From cf794a3ae05ee8bf675efae9261a8c56783fee7f Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Wed, 5 Jan 2022 21:51:02 -0500
Subject: [PATCH 01/34] fix lint

---
 magpie/ui/home/static/style.css | 1 -
 1 file changed, 1 deletion(-)

diff --git a/magpie/ui/home/static/style.css b/magpie/ui/home/static/style.css
index 39f060bdf..89d68acda 100644
--- a/magpie/ui/home/static/style.css
+++ b/magpie/ui/home/static/style.css
@@ -922,7 +922,6 @@ div.tree-button {
     text-align: left;
     margin-right: 0.5em;  /* spacing with disallowed text to ensure one title doesn't end flush where the next begins */
     width: 9.5em;   /* [width = <desired-width> + permission-entry.width + permission-checkbox.width - margin-right] */
-
     /* make text >width employ an ellipsis with scroll that auto apply/remove when using it for too long titles */
     text-overflow: ellipsis;
     overflow: auto;

From 4de9fdbe96748977332fd0fda89f24b6d3a7dbe9 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Wed, 5 Jan 2022 21:59:35 -0500
Subject: [PATCH 02/34] first implementation of geoserver multi-ows services

---
 magpie/models.py                |  24 ++++--
 magpie/services.py              | 134 ++++++++++++++++++++++++++++----
 magpie/ui/home/static/style.css |   1 +
 3 files changed, 137 insertions(+), 22 deletions(-)

diff --git a/magpie/models.py b/magpie/models.py
index 410d8f5e8..bcf894035 100644
--- a/magpie/models.py
+++ b/magpie/models.py
@@ -362,7 +362,7 @@ def get(cls,
             status = status.split(",")
         if isinstance(status, (str, int)):
             return cls._get_one(status)
-        combined = None
+        combined = None  # type: Optional[UserStatuses]
         for _status in status:
             _status = cls._get_one(_status)
             if combined is not None and _status is not None:
@@ -406,6 +406,7 @@ def __xor__(self, other):  # type: (Union[UserStatuses, int]) -> UserStatuses
         return super(UserStatuses, self).__xor__(other)
 
     def __iter__(self):
+        # type: () -> Iterable[UserStatuses]
         values = decompose_enum_flags(self)
         return iter(values)
 
@@ -693,20 +694,28 @@ class Directory(Resource, PathBase):
     __mapper_args__ = {"polymorphic_identity": resource_type_name}
 
 
+class Layer(Resource):
+    child_resource_allowed = False
+    resource_type_name = "layer"
+    __mapper_args__ = {"polymorphic_identity": resource_type_name}
+
+    permissions = [
+        Permission.GET_FEATURE,
+        Permission.DESCRIBE_FEATURE_TYPE,
+        Permission.LOCK_FEATURE,
+        Permission.TRANSACTION,
+    ]
+
+
 class Workspace(Resource):
     resource_type_name = "workspace"
     __mapper_args__ = {"polymorphic_identity": resource_type_name}
 
     permissions = [
-        Permission.GET_CAPABILITIES,
         Permission.GET_MAP,
         Permission.GET_FEATURE_INFO,
         Permission.GET_LEGEND_GRAPHIC,
         Permission.GET_METADATA,
-        Permission.GET_FEATURE,
-        Permission.DESCRIBE_FEATURE_TYPE,
-        Permission.LOCK_FEATURE,
-        Permission.TRANSACTION,
     ]
 
 
@@ -951,8 +960,9 @@ def json(self):
 RESOURCE_TREE_SERVICE = ResourceTreeService(ResourceTreeServicePostgreSQL)
 REMOTE_RESOURCE_TREE_SERVICE = RemoteResourceTreeService(RemoteResourceTreeServicePostgresSQL)
 
+RESOURCE_TYPES = frozenset([Service, Directory, File, Layer, Workspace, Route, Process])
 RESOURCE_TYPE_DICT = dict()  # type: Dict[Str, Type[Resource]]
-for res in [Service, Directory, File, Workspace, Route, Process]:
+for res in RESOURCE_TYPES:
     if res.resource_type_name in RESOURCE_TYPE_DICT:  # pragma: no cover
         raise KeyError("Duplicate resource type identifiers not allowed")
     RESOURCE_TYPE_DICT[res.resource_type_name] = res
diff --git a/magpie/services.py b/magpie/services.py
index 8901d3b63..e13bb4138 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -1,4 +1,5 @@
 import abc
+import inspect
 import re
 from typing import TYPE_CHECKING
 
@@ -582,13 +583,11 @@ class ServiceWPS(ServiceOWS):
     ]
 
     resource_types_permissions = {
-        models.Process: [
-            Permission.DESCRIBE_PROCESS,
-            Permission.EXECUTE,
-        ]
+        models.Process: models.Process.permissions
     }
 
     def resource_requested(self):
+        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
         wps_request = self.permission_requested()
         if wps_request == Permission.GET_CAPABILITIES:
             return self.service, True
@@ -656,6 +655,7 @@ class ServiceNCWMS2(ServiceBaseWMS):
     }
 
     def resource_requested(self):
+        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
         # According to the permission, the resource we want to authorize is not formatted the same way
         permission_requested = self.permission_requested()
         netcdf_file = None
@@ -709,16 +709,13 @@ class ServiceGeoserverWMS(ServiceBaseWMS):
     service_type = "geoserverwms"
 
     resource_types_permissions = {
-        models.Workspace: [
-            Permission.GET_CAPABILITIES,
-            Permission.GET_MAP,
-            Permission.GET_FEATURE_INFO,
-            Permission.GET_LEGEND_GRAPHIC,
-            Permission.GET_METADATA,
-        ]
+        # workspace must allow permissions for layers as well as parent in hierarchy
+        models.Workspace: models.Workspace.permissions + models.Layer.permissions,
+        models.Layer: models.Layer.permissions
     }
 
     def resource_requested(self):
+        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
         path_parts = self._get_request_path_parts()
         if not path_parts:
             return self.service, False
@@ -789,7 +786,6 @@ class ServiceAPI(ServiceInterface):
 
     def resource_requested(self):
         # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
-
         route_parts = self._get_request_path_parts()
         if not route_parts:
             return self.service, True
@@ -907,6 +903,7 @@ def is_match(value, pattern):
             return None
 
     def resource_requested(self):
+        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
         path_parts = self.get_path_parts()
 
         # handle optional prefix as targeting the service directly
@@ -959,11 +956,118 @@ def permission_requested(self):
         return None  # automatically deny
 
 
+class ServiceGeoserverMeta(ServiceMeta):
+    """
+    Mapping and grouping of property definitions for ``GeoServer`` services from distinct `OWS` implementations.
+    """
+    service_map = {
+        "wfs": ServiceWFS,
+        "wms": ServiceGeoserverWMS,
+        "wps": ServiceWPS,
+        "WFS": ServiceWFS,
+        "WMS": ServiceGeoserverWMS,
+        "WPS": ServiceWPS,
+    }
+
+    @property
+    def permissions(self):
+        # type: () -> List[Permission]
+        perms = set()
+        for svc in self.supported_ows:
+            if issubclass(svc, ServiceOWS) and hasattr(svc, "permissions"):
+                perms.update(svc.permissions)
+        return list(perms)
+
+    @property
+    def resource_types_permissions(self):
+        # type: () -> Dict[models.Resource, List[Permission]]
+        perms = {}
+        for svc in self.supported_ows:
+            if issubclass(svc, ServiceOWS) and hasattr(svc, "resource_types_permissions"):
+                perms.update(svc.resource_types_permissions)
+        return perms
+
+    @property
+    def supported_ows(self):
+        # type: () -> Set[Type[ServiceOWS]]
+        return set(self.service_map.values())
+
+
+@six.add_metaclass(ServiceGeoserverMeta)
+class ServiceGeoserver(ServiceOWS):
+    """
+    Service that encapsulates the multiple `OWS` endpoints from ``GeoServer`` services.
+
+    .. seealso::
+        https://docs.geoserver.org/stable/en/user/services/index.html
+    """
+    service_type = "geoserver"
+
+    params_expected = [
+        "request",
+        "service"
+    ]
+
+    def service_requested(self):
+        # type: () -> Type[ServiceOWS]
+        """
+        Obtain the applicable `OWS` implementation according to parsed request parameters.
+        """
+        try:
+            svc = self.parser.params["service"]
+        except KeyError:
+            svc = None
+        req = self.parser.params.get("request")
+        if svc is None and req is not None:
+            # geoserver allows omitting 'service' request parameter because it can be inferred from the path
+            # since all OWS services are accessed using '/geoserver/<SERVICE>?request=...'
+            # attempt to match using applicable 'request' parameter
+            for geo_svc in self.supported_ows:
+                if issubclass(geo_svc, ServiceInterface) and hasattr(geo_svc, "permissions"):
+                    perm = Permission(req)
+                    if perm in geo_svc.permissions:
+                        svc = geo_svc
+                        break
+        ax.verify_param(
+            svc, is_in=True, param_compare=self.service_map, param_name="service", http_error=HTTPBadRequest,
+            content={
+                "service": self.service.resource_name,
+                "type": self.service_type,
+                "value": {"service": svc, "request": req}
+            },
+            msg_on_fail=(
+                "Missing or unknown implementation inferred from OWS 'service' and 'request' parameters. " +
+                "Unable to resolve the requested access for service: [{!s}].".format(self.service.resource_name)
+            )
+        )
+        return self.service_map[svc]
+
+    def resource_requested(self):
+        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
+        svc = self.service_requested()
+        return svc(self.service, self.request).resource_requested()
+
+    def permission_requested(self):
+        # type: () -> Permission
+        svc = self.service_requested()
+        return svc(self.service, self.request).permission_requested()
+
+
+SERVICE_TYPES = frozenset([
+    ServiceAccess,
+    ServiceAPI,
+    ServiceGeoserver,
+    ServiceGeoserverWMS,
+    ServiceNCWMS2,
+    ServiceTHREDDS,
+    ServiceWFS,
+    ServiceWPS
+])
 SERVICE_TYPE_DICT = dict()
-for svc in [ServiceAccess, ServiceAPI, ServiceGeoserverWMS, ServiceNCWMS2, ServiceTHREDDS, ServiceWFS, ServiceWPS]:
-    if svc.service_type in SERVICE_TYPE_DICT:
+for _svc in SERVICE_TYPES:
+    if _svc.service_type in SERVICE_TYPE_DICT:
         raise KeyError("Duplicate resource type identifiers not allowed")
-    SERVICE_TYPE_DICT[svc.service_type] = svc
+    SERVICE_TYPE_DICT[_svc.service_type] = _svc
 
