geovisio 2.10.0__py3-none-any.whl → 2.11.0__py3-none-any.whl

geovisio/web/annotations.py

@@ -6,9 +6,9 @@ from geovisio.utils.annotations import (
     get_annotation,
     update_annotation,
     InputAnnotationShape,
+    delete_annotation,
 )
 from geovisio.utils.tags import SemanticTagUpdate
-from geovisio.web.utils import accountIdOrDefault
 from geovisio.utils.params import validation_error
 from geovisio import errors
 from pydantic import BaseModel, ValidationError, Field
@@ -73,8 +73,7 @@ def postAnnotationNonStacAlias(itemId, account):
                         $ref: '#/components/schemas/GeoVisioAnnotation'
     """
 
-    account_id = UUID(accountIdOrDefault(account))
-
+    account_id = account.id
     pic = db.fetchone(
         current_app,
         "SELECT 1 FROM pictures WHERE id = %(pic)s",
@@ -352,3 +351,97 @@ def patchAnnotation(collectionId, itemId, annotationId, account):
             description: The annotation was empty, it has been correctly deleted
     """
     return patchAnnotationNonStacAlias(annotationId=annotationId, account=account)
+
+
+@bp.route("/collections/<uuid:collectionId>/items/<uuid:itemId>/annotations/<uuid:annotationId>", methods=["DELETE"])
+@auth.login_required()
+def deleteAnnotation(collectionId, itemId, annotationId, account):
+    """Delete an annotation
+
+    It is mandatory to be authenticated to delete an annotation, but anyone can delete do it. The changes are tracked in the history.
+
+    Note that this is the same route as `DELETE /api/annotations/<uuid:annotationId>` but you need to know the picture's and collection's IDs.
+    ---
+    tags:
+        - Semantics
+    parameters:
+        - name: collectionId
+          in: path
+          description: ID of collection
+          required: true
+          schema:
+              type: string
+        - name: itemId
+          in: path
+          description: ID of item
+          required: true
+          schema:
+              type: string
+        - name: annotationId
+          in: path
+          description: ID of annotation
+          required: true
+          schema:
+              type: string
+    security:
+        - bearerToken: []
+        - cookieAuth: []
+    responses:
+        204:
+            description: The Annotation has been correctly deleted
+    """
+    with db.conn(current_app) as conn:
+
+        annotation = get_annotation(conn, annotationId)
+        if not annotation or annotation.picture_id != itemId:
+            raise errors.InvalidAPIUsage(_("Annotation %(p)s not found", p=annotationId), status_code=404)
+
+        delete_annotation(conn, annotation)
+
+    return "", 204
+
+
+@bp.route("/annotations/<uuid:annotationId>", methods=["DELETE"])
+@auth.login_required()
+def deleteAnnotationNonStacAlias(annotationId, account):
+    """Delete an annotation.
+
+    It is mandatory to be authenticated to delete an annotation, but anyone can delete do it. The changes are tracked in the history.
+
+    The is an alias to the `DELETE /api/collections/<collectionId>/items/<itemId>/annotations/<annotationId>` endpoint (but you don't need to know the collection/item ID here).
+    ---
+    tags:
+        - Semantics
+    parameters:
+        - name: collectionId
+          in: path
+          description: ID of collection
+          required: true
+          schema:
+              type: string
+        - name: itemId
+          in: path
+          description: ID of item
+          required: true
+          schema:
+              type: string
+        - name: annotationId
+          in: path
+          description: ID of annotation
+          required: true
+          schema:
+              type: string
+    security:
+        - bearerToken: []
+        - cookieAuth: []
+    responses:
+        204:
+            description: The Annotation has been correctly deleted
+    """
+    with db.conn(current_app) as conn:
+        annotation = get_annotation(conn, annotationId)
+        if not annotation:
+            raise errors.InvalidAPIUsage(_("Annotation %(p)s not found", p=annotationId), status_code=404)
+        delete_annotation(conn, annotation, account.id)
+
+    return "", 204

