Power Apps - Power Automate User Permissions

[ogend]

Hello Power App Gurus, 

I want to build a file transfer app that takes a file as an attachment, calls Power Automate flow, saves the file on Sharepoint (doc library), but sets an item level permission  limited to the app user (sender) and whoever they set up as a recipient (passed from power apps (Office 365 User Search).

      1. I am starting from having doc library open to all users

1. Power App Calls Power Automate Flow, Flow creates a file on sharepoint
2. Flow stops sharing the file (only library owners have access  at that point)
3. Flows grants access to selected users (passed from powerapps)

So far what I have works perfectly when I am the user and I am the sharepoint document library owner, however  when not a document library owner tries to use the app - they create the file successfully but they can't stop sharing leaving the file accessible by all users (flow fails)

What's confusing to me - when I look at the flow- it shows my credentials for connections, not the users', but somehow the  flow knows that whoever pushes ‘send’ button in powerapps is not the site owner.

Do I have any options to build this app in a way that  the user can perform stop sharing actions without being the library owner, given that the service account used to build the app is the library owner?

Thank you!

[Pstork1 · Accepted solution]

Flows that are started with a manual trigger, including the Power Apps trigger, run in the context of the user that starts the flow.  So when a user without the manage permissions permission uses your app the flow runs in their security context.  So they can't break inheritance on the file and change the permission.

The only way to do what you are requesting is to have the flow use an automatic trigger, like when a file is created.  If the additional information needed for the flow, like who owns the file and who should be given permission are in the metadata then the flow can run as the service account and make the changes.  The key is using an automatic trigger.

[ogend]

@Pstork1 This is super-helpful, thank you!