I'm wondering how other developers configure permissioning for webforms where related contacts are shown. Here's the setup:
- webform is configured to display two contacts -- the logged in user and a related org
- the "existing contact" element is used for both contacts. the issue arises for the related org contact
- we are using the static widget and the option to use contact id from url
However, when cid2=# is passed in the URL, it doesn't load the organization contact unless the logged in user has the "edit all contacts" permission. I understand I could flag the relationship as permissioned and use the relationship ACL extension, but I don't really want to universally grant the user the ability to edit the related contact -- just grant access in this webform. And I definitely don't want to grant the edit all contacts permission.
Any suggestions on ways to handle this? Should I just modify permissions via hooks on this form? It seems like this would be a common use case so I'm wondering if there's something in the webform integration that I'm missing.