geovisio/web/collections.py

@@ -11,6 +11,9 @@ from geovisio.web.params import (
     parse_collection_filter,
     parse_collection_sortby,
     parse_collections_limit,
+    parse_boolean,
+    Visibility,
+    check_visibility,
 )
 from geovisio.utils.sequences import (
     STAC_FIELD_MAPPINGS,
@@ -22,12 +25,12 @@ from geovisio.utils.fields import SortBy, SortByField, SQLDirection, BBox, parse
 from geovisio.web.rss import dbSequencesToGeoRSS
 from psycopg.rows import dict_row
 from psycopg.sql import SQL
-from pydantic import BaseModel, Field, ValidationError, field_validator
+from pydantic import BaseModel, Field, ValidationError, field_validator, model_validator
 from flask import current_app, request, url_for, Blueprint, stream_with_context
 from flask_babel import gettext as _
 from geovisio.web.utils import (
     STAC_VERSION,
-    accountIdOrDefault,
+    accountOrDefault,
     cleanNoneInDict,
     cleanNoneInList,
     dbTsToStac,
@@ -66,6 +69,18 @@ def userAgentToClient(user_agent: Optional[str] = None) -> UploadClient:
         return UploadClient.other
 
 
+def retrocompatible_sequence_status(dbSeq, explicit=False):
+    """We used to display status='hidden' for hidden sequence, now that the status and the visiblity has been split, we still return a 'hidden' status for retrocompatibility"""
+    db_status = dbSeq.get("status")
+    if db_status not in ("ready", "hidden"):
+        # for all preparing/error/deleted status, we display the real status
+        return db_status
+    # Note: hidden is a deprecated status value, we consider hidden pictures as ready (it's the visibility that matters)
+    # if the sequence is 'ready' we do not display any status (as it is the default state)
+    # Note that some route are explicit about the default value, so we return it
+    return "ready" if explicit else None
+
+
 def dbSequenceToStacCollection(dbSeq, description="A sequence of geolocated pictures"):
     """Transforms a sequence extracted from database into a STAC Collection
 
@@ -81,8 +96,15 @@ def dbSequenceToStacCollection(dbSeq, description="A sequence of geolocated pict
     object
         The equivalent in STAC Collection format
     """
+    if dbSeq.get("is_sequence_visible_by_user") is False or dbSeq.get("status") == "deleted":
+        # if the sequence is not visible for a given user (it might be because it has been deleted or hidden), we only display its id and its status
+        return {"id": dbSeq["id"], "geovisio:status": "deleted"}
     mints, maxts = dbSeq.get("mints"), dbSeq.get("maxts")
     nb_pic = int(dbSeq.get("nbpic")) if "nbpic" in dbSeq else None
+
+    # we do not want to add a `geovisio:status` = 'ready', we only use it for hidden/deleted status
+    exposed_status = retrocompatible_sequence_status(dbSeq)
+
     return removeNoneInDict(
         {
             "type": "Collection",
@@ -99,9 +121,8 @@ def dbSequenceToStacCollection(dbSeq, description="A sequence of geolocated pict
             "license": current_app.config["API_PICTURES_LICENSE_SPDX_ID"],
             "created": dbTsToStac(dbSeq["created"]),
             "updated": dbTsToStac(dbSeq.get("updated")),
-            "geovisio:status": (
-                dbSeq.get("status") if dbSeq.get("status") != "ready" else None
-            ),  # we do not want to add a `geovisio:status` = 'ready', we only use it for hidden/deleted status
+            "geovisio:status": exposed_status,
+            "geovisio:visibility": dbSeq.get("visibility"),
             "geovisio:sorted-by": dbSeq.get("current_sort"),
             "geovisio:upload-software": userAgentToClient(dbSeq.get("user_agent")).value,
             "geovisio:length_km": dbSeq.get("length_km"),
@@ -208,6 +229,17 @@ def getAllCollections():
             default: json
         - $ref: '#/components/parameters/STAC_bbox'
         - $ref: '#/components/parameters/STAC_collections_filter'
+
+        - name: show_deleted
+          in: query
+          description: >-
+            Show the deleted collections in a separate `deleted_collections` field. Usefull when crawling the catalog to know which collections have been deleted.
+            The deleted collections are returned in the same `collections` list, but the deleted collection will only have their `id` and a `deleted` `geovisio:status`, without additional fields.
+            Note that thus, when using this parameter, the response does no longer follow the STAC format for deleted collections.
+          required: false
+          schema:
+            type: boolean
+            default: false
         - name: datetime
           in: query
           required: false
@@ -243,7 +275,6 @@ def getAllCollections():
                     schema:
                         $ref: '#/components/schemas/GeoVisioCollectionsRSS'
     """
-
     args = request.args
 