 
 def service_factory(service, request):
diff --git a/magpie/ui/home/static/style.css b/magpie/ui/home/static/style.css
index 89d68acda..39f060bdf 100644
--- a/magpie/ui/home/static/style.css
+++ b/magpie/ui/home/static/style.css
@@ -922,6 +922,7 @@ div.tree-button {
     text-align: left;
     margin-right: 0.5em;  /* spacing with disallowed text to ensure one title doesn't end flush where the next begins */
     width: 9.5em;   /* [width = <desired-width> + permission-entry.width + permission-checkbox.width - margin-right] */
+
     /* make text >width employ an ellipsis with scroll that auto apply/remove when using it for too long titles */
     text-overflow: ellipsis;
     overflow: auto;

From da2bbf8a79c1c40778b4e062cf1d1413f3524968 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Thu, 6 Jan 2022 12:49:59 -0500
Subject: [PATCH 03/34] adjust UI to improve display within edit service page
 when many permissions are applicable

---
 magpie/ui/home/static/style.css                  | 6 ++++++
 magpie/ui/management/templates/edit_service.mako | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/magpie/ui/home/static/style.css b/magpie/ui/home/static/style.css
index 39f060bdf..cece10d32 100644
--- a/magpie/ui/home/static/style.css
+++ b/magpie/ui/home/static/style.css
@@ -382,6 +382,12 @@ table.panel-line td {
 */
 }
 
+.panel-line-limit-size {
+    /* reduce size of the field to allow other fields to preserve 'Edit' button closer to their value
+       in case the large value contents within this field makes the table column very wide */
+    max-width: 1em;
+}
+
 .panel-line-checkbox {
     padding-top: 0.1em;
     display: inline-block;
diff --git a/magpie/ui/management/templates/edit_service.mako b/magpie/ui/management/templates/edit_service.mako
index 37268521d..07f1e7855 100644
--- a/magpie/ui/management/templates/edit_service.mako
+++ b/magpie/ui/management/templates/edit_service.mako
@@ -154,7 +154,7 @@
                             <span class="panel-entry">Permissions: </span>
                         </td>
                         <td>
-                            <div class="panel-line-entry">
+                            <div class="panel-line-entry panel-line-limit-size">
                                 %for perm in service_perm:
                                     <span class="label label-warning">${perm}</span>
                                 %endfor

From 1e96bb0caa6b0e2a5d4834b35bccff40480e3b64 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Thu, 6 Jan 2022 12:51:47 -0500
Subject: [PATCH 04/34] =?UTF-8?q?Bump=20version:=203.19.1=20=E2=86=92=203.?=
 =?UTF-8?q?20.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGES.rst        |  5 +++++
 Makefile           |  2 +-
 README.rst         | 18 +++++++++---------
 magpie/__meta__.py |  2 +-
 setup.cfg          |  2 +-
 5 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index ff55ae7d6..5a335e785 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -7,6 +7,11 @@ Changes
 `Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
 ------------------------------------------------------------------------------------
 
