Skip to main content

Sub-users

A sub-user is an identity within your GC2 (Geo Compute Cloud) database that can authenticate with OAuth and call the API with its own, limited rights. The database itself has one super-user, the account you created the backend with, which has unrestricted access. For anything beyond a single-user project you create sub-users so that each application, team member or end user gets its own credentials and only the access it needs.

Each sub-user owns a schema with the same name and starts with no access to tables outside it. You open up access per table with privileges, restrict it further with row-level rules, and organise sub-users in groups so that privileges are inherited. This page covers creating, listing, updating and deleting sub-users, group membership and inheritance, and the self-service signup flow for end users.

Create a new sub-user​

Create a new sub-user
POST https://api.gc2.io/api/v4/users HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "name": "alx",
    "email": "alx@gunsnroses.com",
    "password": "Paradise_City!%Rck1987"
}
Create multiple sub-users
POST https://api.gc2.io/api/v4/users HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

[
    {
        "name": "alx",
        "email": "alx@gunsnroses.com",
        "password": "Paradise_City!%Rck1987"
    },
    {
        "name": "slash",
        "email": "slash@gunsnroses.com",
        "password": "November_Rain!%Pno1991"
    },
    {
        "name": "izzy",
        "email": "izzy@gunsnroses.com",
        "password": "KnockinOn_HeavensDoor!%GnR1990"
    },
    {
        "name": "duff",
        "email": "duff@gunsnroses.com",
        "password": "Welcome2_Jungle!%AxL1987"
    },
    {
        "name": "steven",
        "email": "steven@gunsnroses.com",
        "password": "SweetChild_oMine!%Gtr1987"
    }
]

Get sub-users​

Get specific sub-users
GET https://api.gc2.io/api/v4/users/alx,slash HTTP/1.1
Accept: application/json; charset=utf-8
Authorization: Bearer abc123
Get all sub-users
GET https://api.gc2.io/api/v4/users HTTP/1.1
Accept: application/json; charset=utf-8
Authorization: Bearer abc123

Update sub-users​

It is not possible to update all sub-users in a single operation. You must specify the sub-users explicitly.

Update specific sub-users
PATCH https://api.gc2.io/api/v4/users/alx,slash HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "user_group": "[\"gunsnroses\"]"
}

Delete sub-users​

It is not possible to delete all sub-users in a single operation. You must specify the sub-users explicitly.

Delete specific sub-users
DELETE https://api.gc2.io/api/v4/users/izzy,steven HTTP/1.1
Accept: application/json; charset=utf-8
Authorization: Bearer abc123

Groups and inheritance​

Sub-users can be organized in groups, and privileges granted to a group are inherited by its members. A group is simply a sub-user itself: create a sub-user to act as the group (e.g. gunsnroses) and add other sub-users to it by setting their user_group property.

The user_group property holds a JSON array of group names, encoded as a string. It can be set when creating a sub-user or later with a PATCH:

Add sub-users to a group
PATCH https://api.gc2.io/api/v4/users/alx,slash HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "user_group": "[\"gunsnroses\"]"
}
Membership of multiple groups
PATCH https://api.gc2.io/api/v4/users/slash HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "user_group": "[\"gunsnroses\", \"velvetrevolver\"]"
}

A sub-user can be a member of multiple groups, and a group can itself be a member of other groups, so inheritance is transitive across multiple levels. Cyclic and diamond-shaped memberships are handled safely.

How privileges are resolved​

The effective privilege of a sub-user on a table is the highest privilege found among:

  • the sub-user's own privilege on the table, and
  • the privileges of every group in the sub-user's full inheritance chain.

Privileges rank none < read < write. If alx has no explicit privilege on rockhall.inductees but the group gunsnroses has write, then alx effectively has write on the table.

Schema ownership is inherited the same way: a sub-user owns a schema when the sub-user — or any group in its inheritance chain — has the same name as the schema. Since every sub-user gets a schema named after itself, adding members to the group gunsnroses also gives them full access to the gunsnroses schema.

note

Inheritance applies everywhere privileges are enforced: SQL and the HTTP API as well as the OGC services (WMS/WFS). The super-user (the database owner) always has full access and is not affected by groups.

Signup (Browser – Create a new user)​

GC2 supports signup via the browser. From your app, you can redirect the user to the signup page:

https://api.gc2.io/signup?client_id=abc123&parentdb=mydb&redirect_uri=https://myapp.com/login

Parameters:

  • client_id: OAuth client id configured in GC2
  • parentdb: The parent/tenant database under which the new user should be created
  • redirect_uri: URL in your app to return to after sign‑up

Using the SDK​

The SDK has a SignUp helper that redirects the user to the signup page:

import { SignUp } from "@mapcentia/gc2-sdk";

const signUp = new SignUp({
  host: "https://api.gc2.io",
  clientId: "your-client-id",
  parentDb: "your-parent-database",
  redirectUri: "https://myapp.com/login"
});

// Start sign-up when the user clicks "Create account"
function onSignUpClick() {
  signUp.signUp(); // Redirects to the GC2 sign-up page
}
note
  • After the user completes sign-up and is redirected back to your app, start your normal sign-in flow (for example, CodeFlow). A session is already started, so the user is typically signed in automatically.
  • Client property allow_signup must be set to true for the used OAuth client.
  • Client property social_signup must be set to true for users to sign up with social login.