     # Expected output format
@@ -267,11 +298,21 @@ def getAllCollections():
         sortBy.fields.append(SortByField(field=STAC_FIELD_MAPPINGS["id"], direction=SQLDirection.ASC))
 
     collection_request = CollectionsRequest(sort_by=sortBy)
+    collection_request.show_deleted = parse_boolean(request.args.get("show_deleted"))
 
     # Filter parameter
-    collection_request.user_filter = parse_collection_filter(request.args.get("filter"))
+    cql_filter = request.args.get("filter")
+    if cql_filter and "status IN ('deleted','ready') AND" in cql_filter:
+        # Note handle a bit or retrocompatibility: we used to accept a `status` filter for the metacatalog, this we deprecated this in favour of the `show_deleted` parameter
+        collection_request.show_deleted = True
+        cql_filter = cql_filter.replace("status IN ('deleted','ready') AND", "")
+    collection_request.user_filter = parse_collection_filter(cql_filter)
+
     collection_request.pagination_filter = parse_collection_filter(request.args.get("page"))
 
+    if collection_request.show_deleted and format == "rss":
+        raise errors.InvalidAPIUsage(_("RSS format does not support deleted sequences"), status_code=400)
+
     # Limit parameter
     collection_request.limit = parse_collections_limit(request.args.get("limit"))
 
@@ -313,17 +354,34 @@ def getAllCollections():
                 created_after=args.get("created_after"),
             ),
         },
+        {
+            "title": "Queryables",
+            "href": url_for("queryables.collection_queryables", _external=True),
+            "rel": "http://www.opengis.net/def/rel/ogc/1.0/queryables",
+            "type": "application/schema+json",
+        },
     ]
 
     with db.conn(current_app) as conn:
-        datasetBounds = get_dataset_bounds(conn, collection_request.sort_by, additional_filters=collection_request.user_filter)
-        if datasetBounds is None:
-            return ({"collections": [], "links": links}, 200, {"Content-Type": "application/json"})
-        creation_date_index = collection_request.sort_by.get_field_index("created")
-        if collection_request.created_after and collection_request.created_after > datasetBounds.last[creation_date_index]:
-            raise errors.InvalidAPIUsage(_("There is no collection created after %(d)s", d=collection_request.created_after))
-        if collection_request.created_before and collection_request.created_before < datasetBounds.first[creation_date_index]:
-            raise errors.InvalidAPIUsage(_("There is no collection created before %(d)s", d=collection_request.created_before))
+        account_to_query = auth.get_current_account()
+        if account_to_query is not None and account_to_query.can_see_all():
+            meta_filter = [SQL("TRUE")]
+        else:
+            meta_filter = [SQL("is_sequence_visible_by_user(s, %(account_to_query)s)")]
+        if collection_request.user_filter is not None:
+            meta_filter.append(collection_request.user_filter)
+        datasetBounds = get_dataset_bounds(
+            conn,
+            collection_request.sort_by,
+            additional_filters=SQL(" AND ").join(meta_filter),
+            account_to_query_id=account_to_query.id if account_to_query is not None else None,
+        )
+        if datasetBounds is not None:
+            creation_date_index = collection_request.sort_by.get_field_index("created")
+            if collection_request.created_after and collection_request.created_after > datasetBounds.last[creation_date_index]:
+                raise errors.InvalidAPIUsage(_("There is no collection created after %(d)s", d=collection_request.created_after))
+            if collection_request.created_before and collection_request.created_before < datasetBounds.first[creation_date_index]:
+                raise errors.InvalidAPIUsage(_("There is no collection created before %(d)s", d=collection_request.created_before))
 
     db_collections = get_collections(collection_request)
 
