So, long story short, I need to allow a CMS user to access nodes (from a MNTP for example) outside of that logged in user's start node. So, something like this:

Hopefully that makes sense, but basically User 1 will have a start node under Global Site. They need to be able to select nodes, using MNTP, from Global Content Elements which exists above their allowed level.

I thought I might be able to just intercept the request, replace the user (with admin) and it would all work, but this doesn't seem to have made any difference:

This has stumped me, and I'm happy to look at alternative solutions, but this is what I've got so far:

public class CustomTreeApiHandler : DelegatingHandler
{
    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        IUser user = UmbracoContext.Current.Security.CurrentUser;

        // If current user is not admin
        if (user != null && user.Name != "admin")
        {
            // Catch content tree load events
            switch (request.RequestUri.AbsolutePath.ToLower())
            {
                case "/umbraco/backoffice/umbracotrees/applicationtree/getapplicationtrees":
                    return FilterAllowedContentNodes(request, cancellationToken);
                default:
                    return base.SendAsync(request, cancellationToken);
            }
        }

        return base.SendAsync(request, cancellationToken);
    }

    private Task<HttpResponseMessage> FilterAllowedContentNodes(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        IUserService userService = ApplicationContext.Current.Services.UserService;

        IPrincipal principal =
            new ClaimsPrincipal(new UmbracoBackOfficeIdentity(new ClaimsIdentity(),
                Mapper.Map<UserData>(userService.GetUserById(0))));

        request.SetUserPrincipal(principal);

        return base.SendAsync(request, cancellationToken);
    }
}

And this:

public class UmbracoEvents : ApplicationEventHandler
{
    protected override void ApplicationStarting(UmbracoApplicationBase umbracoApplication,
        ApplicationContext applicationContext)
    {
        //Add a web api handler. Here we can change the values from each web api call.
        GlobalConfiguration.Configuration.MessageHandlers.Add(new CustomTreeApiHandler());
    }
}

Does anyone have any bright ideas as to what I can do here? I know this is a problem that comes up a few times every year, but I've yet to see a solution for it (to be honest it would be great if this was built in to the core, I know we have permissions but this is different).