired in this scenario. Users could add/edit documents as needed.

If you need a new project spun up, create a new document library, and permission it as desired.