Add access_rights into documentation and changelog.

CHANGELOG.md

@@ -5,7 +5,8 @@
 ### Upgrade requirements
 ### Changes
 - [#28](https://github.com/jirik/layman/issues/28) New environment variable [LAYMAN_PRIME_SCHEMA](doc/env-settings.md#LAYMAN_PRIME_SCHEMA). 
-- [#28](https://github.com/jirik/layman/issues/28) New REST endpoint [GET Users](doc/rest.md#get-users) with list of all users registered in Layman. 
+- [#28](https://github.com/jirik/layman/issues/28) New REST endpoint [GET Users](doc/rest.md#get-users) with list of all users registered in Layman.
+- [#28](https://github.com/jirik/layman/issues/28) New attribute `access_rights` added to [GET Layers](doc/rest.md#get-layers), [GET Layer](doc/rest.md#get-layer), [GET Maps](doc/rest.md#get-maps) and [GET Map](doc/rest.md#get-map) responses. New parameters `access_rights.read` and `access_rights.write` added to [POST Layers](doc/rest.md#post-layers), [PATCH Layer](doc/rest.md#patch-layer), [POST Maps](doc/rest.md#post-maps) and [PATCH Map](doc/rest.md#patch-map) requests.
 
 ## v1.7.2
 2020-11-09

doc/models.md

@@ -57,7 +57,13 @@
 - Username can re reserved by [PATCH Current User](rest.md#patch-current-user)
 - Anonymous user has no username
 
+## Roles
+- Role is any group of users. One user can be assigned to multiple roles.
+- Each role is identified by name that is unique among all roles.
+- The name is upper-case (in contrast with [username](#username)).
+- Roles can be used for assigning access rights.
+
 ## Workspace
 - Workspace is group of Layman REST API endpoints whose URL path starts with the same `username` (i. e. `/rest/<username>`)
 - User represented by the `username` is considered as **owner** of the workspace
-- Workspace consists of all [map and layer endpoints](rest.md) endpoints
+- Workspace consists of all [map and layer endpoints](rest.md) endpoints

doc/rest.md

@@ -39,6 +39,9 @@ JSON array of objects representing available layers with following structure:
 - **title**: String. Title of the layer.
 - **uuid**: String. UUID of the layer.
 - **url**: String. URL of the layer. It points to [GET Layer](#get-layer).
+- **access_rights**:
+  - **read**: Array of strings. Names of [users](./models.md#user) and [roles](./models.md#roles) with [read access](./security.md#Authorization).
+  - **write**: Array of strings. Names of [users](./models.md#user) and [roles](./models.md#roles) with [write access](./security.md#Authorization).
 
 ### POST Layers
 Publish vector data file as new layer of WMS and WFS.
@@ -50,7 +53,7 @@ Processing chain consists of few steps:
 - generate thumbnail image
 - publish metadata record to Micka
 
-If user directory, database schema, GeoServer's worskpace, or GeoServer's datastore does not exist yet, it is created on demand.
+If user directory, database schema, GeoServer's workspace, or GeoServer's datastore does not exist yet, it is created on demand.
 
 Response to this request may be returned sooner than the processing chain is finished to enable asynchronous processing. Status of processing chain can be seen using [GET Layer](#get-layer) and **status** properties of layer sources (wms, wfs, thumbnail, db_table, file, sld, metadata).
 
@@ -87,6 +90,12 @@ Body parameters:
 - *sld*, SLD file
    - by default default SLD style of GeoServer is used
    - uploading of additional style files, e.g. point-symbol images or fonts is not supported
+- *access_rights.read*, string
+   - array of names of [users](./models.md#user) and [roles](./models.md#roles) separated by comma (`,`)
+   - these users or/and roles will get [read access](./security.md#Authorization) to this publication
+- *access_rights.write*, string
+   - array of names of [users](./models.md#user) and [roles](./models.md#roles) separated by comma (`,`)
+   - these users or/and roles will get [write access](./security.md#Authorization) to this publication
 
 #### Response
 Content-Type: `application/json`
@@ -158,6 +167,9 @@ JSON object with following structure:
   - *comparison_url*: String. URL of [GET Layer Metadata Comparison](#get-layer-metadata-comparison).
   - *status*: Status information about metadata import and availability. See [GET Layer](#get-layer) **wms** property for meaning.
   - *error*: If status is FAILURE, this may contain error object.
+- **access_rights**:
+  - **read**: Array of strings. Names of [users](./models.md#user) and [roles](./models.md#roles) with [read access](./security.md#Authorization).
+  - **write**: Array of strings. Names of [users](./models.md#user) and [roles](./models.md#roles) with [write access](./security.md#Authorization).
 