+* Nothing new for the moment.
+
+`3.20.0 <https://github.com/Ouranosinc/Magpie/tree/3.20.0>`_ (2022-01-06)
+------------------------------------------------------------------------------------
+
 Features / Changes
 ~~~~~~~~~~~~~~~~~~~~~
 * Add improved UI display of long ``Permission`` titles for ``Resource`` hierarchy tree headers.
diff --git a/Makefile b/Makefile
index 58ed516e1..b742f84db 100644
--- a/Makefile
+++ b/Makefile
@@ -19,7 +19,7 @@ MAKEFILE_NAME := $(word $(words $(MAKEFILE_LIST)),$(MAKEFILE_LIST))
 # Application
 APP_ROOT    := $(abspath $(lastword $(MAKEFILE_NAME))/..)
 APP_NAME    := magpie
-APP_VERSION ?= 3.19.1
+APP_VERSION ?= 3.20.0
 APP_INI     ?= $(APP_ROOT)/config/$(APP_NAME).ini
 
 # guess OS (Linux, Darwin,...)
diff --git a/README.rst b/README.rst
index 818bebfab..c9160a86f 100644
--- a/README.rst
+++ b/README.rst
@@ -29,13 +29,13 @@ Behind the scene, it uses `Ziggurat-Foundations`_ and `Authomatic`_.
     :alt: Requires Python 2.7, 3.5+
     :target: https://www.python.org/getit
 
-.. |commits-since| image:: https://img.shields.io/github/commits-since/Ouranosinc/Magpie/3.19.1.svg
+.. |commits-since| image:: https://img.shields.io/github/commits-since/Ouranosinc/Magpie/3.20.0.svg
     :alt: Commits since latest release
-    :target: https://github.com/Ouranosinc/Magpie/compare/3.19.1...master
+    :target: https://github.com/Ouranosinc/Magpie/compare/3.20.0...master
 
-.. |version| image:: https://img.shields.io/badge/tag-3.19.1-blue.svg?style=flat
+.. |version| image:: https://img.shields.io/badge/tag-3.20.0-blue.svg?style=flat
     :alt: Latest Tag
-    :target: https://github.com/Ouranosinc/Magpie/tree/3.19.1
+    :target: https://github.com/Ouranosinc/Magpie/tree/3.20.0
 
 .. |dependencies| image:: https://pyup.io/repos/github/Ouranosinc/Magpie/shield.svg
     :alt: Dependencies Status
@@ -45,9 +45,9 @@ Behind the scene, it uses `Ziggurat-Foundations`_ and `Authomatic`_.
     :alt: Github Actions CI Build Status (master branch)
     :target: https://github.com/Ouranosinc/Magpie/actions?query=workflow%3ATests+branch%3Amaster
 
-.. |github_tagged| image:: https://img.shields.io/github/workflow/status/Ouranosinc/Magpie/Tests/3.19.1?label=3.19.1
+.. |github_tagged| image:: https://img.shields.io/github/workflow/status/Ouranosinc/Magpie/Tests/3.20.0?label=3.20.0
     :alt: Github Actions CI Build Status (latest tag)
-    :target: https://github.com/Ouranosinc/Magpie/actions?query=workflow%3ATests+branch%3A3.19.1
+    :target: https://github.com/Ouranosinc/Magpie/actions?query=workflow%3ATests+branch%3A3.20.0
 
 .. |readthedocs| image:: https://img.shields.io/readthedocs/pavics-magpie
     :alt: Readthedocs Build Status (master branch)
@@ -75,7 +75,7 @@ Behind the scene, it uses `Ziggurat-Foundations`_ and `Authomatic`_.
 
 .. |docker_semver_tag| image:: https://img.shields.io/docker/v/pavics/magpie?label=version&sort=semver
     :alt: Docker Version Tag
-    :target: https://hub.docker.com/r/pavics/magpie/tags?page=1&ordering=last_updated&name=3.19.1
+    :target: https://hub.docker.com/r/pavics/magpie/tags?page=1&ordering=last_updated&name=3.20.0
 
 .. end-badges
 
@@ -119,8 +119,8 @@ Following most recent variants are available:
     * - Magpie
       - Twitcher |br|
         (with integrated ``MagpieAdapter``)
-    * - ``pavics/magpie:3.19.1``
-      - ``pavics/twitcher:magpie-3.19.1``
+    * - ``pavics/magpie:3.20.0``
+      - ``pavics/twitcher:magpie-3.20.0``
     * - ``pavics/magpie:latest``
       - ``pavics/twitcher:magpie-latest``
 
diff --git a/magpie/__meta__.py b/magpie/__meta__.py
index c586fa12c..06de0d8a1 100644
--- a/magpie/__meta__.py
+++ b/magpie/__meta__.py
@@ -2,7 +2,7 @@
 General meta information on the magpie package.
 """
 
-__version__ = "3.19.1"
+__version__ = "3.20.0"
 __title__ = "Magpie"
 __package__ = "magpie"  # pylint: disable=W0622
 __author__ = "Francois-Xavier Derue, Francis Charette-Migneault"
diff --git a/setup.cfg b/setup.cfg
index d6ec49f9f..117538dad 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 3.19.1
+current_version = 3.20.0
 commit = True
 tag = True
 tag_name = {new_version}

From f65683165db548c41c2a715daf9d6de18bdc7505 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Thu, 6 Jan 2022 15:04:46 -0500
Subject: [PATCH 05/34] allowed scoped resource names using colon character

---
 magpie/api/exception.py                          | 1 +
 magpie/api/management/resource/resource_utils.py | 1 +
 magpie/api/management/resource/resource_views.py | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/magpie/api/exception.py b/magpie/api/exception.py
index d33e3884e..2c59c197f 100644
--- a/magpie/api/exception.py
+++ b/magpie/api/exception.py
@@ -44,6 +44,7 @@
 
 # utility parameter validation regexes for 'matches' argument
 PARAM_REGEX = r"^[A-Za-z0-9]+(?:[\s_\-\.][A-Za-z0-9]+)*$"    # request parameters
+SCOPE_REGEX = r"^[A-Za-z0-9]+(?:[\:\s_\-\.][A-Za-z0-9]+)*$"  # allow scoped names (e.g.: 'namespace:value')
 EMAIL_REGEX = colander.EMAIL_RE
 UUID_REGEX = colander.UUID_REGEX
 URL_REGEX = colander.URL_REGEX
diff --git a/magpie/api/management/resource/resource_utils.py b/magpie/api/management/resource/resource_utils.py
index 0e3d493ff..82f212f69 100644
--- a/magpie/api/management/resource/resource_utils.py
+++ b/magpie/api/management/resource/resource_utils.py
@@ -273,6 +273,7 @@ def get_resource_root_service_impl(resource, request):
 def create_resource(resource_name, resource_display_name, resource_type, parent_id, db_session):
     # type: (Str, Optional[Str], Str, int, Session) -> HTTPException
     ax.verify_param(resource_name, param_name="resource_name", not_none=True, not_empty=True,
+                    matches=True, param_compare=ax.SCOPE_REGEX,
                     http_error=HTTPUnprocessableEntity,
                     msg_on_fail="Invalid 'resource_name' specified for child resource creation.")
     ax.verify_param(resource_type, param_name="resource_type", not_none=True, not_empty=True,
diff --git a/magpie/api/management/resource/resource_views.py b/magpie/api/management/resource/resource_views.py
index 1cfef30e9..bb863288a 100644
--- a/magpie/api/management/resource/resource_views.py
+++ b/magpie/api/management/resource/resource_views.py
@@ -55,7 +55,7 @@ def create_resource_view(request):
     """
     Register a new resource.
     """
-    resource_name = ar.get_value_multiformat_body_checked(request, "resource_name")
+    resource_name = ar.get_multiformat_body(request, "resource_name")
     resource_display_name = ar.get_multiformat_body(request, "resource_display_name", default=resource_name)
     resource_type = ar.get_value_multiformat_body_checked(request, "resource_type")
     parent_id = ar.get_value_multiformat_body_checked(request, "parent_id", check_type=int)

From 9b04a1e3fd5802781dc309eba609548ec448c764 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Thu, 6 Jan 2022 15:48:27 -0500
Subject: [PATCH 06/34] add tests to validate proper support of scoped names
 for service and resources

---
 CHANGES.rst                                   |  4 ++-
 .../api/management/service/service_utils.py   |  2 +-
 .../api/management/service/service_views.py   |  5 ++-
 magpie/api/requests.py                        |  2 +-
 magpie/api/schemas.py                         |  5 +++
 tests/interfaces.py                           | 33 +++++++++++++++++++
 tests/utils.py                                |  2 +-
 7 files changed, 48 insertions(+), 5 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 5a335e785..c7e1adb6b 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -7,7 +7,9 @@ Changes
 `Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
 ------------------------------------------------------------------------------------
 
-* Nothing new for the moment.
+Features / Changes
+~~~~~~~~~~~~~~~~~~~~~
+* Allow ``Resource`` and ``Service`` name to contain colon (``:``) character in order to define scoped names.
 
 `3.20.0 <https://github.com/Ouranosinc/Magpie/tree/3.20.0>`_ (2022-01-06)
 ------------------------------------------------------------------------------------
diff --git a/magpie/api/management/service/service_utils.py b/magpie/api/management/service/service_utils.py
index 75e0c29f4..dd5ea2426 100644
--- a/magpie/api/management/service/service_utils.py
+++ b/magpie/api/management/service/service_utils.py
@@ -67,7 +67,7 @@ def _add_service_magpie_and_phoenix(svc, svc_push, db):
     ax.verify_param(service_url, matches=True, param_compare=ax.URL_REGEX, param_name="service_url",
                     http_error=HTTPBadRequest, msg_on_fail=s.Services_POST_Params_BadRequestResponseSchema.description)
     ax.verify_param(service_name, not_empty=True, not_none=True, matches=True,
-                    param_name="service_name", param_compare=ax.PARAM_REGEX,
+                    param_name="service_name", param_compare=ax.SCOPE_REGEX,
                     http_error=HTTPBadRequest, msg_on_fail=s.Services_POST_Params_BadRequestResponseSchema.description)
     ax.verify_param(models.Service.by_service_name(service_name, db_session=db_session), is_none=True,
                     param_name="service_name", with_param=False, content={"service_name": str(service_name)},
diff --git a/magpie/api/management/service/service_views.py b/magpie/api/management/service/service_views.py
index b82cc852f..cbfbc852a 100644
--- a/magpie/api/management/service/service_views.py
+++ b/magpie/api/management/service/service_views.py
@@ -113,7 +113,7 @@ def register_service_view(request):
     Registers a new service.
     """
     # accomplish basic validations here, create_service will do more field-specific checks
-    service_name = ar.get_value_multiformat_body_checked(request, "service_name")
+    service_name = ar.get_value_multiformat_body_checked(request, "service_name", pattern=ax.SCOPE_REGEX)
     service_url = ar.get_value_multiformat_body_checked(request, "service_url", pattern=ax.URL_REGEX)
     service_type = ar.get_value_multiformat_body_checked(request, "service_type")
     service_push = asbool(ar.get_multiformat_body(request, "service_push", default=False))
@@ -166,6 +166,9 @@ def select_update(new_value, old_value):
         ax.verify_param(svc_name, not_in=True, param_compare=all_svc_names, with_param=False,
                         http_error=HTTPConflict, content={"service_name": str(svc_name)},
                         msg_on_fail=s.Service_PATCH_ConflictResponseSchema.description)
+        ax.verify_param(svc_name, not_none=True, not_empty=True, matches=True, param_compare=ax.SCOPE_REGEX,
+                        http_error=HTTPBadRequest,
+                        msg_on_fail=s.Service_PATCH_UnprocessableEntityResponseSchema.description)
 
     def update_service_magpie_and_phoenix(_svc, new_name, new_url, svc_push, db_session):
         _svc.resource_name = new_name
diff --git a/magpie/api/requests.py b/magpie/api/requests.py
index cf0ea2f94..1ef60ccab 100644
--- a/magpie/api/requests.py
+++ b/magpie/api/requests.py
@@ -311,7 +311,7 @@ def get_service_matchdict_checked(request, service_name_key="service_name"):
     :raises HTTPForbidden: if the requesting user does not have sufficient permission to execute this request.
     :raises HTTPNotFound: if the specified service name does not correspond to any existing service.
     """
-    service_name = get_value_matchdict_checked(request, service_name_key)
+    service_name = get_value_matchdict_checked(request, service_name_key, pattern=ax.SCOPE_REGEX)
     service = ax.evaluate_call(lambda: models.Service.by_service_name(service_name, db_session=request.db),
                                fallback=lambda: request.db.rollback(), http_error=HTTPForbidden,
                                msg_on_fail=s.Service_MatchDictCheck_ForbiddenResponseSchema.description)
diff --git a/magpie/api/schemas.py b/magpie/api/schemas.py
index 3ac19e8a1..9f32daef6 100644
--- a/magpie/api/schemas.py
+++ b/magpie/api/schemas.py
@@ -1509,6 +1509,11 @@ class Service_PATCH_ConflictResponseSchema(BaseResponseSchemaAPI):
     body = ErrorResponseBodySchema(code=HTTPConflict.code, description=description)
 
 
+class Service_PATCH_UnprocessableEntityResponseSchema(BaseResponseSchemaAPI):
+    description = "Specified value is in incorrectly or unsupported format."
+    body = ErrorResponseBodySchema(code=HTTPUnprocessableEntity.code, description=description)
+
+
 Service_DELETE_RequestBodySchema = Resource_DELETE_RequestBodySchema
 
 
diff --git a/tests/interfaces.py b/tests/interfaces.py
index bd1970327..151234366 100644
--- a/tests/interfaces.py
+++ b/tests/interfaces.py
@@ -5636,6 +5636,39 @@ def test_PostServiceResources_DirectResource_Conflict(self):
                                           is_param_value_literal_unicode=True, param_compare_exists=True,
                                           param_value=self.test_resource_name, param_name="resource_name")
 
+    @runner.MAGPIE_TEST_RESOURCES
+    def test_PostServiceResources_ScopedName(self):
+        """
+        Validate that scoped names are allowed for :term:`Service` and :term:`Resource` operations.
+        """
+        utils.warn_version(self, "resource name with scoping", "3.21.0", skip=True)
+        scope = "test:"
+        scope_svc = scope + self.test_service_name
+        scope_res = scope + self.test_resource_name
+        utils.TestSetup.delete_TestService(self, override_service_name=scope_svc)
+        body = utils.TestSetup.create_TestServiceResource(self,
+                                                          override_service_name=scope_svc,
+                                                          override_resource_name=scope_res)
+        res_info = utils.TestSetup.get_ResourceInfo(self, override_body=body, full_detail=True)
+        utils.check_val_equal(res_info["resource_name"], scope_res)
+
+        # explicit check of GET to validate scoped names in path are supported
+        svc_info = utils.TestSetup.get_ExistingTestServiceInfo(self, override_service_name=scope_svc)
+        utils.check_val_equal(svc_info["service_name"], scope_svc)
+
+        # check that second POST also properly detects scoped resource name
+        data = {
+            "resource_name": scope_res,
+            "resource_type": self.test_resource_type,
+            "parent_id": res_info["parent_id"],
+        }
+        resp = utils.test_request(self, "POST", "/resources", json=data, expect_errors=True,
+                                  headers=self.json_headers, cookies=self.cookies)
+        utils.check_response_basic_info(resp, 409, expected_method="POST")
+
+        # explicit check of DELETE to validate it is also supported
+        utils.TestSetup.delete_TestService(self, override_service_name=scope_svc)
+
     @runner.MAGPIE_TEST_SERVICES
     @runner.MAGPIE_TEST_DEFAULTS
     def test_ValidateDefaultServiceProviders(self):
diff --git a/tests/utils.py b/tests/utils.py
index 8a3c78290..ea47694f1 100644
--- a/tests/utils.py
+++ b/tests/utils.py
@@ -1284,7 +1284,7 @@ def check_val_not_in(val, ref, msg=None):
 
 
 def check_val_type(val, ref, msg=None):
-    # type: (Any, Union[Type[Any], NullType], Optional[Str]) -> None
+    # type: (Any, Union[Type[Any], Tuple[Type[Any]], NullType], Optional[Str]) -> None
     """:raises AssertionError: if :paramref:`val` is not an instanced of :paramref:`ref`."""
     assert isinstance(val, ref), format_test_val_ref(val, repr(ref), pre="Type Fail", msg=msg)
 

From e078ace8f890c6b1395b9e58df5760b5b12b8c65 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Fri, 7 Jan 2022 00:27:57 -0500
Subject: [PATCH 07/34] support specific nested structure of children resource
 types

---
 CHANGES.rst                                   |  20 ++
 magpie/api/management/group/__init__.py       |   1 -
 magpie/api/management/resource/__init__.py    |   1 +
 .../api/management/resource/resource_utils.py |  23 ++-
 .../api/management/resource/resource_views.py |  43 ++++
 .../api/management/service/service_formats.py |   8 +-
 magpie/api/management/user/__init__.py        |   2 -
 magpie/api/schemas.py                         | 100 ++++++++--
 magpie/services.py                            | 186 +++++++++++++++---
 magpie/ui/management/views.py                 |   4 +-
 10 files changed, 339 insertions(+), 49 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index c7e1adb6b..58b9e5122 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -10,6 +10,26 @@ Changes
 Features / Changes
 ~~~~~~~~~~~~~~~~~~~~~
 * Allow ``Resource`` and ``Service`` name to contain colon (``:``) character in order to define scoped names.
+* Add ``child_structure_allowed`` attribute to ``Service`` implementations allowing them to define specific path-like
+  structures of allowed ``Resource`` types hierarchies in order to control at which level and which combinations
+  of nested ``Resource`` types are valid under their root ``Service``. When not defined under a ``Service``
+  implementation, any defined ``Resource`` type will remain available for creation at any level of the hierarchy,
+  unless the corresponding ``Resource`` in the tree already defined ``child_resource_allowed = False``. This was
+  already the original behaviour in previous versions.
+* Add ``GET /resources/{id}/types`` endpoint that allows retrieval of applicable children ``Resource`` types under
+  a given ``Resource`` considering the nested hierarchy definition of its root ``Service`` defined by the new
+  attribute ``child_structure_allowed``.
+* Add ``child_structure_allowed`` attribute to the response of ``GET /service/{name}`` endpoint.
+  For backward compatibility, ``resource_types_allowed`` parameter already available in the same response will continue
+  to report all possible ``Resource`` types *at any level* under the ``Service`` hierarchy, although not necessarily
+  applicable as immediate child ``Resource`` under that ``Service``.
+* Adjust UI to consider ``child_structure_allowed`` definitions to propose only applicable ``Resource`` types in the
+  combobox when creating a new ``Resource`` in the tree hierarchy.
+
+Bug Fixes
+~~~~~~~~~~~~~~~~~~~~~
+* Remove invalid ``request`` parameter in ``ServiceTHREDDS`` implementation.
+* Remove multiple invalid schema path definitions that are not mapped against any concrete API endpoint.
 