@@ -332,34 +390,32 @@ def getAllCollections():
         return (dbSequencesToGeoRSS(db_collections.collections).rss(), 200, {"Content-Type": "text/xml"})
 
     stac_collections = [dbSequenceToStacCollection(c) for c in db_collections.collections]
-    pagination_links = []
-
-    additional_filters = request.args.get("filter")
+    if datasetBounds is not None:
+        pagination_links = []
 
-    pagination_links = sequences.get_pagination_links(
-        route="stac_collections.getAllCollections",
-        routeArgs={"limit": collection_request.limit},
-        sortBy=sortBy,
-        datasetBounds=datasetBounds,
-        dataBounds=db_collections.query_bounds,
-        additional_filters=additional_filters,
-    )
+        additional_filters = request.args.get("filter")
 
-    # Compute paginated links
-    links.extend(pagination_links)
+        # Compute paginated links
+        pagination_links = sequences.get_pagination_links(
+            route="stac_collections.getAllCollections",
+            routeArgs={"limit": collection_request.limit},
+            sortBy=sortBy,
+            datasetBounds=datasetBounds,
+            dataBounds=db_collections.query_bounds,
+            additional_filters=additional_filters,
+            showDeleted=collection_request.show_deleted,
+        )
+        links.extend(pagination_links)
 
     return (
-        {
-            "collections": stac_collections,
-            "links": links,
-        },
+        removeNoneInDict({"collections": stac_collections, "links": links}),
         200,
         {"Content-Type": "application/json"},
     )
 
 
 @bp.route("/collections/<uuid:collectionId>")
-def getCollection(collectionId):
+def getCollection(collectionId, account=None):
     """Retrieve metadata of a single collection
     ---
     tags:
@@ -380,17 +436,24 @@ def getCollection(collectionId):
                         $ref: '#/components/schemas/GeoVisioCollection'
     """
 
-    account = auth.get_current_account()
+    account = account or auth.get_current_account()
 
     params = {
         "id": collectionId,
         # Only the owner of an account can view sequence not 'ready'
         "account": account.id if account is not None else None,
     }
+    perm_filter = SQL("")
+    if account is not None and account.can_see_all():
+        # admins can see all the collections
+        perm_filter = SQL("TRUE")
+    else:
+        perm_filter = SQL("is_sequence_visible_by_user(s, %(account)s)")
 
     record = db.fetchone(
         current_app,
-        """SELECT
+        SQL(
+            """SELECT
                 s.id,
                 s.metadata->>'title' AS name,
                 ST_XMin(s.bbox) AS minx,
@@ -398,6 +461,7 @@ def getCollection(collectionId):
                 ST_XMax(s.bbox) AS maxx,
                 ST_YMax(s.bbox) AS maxy,
                 s.status AS status,
+                s.visibility,
                 accounts.name AS account_name,
                 s.account_id AS account_id,
                 s.upload_set_id,
@@ -434,9 +498,10 @@ def getCollection(collectionId):
                 JOIN sequences_pictures sp ON sp.seq_id = %(id)s AND sp.pic_id = p.id
             ) a
             WHERE s.id = %(id)s
-                AND (s.status != 'hidden' OR s.account_id = %(account)s)
+                AND {perm_filter}
                 AND s.status != 'deleted'
-        """,
+        """
+        ).format(perm_filter=perm_filter),
         params,
         row_factory=dict_row,
     )
@@ -475,12 +540,10 @@ def getCollectionThumbnail(collectionId):
                         type: string
                         format: binary
     """
-    account = auth.get_current_account()
-
     params = {
         "seq": collectionId,
         # Only the owner of an account can view pictures not 'ready'
-        "account": account.id if account is not None else None,
+        "account": auth.get_current_account_id(),
     }
 
     records = db.fetchone(
@@ -493,6 +556,7 @@ def getCollectionThumbnail(collectionId):
             WHERE
                 sp.seq_id = %(seq)s
                 AND (p.status = 'ready' OR p.account_id = %(account)s)
+                AND is_picture_visible_by_user(p, %(account)s)
                 AND is_sequence_visible_by_user(s, %(account)s)
             ORDER BY RANK ASC
             LIMIT 1""",
@@ -558,12 +622,12 @@ def postCollection(account=None):
     metadata = removeNoneInDict(metadata)
 
