changing user permissions dynamically

Question

I am designing a system on SharePoint. There is a approval list for the items. The members can approve, reject and edit the items. One from approval list has to fill the "assigned to" field in the item while approving it. The user who is added to "assigned to" field should able to edit the content of the item after it is approved. So, how can I give the edit permission to the users after they are added assigned to field of a specific item?

The situation is:

approval list: A, B ,C (edit, view permission)

users: x,y,z .... (no permission, view after approval)

items: item1, item2, item3....

items are invisible. A approved the item1 and added X to "assigned to" field. It means This item is under X's responsibility. But X hasn't got edit permission. we can't give edit permission to X for every item. He should edit the items after he is written into the "assigned to" field.

How can I create this workflow in SharePoint? Please urgent help needed.

Answer 1

Not 100% sure it is fully clear what you are trying to achieve, but...

From my understanding of your question, what you want to do is assign unique permissions to a list item based on a value in the assigned to field of that list item.

The way I would do this is to create an event handler for your items list that runs when the list item is updated/approved etc. It would:-

1. Read the value in the assigned to field
2. Break permission inheritance on the list item
3. Assign the user in the assigned to field edit permissions to that item.

Answer 2

as Paul Lucas mentioned, you could do it using an ItemAdded and ItemUpdated event receiver and methods like these, with added exception handling

public override void ItemUpdated(SPItemEventProperties properties)
{
    base.ItemUpdated(properties);
    SPListItem item = properties.ListItem;
    SetRights(item, ((SPFieldUserValue)item["AssignedTo"]).User, SPRoleType.Reader);                     
}

private void SetRights(SPListItem item, SPPrincipal principal, SPRoleType role)
{
    SPRoleDefinition RoleDefinition = item.ParentList.ParentWeb.RoleDefinitions.GetByType(role);
    SPRoleAssignment RoleAssignment = new SPRoleAssignment(principal);
    RoleAssignment.RoleDefinitionBindings.Add(RoleDefinition);

    if (!item.HasUniqueRoleAssignments)
    {
        item.BreakRoleInheritance(true);
    }
    item.RoleAssignments.Add(RoleAssignment);
    item.SystemUpdate(false);
}