 `3.20.0 <https://github.com/Ouranosinc/Magpie/tree/3.20.0>`_ (2022-01-06)
 ------------------------------------------------------------------------------------
diff --git a/magpie/api/management/group/__init__.py b/magpie/api/management/group/__init__.py
index 4bc03205a..0d84b184a 100644
--- a/magpie/api/management/group/__init__.py
+++ b/magpie/api/management/group/__init__.py
@@ -17,6 +17,5 @@ def includeme(config):
     config.add_route(**s.service_api_route_info(s.GroupResourcesAPI))
     config.add_route(**s.service_api_route_info(s.GroupResourcePermissionsAPI))
     config.add_route(**s.service_api_route_info(s.GroupResourcePermissionAPI))
-    config.add_route(**s.service_api_route_info(s.GroupResourceTypesAPI))
 
     config.scan()
diff --git a/magpie/api/management/resource/__init__.py b/magpie/api/management/resource/__init__.py
index 2c30e2d67..e8582980a 100644
--- a/magpie/api/management/resource/__init__.py
+++ b/magpie/api/management/resource/__init__.py
@@ -10,5 +10,6 @@ def includeme(config):
     config.add_route(**s.service_api_route_info(s.ResourcesAPI))
     config.add_route(**s.service_api_route_info(s.ResourceAPI))
     config.add_route(**s.service_api_route_info(s.ResourcePermissionsAPI))
+    config.add_route(**s.service_api_route_info(s.ResourceTypesAPI))
 
     config.scan()
diff --git a/magpie/api/management/resource/resource_utils.py b/magpie/api/management/resource/resource_utils.py
index 82f212f69..cdb978985 100644
--- a/magpie/api/management/resource/resource_utils.py
+++ b/magpie/api/management/resource/resource_utils.py
@@ -58,6 +58,7 @@ def check_valid_service_or_resource_permission(permission_name, service_or_resou
 
 
 def check_valid_service_resource(parent_resource, resource_type, db_session):
+    # type: (ServiceOrResourceType, Str, Session) -> models.Service
     """
     Checks if a new Resource can be contained under a parent Resource given the requested type and the corresponding
     Service under which the parent Resource is already assigned.
@@ -69,20 +70,32 @@ def check_valid_service_resource(parent_resource, resource_type, db_session):
     """
     parent_type = parent_resource.resource_type_name
     parent_msg_err = "Child resource not allowed for specified parent resource type '{}'".format(parent_type)
-    ax.verify_param(models.RESOURCE_TYPE_DICT[parent_type].child_resource_allowed, is_equal=True,
-                    param_compare=True, http_error=HTTPForbidden, msg_on_fail=parent_msg_err)
+    ax.verify_param(models.RESOURCE_TYPE_DICT[parent_type].child_resource_allowed, is_true=True,
+                    http_error=HTTPForbidden, msg_on_fail=parent_msg_err)
     root_service = get_resource_root_service(parent_resource, db_session=db_session)
     ax.verify_param(root_service, not_none=True, http_error=HTTPInternalServerError,
                     msg_on_fail="Failed retrieving 'root_service' from db")
     ax.verify_param(root_service.resource_type, is_equal=True, http_error=HTTPInternalServerError,
                     param_name="resource_type", param_compare=models.Service.resource_type_name,
                     msg_on_fail="Invalid 'root_service' retrieved from db is not a service")
-    ax.verify_param(SERVICE_TYPE_DICT[root_service.type].child_resource_allowed, is_equal=True,
-                    param_compare=True, http_error=HTTPForbidden,
+    root_svc_cls = SERVICE_TYPE_DICT[root_service.type]
+    ax.verify_param(root_svc_cls.child_resource_allowed, is_true=True, http_error=HTTPForbidden,
                     msg_on_fail="Child resource not allowed for specified service type '{}'".format(root_service.type))
     ax.verify_param(resource_type, is_in=True, http_error=HTTPForbidden,
-                    param_name="resource_type", param_compare=SERVICE_TYPE_DICT[root_service.type].resource_type_names,
+                    param_name="resource_type", param_compare=root_svc_cls.resource_type_names,
                     msg_on_fail="Invalid 'resource_type' specified for service type '{}'".format(root_service.type))
+    ax.verify_param(root_svc_cls.validate_nested_resource_type(parent_resource, resource_type), is_true=True,
+                    param_content={
+                        "resource_structure_allowed": root_svc_cls.child_structure_allowed,
+                        "resource_types_allowed": [
+                            res.resource_type for res in root_svc_cls.nested_resource_allowed(parent_resource)
+                        ]
+                    },
+                    http_error=HTTPUnprocessableEntity,
+                    msg_on_fail=(
+                        "Invalid 'resource_type' specified for service type '{}' is not allowed at this position "
+                        "under '{}' resource.".format(root_service.type, parent_type)
+                    ))
     return root_service
 
