We'd like to develop an on-provider web app which can import documents from a Sharepoint instance. Right now we are focusing on Sharepoint Online, but later on, we will create on-premise solutions as well. We want to stick with REST API because we use different technologies accessing the Sharepoint site which includes .NET Core which doesn't have a fully implemented SharepointContext and TokenHelper class.
How can I give permission to any user who has read / download permission on the site to use our app? Since we are not on the Sharepoint site, we have to use low trust authorization, but we don't want our users to have Manage permissions on the Sharepoint site.
The other question is how to authorize our app to include user permissions as well. I've already come to a solution where we could authorize the App, but we need to do it with a user who has Manage permission on the site, and the Context token we got didn't include any user information like it is mentioned on the Sharepoint developer site. User+Add-in policy
Maybe my question is a bit confusing, but I am confused now too.
Any suggestion is welcome.