     # Create sequence folder
-    accountId = accountIdOrDefault(account)
-    seqId = sequences.createSequence(metadata, accountId, request.user_agent.string)
+    account = accountOrDefault(account)
+    seqId = sequences.createSequence(metadata, account.id, request.user_agent.string)
 
     # Return created sequence
     return (
-        getCollection(seqId)[0],
+        getCollection(seqId, account=account)[0],
         200,
         {
             "Content-Type": "application/json",
@@ -579,7 +643,21 @@ class PatchCollectionParameter(BaseModel):
     relative_heading: Optional[int] = None
     """The relative heading (in degrees), offset based on movement path (0° = looking forward, -90° = looking left, 90° = looking right). For single picture collections, 0° is heading north). Headings are unchanged if this parameter is not set."""
     visible: Optional[bool] = None
-    """Should the sequence be publicly visible ?"""
+    """Should the sequence be publicly visible ?
+    
+    This parameter is deprecated in favor of the finer grained `visibility` parameter.
+    `visible=true` is equivalent to `visibility=anyone`.
+    `visible=false` is equivalent to `visibility=logged-only`.
+    """
+    visibility: Optional[Visibility] = None
+    """Visibility of the sequence. Can be set to:
+    * `anyone`: the sequence is visible to anyone
+    * `owner-only`: the sequence is visible to the owner and administrator only
+    * `logged-only`: the sequence is visible to logged users only
+
+    This visibility can also be set for each picture individually, using the `visibility` field of the pictures.
+    If not set at the sequence level, it will default to the visibility of the `upload_set` and if not set the default visibility of the `account` and if not set the default visibility of the instance.
+    """
     title: Optional[str] = Field(max_length=250, default=None)
     """The sequence title (publicly displayed)"""
     sortby: Optional[str] = None
@@ -624,9 +702,28 @@ If unset, sort order is unchanged."""
     def parse_relative_heading(cls, value):
         return parse_relative_heading(value)
 
+    @model_validator(mode="after")
+    def validate(self):
+        if self.visibility is not None and self.visible is not None:
+            raise errors.InvalidAPIUsage(_("Visibility and visible parameters are mutually exclusive parameters"))
+        # handle retrocompatibility on the visible parameter
+        if self.visible is not None:
+            self.visibility = Visibility.anyone if self.visible is True else Visibility.owner_only
+        return self
+
     def has_only_semantics_updates(self):
         return self.model_fields_set == {"semantics"}
 
+    @field_validator("visibility", mode="after")
+    @classmethod
+    def validate_visibility(cls, visibility):
+        if not check_visibility(visibility):
+            raise errors.InvalidAPIUsage(
+                _("The logged-only visibility is not allowed on this instance since anybody can create an account"),
+                status_code=400,
+            )
+        return visibility
+
 
 @bp.route("/collections/<uuid:collectionId>", methods=["PATCH"])
 @auth.login_required()
@@ -692,14 +789,15 @@ def patchCollection(collectionId, account):
         with conn.transaction():
             with conn.cursor(row_factory=dict_row) as cursor:
                 seq = cursor.execute(
-                    "SELECT status, metadata, account_id, current_sort FROM sequences WHERE id = %s AND status != 'deleted'", [collectionId]
+                    "SELECT metadata, account_id, current_sort, visibility FROM sequences WHERE id = %s AND status != 'deleted'",
+                    [collectionId],
                 ).fetchone()
 
                 # Sequence not found
                 if not seq:
                     raise errors.InvalidAPIUsage(_("Collection %(c)s wasn't found in database", c=collectionId), status_code=404)
 