 
diff --git a/magpie/api/management/resource/resource_views.py b/magpie/api/management/resource/resource_views.py
index bb863288a..59fcc438a 100644
--- a/magpie/api/management/resource/resource_views.py
+++ b/magpie/api/management/resource/resource_views.py
@@ -127,3 +127,46 @@ def get_resource_permissions_view(request):
                                 content={"resource": rf.format_resource(resource, basic_info=True)})
     return ax.valid_http(http_success=HTTPOk, detail=s.ResourcePermissions_GET_OkResponseSchema.description,
                          content=format_permissions(res_perm, PermissionType.ALLOWED))
+
+
+@s.ResourceTypesAPI.get(schema=s.ResourceTypes_GET_RequestSchema, tags=[s.ResourcesTag],
+                        response_schemas=s.ResourceTypes_GET_responses)
+@view_config(route_name=s.ResourceTypesAPI.name, request_method="GET")
+def get_resource_types_view(request):
+    """
+    List all applicable children resource types under another resource within a service hierarchy.
+    """
+    resource = ar.get_resource_matchdict_checked(request, "resource_id")
+
+    def get_res_types(res):
+        svc_root = ru.get_resource_root_service(res, db_session=request.db)
+        svc_impl = SERVICE_TYPE_DICT[svc_root.type]
+        return svc_impl.nested_resource_allowed(res), svc_root
+
+    def get_res_child_allowed(res):
+        # make sure to obtain the specific resource/service implementation to avoid using the default
+        if res.resource_type_name == models.Service.resource_type_name:
+            res_impl = SERVICE_TYPE_DICT[res.type]
+        else:
+            res_impl = models.RESOURCE_TYPE_DICT[res.resource_type_name]
+        return res_impl.child_resource_allowed
+
+    res_types, svc = ax.evaluate_call(lambda: get_res_types(resource),
+                                      fallback=lambda: request.db.rollback(), http_error=HTTPInternalServerError,
+                                      msg_on_fail="Error occurred while computing applicable children resource types.",
+                                      content={"resource": rf.format_resource(resource, basic_info=True)})
+    child_allowed = ax.evaluate_call(lambda: get_res_child_allowed(resource),
+                                     http_error=HTTPInternalServerError,
+                                     msg_on_fail="Error occurred while computing allowed children resource status.",
+                                     content={"resource": rf.format_resource(resource, basic_info=True)})
+    data = {
+        "resource_name": resource.resource_name,
+        "resource_type": resource.resource_type_name,
+        "children_resource_types": list(sorted(res_type.resource_type_name for res_type in res_types)),
+        "children_resource_allowed": child_allowed,
+        "root_service_id": svc.resource_id,
+        "root_service_name": svc.resource_name,
+        "root_service_type": svc.type,
+    }
+    return ax.valid_http(http_success=HTTPOk, content=data,
+                         detail=s.ResourceTypes_GET_OkResponseSchema.description)
diff --git a/magpie/api/management/service/service_formats.py b/magpie/api/management/service/service_formats.py
index 9e0d2eb5c..6b0bcf271 100644
--- a/magpie/api/management/service/service_formats.py
+++ b/magpie/api/management/service/service_formats.py
@@ -76,11 +76,13 @@ def fmt_svc():
             return svc_info
         if show_configuration:
             svc_info["configuration"] = service.configuration
-        perms = SERVICE_TYPE_DICT[service.type].permissions if permissions is None else permissions
+        svc_type = SERVICE_TYPE_DICT[service.type]
+        perms = svc_type.permissions if permissions is None else permissions
         svc_info.update(format_permissions(perms, permission_type))
         if show_resources_allowed:
-            svc_info["resource_types_allowed"] = sorted(SERVICE_TYPE_DICT[service.type].resource_type_names)
-            svc_info["resource_child_allowed"] = SERVICE_TYPE_DICT[service.type].child_resource_allowed
+            svc_info["resource_child_allowed"] = svc_type.child_resource_allowed
+            svc_info["resource_types_allowed"] = sorted(svc_type.resource_type_names)
+            svc_info["resource_structure_allowed"] = sorted(svc_type.child_structure_allowed)
         return svc_info
 
     return evaluate_call(
diff --git a/magpie/api/management/user/__init__.py b/magpie/api/management/user/__init__.py
index bf9691f2e..bd9e47b3b 100644
--- a/magpie/api/management/user/__init__.py
+++ b/magpie/api/management/user/__init__.py
@@ -21,7 +21,6 @@ def includeme(config):
     config.add_route(**s.service_api_route_info(s.UserServicePermissionAPI, **user_kwargs))
     config.add_route(**s.service_api_route_info(s.UserServiceResourcesAPI, **user_kwargs))
     config.add_route(**s.service_api_route_info(s.UserResourcesAPI, **user_kwargs))
-    config.add_route(**s.service_api_route_info(s.UserResourceTypesAPI, **user_kwargs))
     config.add_route(**s.service_api_route_info(s.UserResourcePermissionsAPI, **user_kwargs))
     config.add_route(**s.service_api_route_info(s.UserResourcePermissionAPI, **user_kwargs))
     # Logged User routes
@@ -33,7 +32,6 @@ def includeme(config):
     config.add_route(**s.service_api_route_info(s.LoggedUserServicePermissionAPI, **user_kwargs))
     config.add_route(**s.service_api_route_info(s.LoggedUserServiceResourcesAPI, **user_kwargs))
     config.add_route(**s.service_api_route_info(s.LoggedUserResourcesAPI, **user_kwargs))
-    config.add_route(**s.service_api_route_info(s.LoggedUserResourceTypesAPI, **user_kwargs))
     config.add_route(**s.service_api_route_info(s.LoggedUserResourcePermissionsAPI, **user_kwargs))
     config.add_route(**s.service_api_route_info(s.LoggedUserResourcePermissionAPI, **user_kwargs))
 
diff --git a/magpie/api/schemas.py b/magpie/api/schemas.py
index 9f32daef6..c9ce16e6d 100644
--- a/magpie/api/schemas.py
+++ b/magpie/api/schemas.py
@@ -122,9 +122,6 @@ def service_api_route_info(service_api, **kwargs):
 UserResourcePermissionAPI = Service(
     path="/users/{user_name}/resources/{resource_id}/permissions/{permission_name}",
     name="UserResourcePermission")
-UserResourceTypesAPI = Service(
-    path="/users/{user_name}/resources/types/{resource_type}",
-    name="UserResourceTypes")
 UserServicesAPI = Service(
     path="/users/{user_name}/services",
     name="UserServices")
@@ -158,9 +155,6 @@ def service_api_route_info(service_api, **kwargs):
 LoggedUserResourcePermissionsAPI = Service(
     path=LoggedUserBase + "/resources/{resource_id}/permissions",
     name="LoggedUserResourcePermissions")
-LoggedUserResourceTypesAPI = Service(
-    path=LoggedUserBase + "/resources/types/{resource_type}",
-    name="LoggedUserResourceTypes")
 LoggedUserServicesAPI = Service(
     path=LoggedUserBase + "/services",
     name="LoggedUserServices")
@@ -203,9 +197,6 @@ def service_api_route_info(service_api, **kwargs):
 GroupResourcePermissionAPI = Service(
     path="/groups/{group_name}/resources/{resource_id}/permissions/{permission_name}",
     name="GroupResourcePermission")
-GroupResourceTypesAPI = Service(
-    path="/groups/{group_name}/resources/types/{resource_type}",
-    name="GroupResourceTypes")
 RegisterGroupsAPI = Service(
     path="/register/groups",
     name="RegisterGroups")
@@ -227,6 +218,9 @@ def service_api_route_info(service_api, **kwargs):
 ResourcePermissionsAPI = Service(
     path="/resources/{resource_id}/permissions",
     name="ResourcePermissions")
+ResourceTypesAPI = Service(
+    path="/resources/{resource_id}/types",
+    name="ResourceTypes")
 ServicesAPI = Service(
     path="/services",
     name="Services")
@@ -713,6 +707,14 @@ class ResourceTypesListSchema(colander.SequenceSchema):
     )
 
 
+class ChildrenResourceTypesListSchema(colander.SequenceSchema):
+    resource_type = colander.SchemaNode(
+        colander.String(),
+        description="Available children resource types under a resource within a service hierarchy.",
+        example="file",
+    )
+
+
 class GroupNamesListSchema(colander.SequenceSchema):
     group_name = GroupNameParameter
 
@@ -1147,7 +1149,7 @@ class Resources_GET_OkResponseSchema(BaseResponseSchemaAPI):
 class Resources_POST_RequestBodySchema(colander.MappingSchema):
     resource_name = colander.SchemaNode(
         colander.String(),
-        description="Name of the resource to create"
+        description="Name of the resource to create."
     )
     resource_display_name = colander.SchemaNode(
         colander.String(),
@@ -1156,11 +1158,11 @@ class Resources_POST_RequestBodySchema(colander.MappingSchema):
     )
     resource_type = colander.SchemaNode(
         colander.String(),
-        description="Type of the resource to create"
+        description="Type of the resource to create."
     )
     parent_id = colander.SchemaNode(
         colander.Int(),
-        description="ID of parent resource under which the new resource should be created",
+        description="ID of parent resource under which the new resource should be created.",
         missing=colander.drop
     )
 
@@ -1222,6 +1224,51 @@ class ResourcePermissions_GET_BadRequestResponseSchema(BaseResponseSchemaAPI):
     body = ErrorResponseBodySchema(code=HTTPBadRequest.code, description=description)
 
