Sharing and roles

The three ways to share¶

Haiyz has three sharing mechanisms, not one. Which ones an object offers depends on what the object is — a button that is missing is missing because the endpoint behind it does not exist for that type.

Mechanism	Works on	What the recipient needs
A share link	data items, data rooms	The link. Each link carries a scope — view, or view and download — and can be revoked
A group grant	data rooms, dashboards, projects, private services	Membership of the group you granted. The grant is created on the resource, not on the group
A direct invitation	maps, dashboards, field campaigns, projects, groups, private services	An account with the invited email address. Invite by email or by username; someone with no account yet claims the invitation the first time they sign in. A service is shared only with an existing account

A dashboard adds a fourth switch of its own: visibility. private means owner, members and grants only; link mints a token so anyone holding that URL is a viewer; public makes it readable by anyone. Rotating the link kills the old one immediately.

Publishing to the Catalog also grants a role: a published map, data room or dashboard reads as a viewer for anyone who opens it.

Roles, object by object¶

Roles are listed from least to most. The top role of each object is the only one that manages sharing — grants, invitations, link rotation, archiving and deletion never travel with a lower role.

Object	Role	Can
Data item	viewer	Open it and download its clean versions; see an editable layer's features
Data item	editor	Viewer, plus upload versions and change features on an editable layer within its rules — see who may edit
Data item	manager	Editor, plus switch editing on, set the rules, lock and unlock features, take and restore snapshots, share and publish
Data item	owner	Everything, including deletion
Map	viewer	Open it, toggle layers, read the legend, measure — and download layers if the owner allowed it
Map	editor	All of that, plus add layers, restyle, sketch, run tools, save to the map
Map	owner	All of that, plus members, status, duplication, deletion
Data room	viewer	Open the room and download its clean items
Data room	collaborator	Viewer, plus curate the bundle — add, remove and pin items
Data room	manager	Everything, including share links, group grants, rename and archive
Dashboard	viewer	Open it and query its widgets
Dashboard	editor	Viewer, plus save pages, widgets and theme
Dashboard	manager	Everything, including visibility, the link token, grants and deletion
Project	viewer	Open the project and read its index
Project	collaborator	Viewer, plus add and remove items
Project	manager	Everything, including groups, members, archive and deletion
Group	member	See the group and what it reaches
Group	manager	Invite and remove members — but never mint another manager
Group	owner	Everything, including manager roles, rename and deletion
Service	viewer (Can use)	Use a private service — tiles, features, open standards, a token for desktop GIS — without opening the data item
Service	manager (Can use and share)	Use it, and share it with others
Field campaign	collector	Submit records
Field campaign	manager	The form, the members, the submissions

Data items have no member roles at all. They are shared by link, by being in a data room, or by being published as open data.

Objects with no role to give¶

Three kinds cannot be shared through a project, because sharing means granting a view and they have nothing view-shaped to grant:

• A field campaign's least-privileged role, collector, can submit data. Granting it would turn a read into a write.
• A workspace is owner-only. It has no roles.
• A group is the thing you share with, not a thing you share.

They still appear in a project's index and still answer "used by project X" — the share toggle is simply not offered.

Not found, never forbidden¶

Ask for an object you have no role on and Haiyz answers 404 Not found, not 403. This is deliberate: a 403 confirms that the object exists, which turns a URL into a membership oracle. The same rule holds for maps, data rooms, dashboards, projects and groups.

403 does exist, and it means something different: you have a role, but not a high enough one. A dashboard editor who tries to change the visibility gets a 403, because their access is not in question — their authority is.

Good to know¶

• Being on a project grants nothing inside it. Per-item sharing is a toggle on the edge, off by default, and only for the four kinds that have a view-only role: data item, data room, map, dashboard.
• Removing an item from a project removes an edge. It never deletes the thing, and the thing may sit in several projects at once.
• A group grant lives on the resource. To stop a group reaching a room, remove the grant from the room — deleting members from the group is a bigger hammer than you probably want.
• A service is shared on its own. Sharing a private service gives its tiles and features, never the data item behind it. Making, renaming and unpublishing a service stay with the item's owner and publishers — see make a service.
• Maps have no anonymous link. Bearer-style links are a data-item and data-room feature by design; a map is shared person by person.
• An invitation is addressed to an email. Re-inviting the same address is how a role gets changed, and a pending row is claimed by whoever signs in with that address.