-                if account is not None and account.id != str(seq["account_id"]):
+                if account is not None and not account.can_edit_collection(str(seq["account_id"])):
                     # Only owner of the sequence is allower to change its visibility and title
                     # tags and headings can be changed by anyone
                     if metadata.visible is not None or metadata.title is not None:
@@ -718,26 +816,18 @@ def patchCollection(collectionId, account):
                                 status_code=403,
                             )
 
-                oldStatus = seq["status"]
+                oldVisibility = seq["visibility"]
                 oldMetadata = seq["metadata"]
                 oldTitle = oldMetadata.get("title")
 
-                # Check if sequence is in a preparing/broken/... state so no edit possible
-                if oldStatus not in ["ready", "hidden"]:
-                    if metadata.visible is not None:
-                        raise errors.InvalidAPIUsage(
-                            _("Sequence %(c)s is in %(s)s state, its visibility can't be changed for now", c=collectionId, s=oldStatus),
-                            status_code=400,
-                        )
-
                 sqlUpdates = []
                 sqlParams = {"id": collectionId, "account": account.id}
 
-                if metadata.visible is not None:
-                    newStatus = "ready" if metadata.visible is True else "hidden"
-                    if newStatus != oldStatus:
-                        sqlUpdates.append(SQL("status = %(status)s"))
-                        sqlParams["status"] = newStatus
+                if metadata.visibility is not None:
+                    newVisibility = metadata.visibility.value
+                    if newVisibility != oldVisibility:
+                        sqlUpdates.append(SQL("visibility = %(visibility)s"))
+                        sqlParams["visibility"] = newVisibility
 
                 new_metadata = {}
                 if metadata.title is not None and oldTitle != metadata.title:
@@ -845,21 +935,20 @@ def getCollectionImportStatus(collectionId):
                     schema:
                         $ref: '#/components/schemas/GeoVisioCollectionImportStatus'
     """
-
-    account = auth.get_current_account()
-    params = {"seq_id": collectionId, "account": account.id if account is not None else None}
+    params = {"seq_id": collectionId, "account": auth.get_current_account_id()}
     with db.cursor(current_app, row_factory=dict_row) as cursor:
         sequence_status = cursor.execute(
             SQL(
-                """SELECT status 
+                """SELECT status, visibility 
                 FROM sequences
                 WHERE id = %(seq_id)s
-                    AND (status != 'hidden' OR account_id = %(account)s)-- show deleted sequence here"""
+                    AND is_sequence_visible_by_user(sequences, %(account)s)
+                    AND status != 'deleted'""",
             ),
             params,
         ).fetchone()
         if sequence_status is None:
-            raise errors.InvalidAPIUsage(_("Sequence doesn't exists"), status_code=404)
+            raise errors.InvalidAPIUsage(_("Sequence doesn't exist"), status_code=404)
 
         pics_status = cursor.execute(
             """WITH
@@ -892,8 +981,8 @@ pic_jobs_stats AS (
     JOIN pictures p ON sp.pic_id = p.id
     LEFT JOIN pic_jobs_stats ON pic_jobs_stats.picture_id = p.id
     WHERE
-                s.id = %(seq_id)s
-                AND (p IS NULL OR p.status != 'hidden' OR p.account_id = %(account)s)
+        s.id = %(seq_id)s
+        AND (p IS NULL OR is_picture_visible_by_user(p, %(account)s))
     ORDER BY s.id, sp.rank
 )
 SELECT json_strip_nulls(
@@ -1050,6 +1139,8 @@ def getUserCollection(userId, userIdMatchesAccount=False):
         sortBy.fields.append(SortByField(field=STAC_FIELD_MAPPINGS["id"], direction=SQLDirection.ASC))
     collection_request = CollectionsRequest(sort_by=sortBy, userOwnsAllCollections=userIdMatchesAccount)
 
+    account_to_query_id = auth.get_current_account_id()
+
     # Filter parameter
     collection_request.user_filter = parse_collection_filter(request.args.get("filter"))
 
@@ -1075,16 +1166,16 @@ def getUserCollection(userId, userIdMatchesAccount=False):
     meta_filter = [
         SQL("{field} IS NOT NULL").format(field=collection_request.sort_by.fields[0].field.sql_filter),
         SQL("s.account_id = %(account)s"),
+        SQL("is_sequence_visible_by_user(s, %(account_to_query)s)"),
     ]
     if collection_request.user_filter is not None:
         meta_filter.append(collection_request.user_filter)
 