 
+class ResourceTypes_GET_RequestSchema(BaseRequestSchemaAPI):
+    path = Resource_RequestPathSchema()
+
+
+class ResourceTypes_GET_ResponseBodySchema(BaseResponseBodySchema):
+    resource_name = colander.SchemaNode(
+        colander.String(),
+        description="Name of the specified resource."
+    )
+    resource_type = colander.SchemaNode(
+        colander.String(),
+        description="Type of the specified resource."
+    )
+    children_resource_types = ChildrenResourceTypesListSchema(
+        description="All resource types applicable as children under the specified resource. "
+    )
+    children_resource_allowed = colander.SchemaNode(
+        colander.Boolean(),
+        description="Indicates if the resource allows any children resources."
+    )
+    root_service_id = colander.SchemaNode(
+        colander.Integer(),
+        description="Resource tree root service identification number.",
+        default=colander.null,  # if no parent
+        missing=colander.drop  # if not returned (basic_info = True)
+    )
+    root_service_name = colander.SchemaNode(
+        colander.Integer(),
+        description="Resource tree root service name.",
+        default=colander.null,  # if no parent
+        missing=colander.drop  # if not returned (basic_info = True)
+    )
+    root_service_type = colander.SchemaNode(
+        colander.Integer(),
+        description="Resource tree root service type.",
+        default=colander.null,  # if no parent
+        missing=colander.drop  # if not returned (basic_info = True)
+    )
+
+
+class ResourceTypes_GET_OkResponseSchema(BaseResponseSchemaAPI):
+    description = "Get applicable children resource types under resource successful."
+    body = ResourceTypes_GET_ResponseBodySchema(code=HTTPOk.code, description=description)
+
+
 class ServiceResourcesBodySchema(ServiceBodySchema):
     children = ResourcesSchemaNode()
 
@@ -1602,6 +1649,22 @@ class ServiceTypeResources_GET_RequestSchema(BaseRequestSchemaAPI):
     path = ServiceType_RequestPathSchema()
 
 
+class ResourceTypesAllowed(colander.SequenceSchema):
+    description = "List of all allowed resource types at some level within the service hierarchy."
+    res_type_path = colander.SchemaNode(
+        colander.String(),
+        description="Allowed resource type under the service hierarchy."
+    )
+
+
+class ResourceStructuresAllowed(colander.SequenceSchema):
+    description = "List of allowed combinations of resource type hierarchical structures under the service."
+    res_type_path = colander.SchemaNode(
+        colander.String(),
+        description="Path-like resource type structure allowed under the service."
+    )
+
+
 class ServiceTypeResourceInfo(colander.MappingSchema):
     resource_type = colander.SchemaNode(
         colander.String(),
@@ -1609,8 +1672,10 @@ class ServiceTypeResourceInfo(colander.MappingSchema):
     )
     resource_child_allowed = colander.SchemaNode(
         colander.Boolean(),
-        description="Indicates if the resource type allows child resources."
+        description="Indicates if the service allows any child resources."
     )
+    resource_types_allowed = ResourceTypesAllowed()
+    resource_structure_allowed = ResourceStructuresAllowed()
     permission_names = PermissionNameListSchema(
         description="Permissions applicable to the specific resource type.",
         example=[Permission.READ.value, Permission.WRITE.value]
@@ -3277,6 +3342,15 @@ class SwaggerAPI_GET_OkResponseSchema(colander.MappingSchema):
     "422": UnprocessableEntityResponseSchema(),
     "500": InternalServerErrorResponseSchema(),
 }
+ResourceTypes_GET_responses = {
+    "200": ResourceTypes_GET_OkResponseSchema(),
+    "400": Resource_MatchDictCheck_BadRequestResponseSchema(),
+    "401": UnauthorizedResponseSchema(),
+    "403": Resource_MatchDictCheck_ForbiddenResponseSchema(),
+    "404": Resource_MatchDictCheck_NotFoundResponseSchema(),
+    "422": UnprocessableEntityResponseSchema(),
+    "500": InternalServerErrorResponseSchema(),
+}
 ServiceTypes_GET_responses = {
     "200": ServiceTypes_GET_OkResponseSchema(),
     "401": UnauthorizedResponseSchema(),
diff --git a/magpie/services.py b/magpie/services.py
index e13bb4138..2372e9ed5 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -1,5 +1,4 @@
 import abc
-import inspect
 import re
 from typing import TYPE_CHECKING
 
@@ -61,6 +60,19 @@ def resource_type_names(cls):
     @property
     def child_resource_allowed(cls):
         # type: (Type[ServiceInterface]) -> bool
+        """
+        Lists all resources allowed *somewhere* within its resource hierarchy under the service.
+
+        .. note::
+            Resources are not necessarily all allowed *directly* under the service.
+            This depends on whether :attr:`ServiceInterface.child_structure_allowed` is defined or not.
+            If not defined, resources are applicable anywhere.
+            Otherwise, they must respect the explicit structure definitions.
+
+        .. seealso::
+             Use :meth:`ServiceInterface.nested_resource_allowed` to obtain only scoped types allowed under a
+             given resource considering allowed path structures.
+        """
         return len(cls.resource_types) > 0
 
 
@@ -68,12 +80,58 @@ def child_resource_allowed(cls):
 class ServiceInterface(object):
     # required service type identifier (unique)
     service_type = None                 # type: Str
-    # required request parameters for the service
+    """
+    Service type identifier (required, unique across implementation).
+    """
+
     params_expected = []                # type: List[Str]
-    # global permissions allowed for the service (top-level resource)
+    """
+    Request parameters that are expected and required for parsing service or child resource access.
+    """
+
     permissions = []                    # type: List[Permission]
-    # dict of list for each corresponding allowed resource permissions (children resources)
-    resource_types_permissions = {}     # type: Dict[models.Resource, List[Permission]]
+    """
+    Permission allowed directly on the service as top-level resource.
+    """
+
+    resource_types_permissions = {}     # type: Dict[Type[models.Resource], List[Permission]]
+    """
+    Mapping of resource types to lists of permissions defining allowed children resource permissions under the service.
+    """
+
+    child_structure_allowed = []        # type: List[Str]
+    """
+    Control listing of path-like resource types limiting the allowed structure of nested children resources.
+
+    When not defined, any nested resource type combination is allowed if they themselves allow children resources.
+    Otherwise, nested child resource under the service can only be created at specific positions within the hierarchy
+    that matches exactly one of the listed control path-like definition. All definitions must start with ``service``
+    and must contain at least one separator and a sub-resource to ensure working behaviour of child resource under
+    the service.
+
+    For example, the below definition allows only resources typed ``route`` directly under the service.
+    The following nested resource under that first-level ``route`` can then be either another ``route`` followed
+    by a child ``process`` or directly a ``process``. Because ``process`` type doesn't allow any children resource
+    (see :attr:`models.Process.child_resource_allowed`), those are the only allowed combinations (cannot further nest
+    resources under the final ``process`` resource). Note that because intermediate ``route`` resources need to be
+    created at some point before the last ``process`` can even exist, partial paths (without ``process``) must also
+    be allowed as valid structures.
+
+    .. code-block:: python
+
+        child_structure_allowed = [
+            "service/route",
+            "service/route/process",
+            "service/route/route",
+            "service/route/route/process",
+        ]
+
+    .. seealso::
+        - Validation of allowed nested children resource insertion of a given type under a parent resource is provided
+          by :meth:`ServiceInterface.validate_nested_resource_type` that employs :attr:`child_structure_allowed`.
+        - Listing of allowed resource types scoped under a given child resource within the hierarchy is provided
+          by :meth:`ServiceInterface.nested_resource_allowed`.
+    """
 
     def __init__(self, service, request):
         # type: (models.Service, Request) -> None
@@ -323,11 +381,80 @@ def get_resource_permissions(cls, resource_type_name):
         """
         Obtains the allowed permissions of the service's child resource fetched by resource type name.
         """
-        for res in cls.resource_types_permissions:  # type: models.Resource
+        for res in cls.resource_types_permissions:  # type: Type[models.Resource]
             if res.resource_type_name == resource_type_name:
                 return cls.resource_types_permissions[res]
         return []
 