 ### PATCH Layer
 Update information about existing layer. First, it deletes sources of the layer, and then it publishes them again with new parameters. The processing chain is similar to [POST Layers](#post-layers).
@@ -185,6 +197,12 @@ Body parameters:
    - Taken into account only if `file` is provided.
 - *sld*, SLD file
    - If provided, current layer thumbnail will be temporarily deleted and created again using the new style.
+- *access_rights.read*, string
+   - array of names of [users](./models.md#user) and [roles](./models.md#roles) separated by comma (`,`)
+   - these users or/and roles will get [read access](./security.md#Authorization) to this publication
+- *access_rights.write*, string
+   - array of names of [users](./models.md#user) and [roles](./models.md#roles) separated by comma (`,`)
+   - these users or/and roles will get [write access](./security.md#Authorization) to this publication
 
 #### Response
 Content-Type: `application/json`
@@ -313,6 +331,9 @@ JSON array of objects representing available maps with following structure:
 - **title**: String. Title of the map.
 - **uuid**: String. UUID of the map.
 - **url**: String. URL of the map. It points to [GET Map](#get-map).
+- **access_rights**:
+  - **read**: Array of strings. Names of [users](./models.md#user) and [roles](./models.md#roles) with [read access](./security.md#Authorization).
+  - **write**: Array of strings. Names of [users](./models.md#user) and [roles](./models.md#roles) with [write access](./security.md#Authorization).
 
 ### POST Maps
 Publish new map composition. Accepts JSON valid against [map-composition schema](https://github.com/hslayers/hslayers-ng/wiki/Composition-schema) used by [Hslayers-ng](https://github.com/hslayers/hslayers-ng).
@@ -345,6 +366,12 @@ Body parameters:
    - by default it is either `title` attribute of JSON root object or map name
 - *description*
    - by default it is either `abstract` attribute of JSON root object or empty string
+- *access_rights.read*, string
+   - array of names of [users](./models.md#user) and [roles](./models.md#roles) separated by comma (`,`)
+   - these users or/and roles will get [read access](./security.md#Authorization) to this publication
+- *access_rights.write*, string
+   - array of names of [users](./models.md#user) and [roles](./models.md#roles) separated by comma (`,`)
+   - these users or/and roles will get [write access](./security.md#Authorization) to this publication
 
 #### Response
 Content-Type: `application/json`
@@ -394,6 +421,9 @@ JSON object with following structure:
   - *comparison_url*: String. URL of [GET Map Metadata Comparison](#get-map-metadata-comparison).
   - *status*: Status information about metadata import and availability. See [GET Map](#get-map) 
   - *error*: If status is FAILURE, this may contain error object.
+- **access_rights**:
+  - **read**: Array of strings. Names of [users](./models.md#user) and [roles](./models.md#roles) with [read access](./security.md#Authorization).
+  - **write**: Array of strings. Names of [users](./models.md#user) and [roles](./models.md#roles) with [write access](./security.md#Authorization).
 
 ### PATCH Map
 Update information about existing map. First, it deletes sources of the map, and then it publishes them again with new parameters. The processing chain is similar to [POST Maps](#post-maps).
@@ -412,6 +442,12 @@ Body parameters:
    - by default it is either `title` attribute of JSON root object or map name
 - *description*, string `.+`
    - by default it is either `abstract` attribute of JSON root object or empty string
+- *access_rights.read*, string
+   - array of names of [users](./models.md#user) and [roles](./models.md#roles) separated by comma (`,`)
+   - these users or/and roles will get [read access](./security.md#Authorization) to this publication
+- *access_rights.write*, string
+   - array of names of [users](./models.md#user) and [roles](./models.md#roles) separated by comma (`,`)
+   - these users or/and roles will get [write access](./security.md#Authorization) to this publication
 
 #### Response
 Content-Type: `application/json`