Get user privileges on item via Sitecore RESTful API

Question

I am looking for a good way to figure out what privileges a user has via the Sitecore RESTful API.

For example, I can use the RESTful API for ItemService:

/sitecore/api/ssc/item/{itemId}?fields=__Security&database=master&includeStandardTemplateFields=true

This allows me to get the security string set directly on an item and looks like this:

"__Security": "au|sitecore\\User|pe|+item:read|+item:rename|"

However, if the user has rights to that item that are inherited from the parent, it does not show up in the __Security field.

Is there another way I can use the Sitecore RESTful API to determine which privileges a user has on a Sitecore item?

Answer 1

Sitecore security model does provide API for determining user access rights (see Sitecore.Security.AccessControl.ItemAccess class). AFAIK there is no any web service exposing it but you can easily create one using Sitecore Services Client:

public class AccessController : ServicesApiController
{
    [Route("sitecore/api/ssc/itemaccess/{database}/{itemId}")]
    public IHttpActionResult Get(string database, string itemId)
    {
        // simplified. no null check
        var item = Database.GetDatabase(database).GetItem(itemId);
        var model = new ItemAccessDto
        {
            CanRead = item.Access.CanRead(),
            CanWrite = item.Access.CanWrite(),
            CanCreate = item.Access.CanCreate(),
            CanDelete = item.Access.CanDelete(),
        };

        return Ok(model);
    }

    private class ItemAccessDto
    {
        [JsonProperty("can_read")]
        public bool CanRead { get; set; }

        [JsonProperty("can_write")]
        public bool CanWrite { get; set; }

        [JsonProperty("can_create")]
        public bool CanCreate { get; set; }

        [JsonProperty("can_delete")]
        public bool CanDelete { get; set; }
    }
}

Now you can request user access info. That is what an anonymous user can do with the default Home item:

http://mysite/sitecore/api/ssc/itemaccess/master/110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9

Result:
{
    "can_read": true,
    "can_write": false,
    "can_create": false,
    "can_delete": false
}