+    @classmethod
+    def get_resource_type_path(cls, resource, extra_path=None):
+        # type: (ServiceOrResourceType, Optional[Str]) -> Str
+        """
+        Generate the resource type path-like definition from the top service down to the specified resource.
+
+        :param resource: leaf resource for which to generate the resource type path.
+        :param extra_path: optional resource path to append after the generated path.
+        :return: path like representation of the resource types from service to leaf resource path.
+        """
+        session = get_db_session(obj=resource)
+        res_tree = reversed(list(models.RESOURCE_TREE_SERVICE.path_upper(resource.resource_id, db_session=session)))
+        res_extra_path = [] if extra_path is None else [extra_path]
+        res_types_path = "/".join([res.resource_type_name for res in res_tree] + res_extra_path)
+        return res_types_path
+
+    @classmethod
+    def validate_nested_resource_type(cls, parent_resource, child_resource_type):
+        # type: (ServiceOrResourceType, Str) -> bool
+        """
+        Validate whether a new child resource type is allowed under the parent resource under the service.
+
+        :param parent_resource: Parent under which the new resource must be validated. This can be the service itself.
+        :param child_resource_type: Type to validate at the position defined under the parent resource.
+        :return: status indicating if insertion is allowed for this type and at this parent position.
+        """
+        if not cls.child_resource_allowed:
+            return False
+        # make sure to obtain the specific resource/service implementation to avoid using the default
+        if parent_resource.resource_type_name == models.Service.resource_type_name:
+            res_impl = SERVICE_TYPE_DICT[parent_resource.type]
+        else:
+            res_impl = models.RESOURCE_TYPE_DICT[parent_resource.resource_type_name]
+        if not res_impl.child_resource_allowed:
+            return False
+        # if undefined control structures, assume any combination of nested resource is allowed (original behaviour)
+        if not cls.child_structure_allowed:
+            return True
+        res_types_path = cls.get_resource_type_path(parent_resource, extra_path=child_resource_type)
+        for allow_types_path in cls.child_structure_allowed:
+            if allow_types_path == res_types_path:
+                return True
+        return False
+
+    @classmethod
+    def nested_resource_allowed(cls, parent_resource):
+        # type: (ServiceOrResourceType) -> List[Type[models.Resource]]
+        """
+        Obtain the nested resource types allowed as children children resource within structure definitions.
+        """
+        if not cls.child_resource_allowed:
+            return []
+        # make sure to obtain the specific resource/service implementation to avoid using the default
+        if parent_resource.resource_type_name == models.Service.resource_type_name:
+            res_impl = SERVICE_TYPE_DICT[parent_resource.type]
+        else:
+            res_impl = models.RESOURCE_TYPE_DICT[parent_resource.resource_type_name]
+        if not res_impl.child_resource_allowed:
+            return []
+        # if undefined control structures, any combination is allowed (original behaviour)
+        if not cls.child_structure_allowed:
+            return cls.resource_types
+        res_types_path = cls.get_resource_type_path(parent_resource, extra_path="")  # terminate as ".../"
+        res_types_next = [  # retain only paths that correspond to immediately the next resource type
+            path.replace(res_types_path, "", 1) for path in cls.child_structure_allowed
+            if path.startswith(res_types_path) and len(path.replace(res_types_path, "", 1).split("/")) == 1
+        ]
+        return [models.RESOURCE_TYPE_DICT[res_type] for res_type in res_types_next]
+
     def allowed_permissions(self, resource):
         # type: (ServiceOrResourceType) -> List[Permission]
         """
@@ -849,10 +976,6 @@ class ServiceTHREDDS(ServiceInterface):
         Permission.WRITE,   # NOTE: see special usage of WRITE in docs
     ]
 
-    params_expected = [
-        "request"
-    ]
-
     resource_types_permissions = {
         models.Directory: permissions,
         models.File: permissions,
@@ -964,9 +1087,6 @@ class ServiceGeoserverMeta(ServiceMeta):
         "wfs": ServiceWFS,
         "wms": ServiceGeoserverWMS,
         "wps": ServiceWPS,
-        "WFS": ServiceWFS,
-        "WMS": ServiceGeoserverWMS,
-        "WPS": ServiceWPS,
     }
 
     @property
@@ -1008,28 +1128,48 @@ class ServiceGeoserver(ServiceOWS):
         "service"
     ]
 
+    # only allow workspace directly under service
+    # then, only layer or process under that workspace
+    child_structure_allowed = [
+        "{}/{}".format(
+            models.Service.resource_type_name,
+            models.Workspace.resource_type_name,
+        ),
+        "{}/{}/{}".format(
+            models.Service.resource_type_name,
+            models.Workspace.resource_type_name,
+            models.Layer.resource_type_name,
+        ),
+        "{}/{}/{}".format(
+            models.Service.resource_type_name,
+            models.Workspace.resource_type_name,
+            models.Process.resource_type_name,
+        ),
+    ]
+
     def service_requested(self):
         # type: () -> Type[ServiceOWS]
         """
         Obtain the applicable `OWS` implementation according to parsed request parameters.
         """
         try:
-            svc = self.parser.params["service"]
+            svc_key = svc = self.parser.params["service"]
         except KeyError:
-            svc = None
+            svc_key = svc = None
         req = self.parser.params.get("request")
-        if svc is None and req is not None:
+        if svc_key is None and req is not None:
             # geoserver allows omitting 'service' request parameter because it can be inferred from the path
             # since all OWS services are accessed using '/geoserver/<SERVICE>?request=...'
             # attempt to match using applicable 'request' parameter
-            for geo_svc in self.supported_ows:
-                if issubclass(geo_svc, ServiceInterface) and hasattr(geo_svc, "permissions"):
-                    perm = Permission(req)
-                    if perm in geo_svc.permissions:
-                        svc = geo_svc
+            for svc_ows in self.supported_ows:
+                if issubclass(svc_ows, ServiceInterface) and hasattr(svc_ows, "permissions"):
+                    perm = Permission(str(req).lower())
+                    if perm in svc_ows.permissions:
+                        svc_key = svc_ows
                         break
+        svc_key = str(svc_key).lower()
         ax.verify_param(
-            svc, is_in=True, param_compare=self.service_map, param_name="service", http_error=HTTPBadRequest,
+            svc_key, is_in=True, param_compare=self.service_map, param_name="service", http_error=HTTPBadRequest,
             content={
                 "service": self.service.resource_name,
                 "type": self.service_type,
@@ -1040,7 +1180,7 @@ def service_requested(self):
                 "Unable to resolve the requested access for service: [{!s}].".format(self.service.resource_name)
             )
         )
-        return self.service_map[svc]
+        return self.service_map[svc_key]
 
     def resource_requested(self):
         # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
diff --git a/magpie/ui/management/views.py b/magpie/ui/management/views.py
index 93d89dae0..1cf688720 100644
--- a/magpie/ui/management/views.py
+++ b/magpie/ui/management/views.py
@@ -975,10 +975,10 @@ def add_resource(self):
                                                     service_name=service_name,
                                                     cur_svc_type=cur_svc_type))
 
-        path = schemas.ServiceTypeResourceTypesAPI.path.format(service_type=cur_svc_type)
+        path = schemas.ResourceTypesAPI.path.format(resource_id=resource_id)
         resp = request_api(self.request, path, "GET")
         check_response(resp)
-        svc_res_types = get_json(resp)["resource_types"]
+        svc_res_types = get_json(resp)["children_resource_types"]
         data = {
             "service_name": service_name,
             "cur_svc_type": cur_svc_type,

From 264890475cdb7a2a7da72f39f460f74e300ba173 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Fri, 7 Jan 2022 19:07:17 -0500
Subject: [PATCH 08/34] fixes to reporting applied service configuration from
 API and setting one during creation from UI

---
 CHANGES.rst                                   |   7 ++
 .../api/management/service/service_formats.py |  10 +-
 magpie/api/schemas.py                         |  11 +-
 magpie/services.py                            |  93 +++++++++-------
 magpie/ui/home/static/style.css               |  20 ++++
 .../ui/management/templates/add_service.mako  | 102 ++++++++++++------
 .../ui/management/templates/edit_service.mako |   8 --
 magpie/ui/management/views.py                 |  64 ++++++++---
 magpie/utils.py                               |  12 +--
 9 files changed, 227 insertions(+), 100 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 58b9e5122..3d71e0fbb 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -23,13 +23,20 @@ Features / Changes
   For backward compatibility, ``resource_types_allowed`` parameter already available in the same response will continue
   to report all possible ``Resource`` types *at any level* under the ``Service`` hierarchy, although not necessarily
   applicable as immediate child ``Resource`` under that ``Service``.
+* Add ``configurable`` attribute to ``Service`` types that supports custom definitions modifying their behaviour.
+* Add ``service_configurable`` to response of ``GET /service/{name}`` endpoint.
 * Adjust UI to consider ``child_structure_allowed`` definitions to propose only applicable ``Resource`` types in the
   combobox when creating a new ``Resource`` in the tree hierarchy.
+* Add UI submission field to provide ``Service`` JSON configuration at creation when supported by the type.
 