-    if collection_request.user_filter is None or "status" not in collection_request.user_filter.as_string(None):
-        # if the filter does not contains any `status` condition, we want to show only 'ready' collection to the general users, and non deleted one for the owner
-        if not userIdMatchesAccount:
-            meta_filter.extend([SQL("s.status = 'ready'")])
-        else:
-            meta_filter.append(SQL("s.status != 'deleted'"))
+    # we want to show only 'ready' collection to the general users, and non deleted one for the owner
+    if not userIdMatchesAccount:
+        meta_filter.extend([SQL("s.status = 'ready'")])
+    else:
+        meta_filter.append(SQL("s.status != 'deleted'"))
 
     # Check user account parameter
     with db.cursor(current_app, row_factory=dict_row) as cursor:
@@ -1118,7 +1209,7 @@ def getUserCollection(userId, userIdMatchesAccount=False):
                 filter=SQL(" AND ").join(meta_filter),
                 order_column=collection_request.sort_by.fields[0].field.sql_filter,
             ),
-            params={"account": userId},
+            params={"account": userId, "account_to_query": account_to_query_id},
         ).fetchone()
 
         if not meta_collection or meta_collection["created"] is None:
@@ -1133,6 +1224,7 @@ def getUserCollection(userId, userIdMatchesAccount=False):
             collection_request.sort_by,
             additional_filters=SQL(" AND ").join(meta_filter),
             additional_filters_params={"account": userId},
+            account_to_query_id=account_to_query_id,
         )
 
     collections = get_collections(collection_request)
@@ -1158,7 +1250,8 @@ def getUserCollection(userId, userIdMatchesAccount=False):
                     },
                     "spatial": {"bbox": [[s["minx"] or -180.0, s["miny"] or -90.0, s["maxx"] or 180.0, s["maxy"] or 90.0]]},
                 },
-                "geovisio:status": s["status"] if userIdMatchesAccount else None,
+                "geovisio:status": retrocompatible_sequence_status(s, explicit=True) if userIdMatchesAccount else None,
+                "geovisio:visibility": s["visibility"] if userIdMatchesAccount else None,
                 "geovisio:length_km": s.get("length_km"),
             }
         )

geovisio/web/configuration.py

@@ -3,6 +3,7 @@ from typing import Dict, Any
 from flask import jsonify, current_app
 from flask_babel import get_locale
 from geovisio.web.utils import get_api_version
+from geovisio.web.params import Visibility
 from geovisio.utils import db
 from psycopg.rows import class_row
 from typing import Optional
@@ -42,6 +43,7 @@ def configuration():
             "version": get_api_version(),
             "pages": _get_pages(),
             "defaults": _get_default_values(),
+            "visibility": {"possible_values": _get_possible_visibility_values()},
         }
     )
 
@@ -72,6 +74,13 @@ def _license_configuration():
     return l
 
 
+def _get_possible_visibility_values():
+    val = ["anyone", "owner-only"]
+    if not flask.current_app.config["API_REGISTRATION_IS_OPEN"]:
+        val.insert(1, "logged-only")
+    return val
+
+
 def _get_pages():
 
     pages = db.fetchall(current_app, "SELECT distinct(name) FROM pages")
@@ -85,11 +94,14 @@ class Config(BaseModel):
     split_time: Optional[datetime.timedelta] = Field(validation_alias="default_split_time")
     duplicate_distance: Optional[float] = Field(validation_alias="default_duplicate_distance")
     duplicate_rotation: Optional[int] = Field(validation_alias="default_duplicate_rotation")
+    default_visibility: Visibility
 
     @field_serializer("split_time")
     def split_time_to_s(self, s: datetime.timedelta, _):
         return s.total_seconds()
 
+    model_config = ConfigDict(use_enum_values=True)
+
 
 def _get_default_values():
     return db.fetchone(current_app, "SELECT * FROM configurations", row_factory=class_row(Config)).model_dump()