 Bug Fixes
 ~~~~~~~~~~~~~~~~~~~~~
 * Remove invalid ``request`` parameter in ``ServiceTHREDDS`` implementation.
 * Remove multiple invalid schema path definitions that are not mapped against any concrete API endpoint.
+* Fix reporting of ``Service`` configuration for any type that supports it. Unless overridden during creation with a
+  custom configuration, ``ServiceTHREDDS`` implementation would not report their default configuration and would
+  instead return ``null``, making it difficult to know from the API if default or no configuration was being applied
+  for a given ``Service``.
 
 `3.20.0 <https://github.com/Ouranosinc/Magpie/tree/3.20.0>`_ (2022-01-06)
 ------------------------------------------------------------------------------------
diff --git a/magpie/api/management/service/service_formats.py b/magpie/api/management/service/service_formats.py
index 6b0bcf271..ab6c9af96 100644
--- a/magpie/api/management/service/service_formats.py
+++ b/magpie/api/management/service/service_formats.py
@@ -65,6 +65,7 @@ def fmt_svc():
             "service{}name".format(sep): str(service.resource_name),
             "service{}type".format(sep): str(service.type),
             "service{}sync_type".format(sep): svc_sync_type,
+            "service{}configurable".format(sep): SERVICE_TYPE_DICT[service.type].configurable,
             "resource{}id".format(sep): service.resource_id,
         }
         if show_public_url:
@@ -74,9 +75,14 @@ def fmt_svc():
             svc_info["service{}url".format(sep)] = str(service.url)
         if basic_info:
             return svc_info
-        if show_configuration:
-            svc_info["configuration"] = service.configuration
         svc_type = SERVICE_TYPE_DICT[service.type]
+        if show_configuration:
+            # make sure to generate the default configuration if applicable
+            if svc_type.configurable:
+                svc_config = svc_type(service, request=None).get_config()
+            else:
+                svc_config = None
+            svc_info["configuration"] = svc_config
         perms = svc_type.permissions if permissions is None else permissions
         svc_info.update(format_permissions(perms, permission_type))
         if show_resources_allowed:
diff --git a/magpie/api/schemas.py b/magpie/api/schemas.py
index c9ce16e6d..8d3836c7e 100644
--- a/magpie/api/schemas.py
+++ b/magpie/api/schemas.py
@@ -890,7 +890,11 @@ class GroupDetailBodySchema(GroupPublicBodySchema, GroupInfoBodySchema):
 
 
 class ServiceConfigurationSchema(colander.MappingSchema):
-    description = "Custom configuration of the service. Expected format and fields specific to each service type."
+    description = (
+        "Custom configuration of the service. "
+        "Expected format and fields specific to each service type. "
+        "Service type must support custom configuration."
+    )
     missing = colander.drop
     default = colander.null
 
@@ -915,6 +919,11 @@ class ServiceSummarySchema(colander.MappingSchema):
         description="Type of resource synchronization implementation.",
         example="thredds"
     )
+    service_configurable = colander.SchemaNode(
+        colander.Boolean(),
+        description="Indicates if the service supports custom configuration.",
+        examble=False,
+    )
     public_url = colander.SchemaNode(
         colander.String(),
         description="Proxy URL available for public access with permissions",
diff --git a/magpie/services.py b/magpie/services.py
index 2372e9ed5..042fa39c3 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -78,28 +78,27 @@ def child_resource_allowed(cls):
 
 @six.add_metaclass(ServiceMeta)
 class ServiceInterface(object):
-    # required service type identifier (unique)
-    service_type = None                 # type: Str
+    service_type = None  # type: Optional[Str]  # MUST be overridden
     """
     Service type identifier (required, unique across implementation).
     """
 
-    params_expected = []                # type: List[Str]
+    params_expected = []  # type: List[Str]
     """
     Request parameters that are expected and required for parsing service or child resource access.
     """
 
-    permissions = []                    # type: List[Permission]
+    permissions = []  # type: List[Permission]
     """
     Permission allowed directly on the service as top-level resource.
     """
 
-    resource_types_permissions = {}     # type: Dict[Type[models.Resource], List[Permission]]
+    resource_types_permissions = {}  # type: Dict[Type[models.Resource], List[Permission]]
     """
     Mapping of resource types to lists of permissions defining allowed children resource permissions under the service.
     """
 
-    child_structure_allowed = []        # type: List[Str]
+    child_structure_allowed = []  # type: List[Str]
     """
     Control listing of path-like resource types limiting the allowed structure of nested children resources.
 
@@ -133,6 +132,12 @@ class ServiceInterface(object):
           by :meth:`ServiceInterface.nested_resource_allowed`.
     """
 
+    _config = None  # type: Optional[ServiceConfiguration]  # for optimization to avoid reload and parsing each time
+    configurable = False
+    """
+    Indicates if the service supports custom configuration.
+    """
+
     def __init__(self, service, request):
         # type: (models.Service, Request) -> None
         self.service = service          # type: models.Service
@@ -659,6 +664,8 @@ def _get_request(self):
     def _set_request(self, request):
         # type: (Request) -> None
         self._request = request
+        if request is None:
+            return  # avoid error parsing undefined request
         # must reset the parser from scratch if request changes to ensure everything is updated with new inputs
         self.parser = ows_parser_factory(request)
         self.parser.parse(self.params_expected)  # run parsing to obtain guaranteed lowered-name parameters
@@ -958,7 +965,11 @@ class ServiceWFS(ServiceOWS):
         "typenames"
     ]
 
-    resource_types_permissions = {}
+    resource_types_permissions = {
+        # workspace must allow permissions for layers as well as parent in hierarchy
+        models.Workspace: models.Workspace.permissions + models.Layer.permissions,
+        models.Layer: models.Layer.permissions
+    }
 
     def resource_requested(self):
         return self.service, True   # no children resource, so can only be the service
@@ -981,15 +992,12 @@ class ServiceTHREDDS(ServiceInterface):
         models.File: permissions,
     }
 
-    def __init__(self, *_, **__):
-        super(ServiceTHREDDS, self).__init__(*_, **__)
-        self._config = None
+    configurable = True
 
     def get_config(self):
         # type: () -> ServiceConfiguration
         if self._config is not None:
             return self._config
-
         self._config = super(ServiceTHREDDS, self).get_config() or {}
         self._config.setdefault("skip_prefix", "thredds")
         self._config.setdefault("file_patterns", [".*\\.nc"])
@@ -1147,49 +1155,60 @@ class ServiceGeoserver(ServiceOWS):
         ),
     ]
 
+    configurable = True
+
+    def get_config(self):
+        # type: () -> ServiceConfiguration
+        """
+        Obtain the configuration defining which `OWS` services are enabled under this instance.
+
+        Should provide a mapping of all `OWS` service type names to enabled boolean status.
+        """
+        if self._config is not None:
+            return self._config
+        self._config = super(ServiceGeoserver, self).get_config() or {}
+        for svc_type in type(self).service_map:
+            self._config.setdefault(svc_type, True)
+            if not isinstance(self._config[svc_type], bool):
+                self._config[svc_type] = True
+        self._config = {key: self._config[key] for key in sorted(self._config)}
+        return self._config
+
     def service_requested(self):
-        # type: () -> Type[ServiceOWS]
+        # type: () -> Optional[Type[ServiceOWS]]
         """
         Obtain the applicable `OWS` implementation according to parsed request parameters.
         """
-        try:
-            svc_key = svc = self.parser.params["service"]
-        except KeyError:
-            svc_key = svc = None
-        req = self.parser.params.get("request")
-        if svc_key is None and req is not None:
-            # geoserver allows omitting 'service' request parameter because it can be inferred from the path
+        # guaranteed to exist and lowercase string if provided, otherwise None
+        svc = self.parser.params["service"]
+        req = self.parser.params["request"]
+        if not svc and req:
+            # geoserver allows omitting 'service' request query parameter because it can be inferred from the path
             # since all OWS services are accessed using '/geoserver/<SERVICE>?request=...'
             # attempt to match using applicable 'request' parameter
-            for svc_ows in self.supported_ows:
+            for svc_ows in type(self).supported_ows:
                 if issubclass(svc_ows, ServiceInterface) and hasattr(svc_ows, "permissions"):
-                    perm = Permission(str(req).lower())
+                    perm = Permission(req)
                     if perm in svc_ows.permissions:
-                        svc_key = svc_ows
+                        svc = svc_ows
                         break
-        svc_key = str(svc_key).lower()
-        ax.verify_param(
-            svc_key, is_in=True, param_compare=self.service_map, param_name="service", http_error=HTTPBadRequest,
-            content={
-                "service": self.service.resource_name,
-                "type": self.service_type,
-                "value": {"service": svc, "request": req}
-            },
-            msg_on_fail=(
-                "Missing or unknown implementation inferred from OWS 'service' and 'request' parameters. " +
-                "Unable to resolve the requested access for service: [{!s}].".format(self.service.resource_name)
-            )
-        )
-        return self.service_map[svc_key]
+        config = self.get_config()
+        if svc not in config or not config[svc]:
+            return None
+        return type(self).service_map[svc]
 
     def resource_requested(self):
         # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
         svc = self.service_requested()
+        if not svc:
+            return None
         return svc(self.service, self.request).resource_requested()
 
     def permission_requested(self):
-        # type: () -> Permission
+        # type: () -> Optional[Union[Permission, Collection[Permission]]]
         svc = self.service_requested()
+        if not svc:
+            return None
         return svc(self.service, self.request).permission_requested()
 
 
diff --git a/magpie/ui/home/static/style.css b/magpie/ui/home/static/style.css
index cece10d32..69fe61957 100644
--- a/magpie/ui/home/static/style.css
+++ b/magpie/ui/home/static/style.css
@@ -1250,6 +1250,10 @@ a.tab:visited {
     border-color: black;
 }
 
+.input-configuration {
+
+}
+
 .current-option {
 
 }
@@ -1294,6 +1298,22 @@ table.fields-table input[type="radio"] {
     margin-left: 2em;
 }
 
+.service-button {
+    margin-left: 40%
+}
+
+.service-config-error {
+    margin-top: 0.25em;
+    margin-left: 0;
+    display: inline-flex;
+}
+
+.service-config-error > img {
+    width: 1em;
+    height: 1em;
+    margin: 0.1em 0.25em 0.15em 0;
+}
+
 /* ---
 field form equal width inputs
 support different browsers using an higher level container
diff --git a/magpie/ui/management/templates/add_service.mako b/magpie/ui/management/templates/add_service.mako
index 95ea2a061..cd1d66403 100644
--- a/magpie/ui/management/templates/add_service.mako
+++ b/magpie/ui/management/templates/add_service.mako
@@ -9,14 +9,17 @@
 <h1>Add Service</h1>
 
 <script>
-    function updatePushPhoenixOption() {
-        let arrayServicesPhoenix = ${services_phoenix_indices};
+    function updateActiveServiceOptions() {
+        let arrayServicesPhoenix = ${services_phoenix_enabled};
+        let arrayServicesConfig = ${services_config_enabled};
         let selectedIndex = $("select[id='service_type_select'] option:selected").index();
-        let selectedEnable = (arrayServicesPhoenix[selectedIndex] == 1);
-        document.getElementById("service_push_phoenix_section").hidden = !selectedEnable;
+        let selectedPhoenixEnabled = (arrayServicesPhoenix[selectedIndex] == 1);
+        let selectedConfigEnabled = (arrayServicesConfig[selectedIndex] == 1);
+        document.getElementById("service_push_phoenix_section").hidden = !selectedPhoenixEnabled;
+        document.getElementById("service_configurable_section").hidden = !selectedConfigEnabled;
     }
     $( document ).ready(function() {
-        updatePushPhoenixOption();
+        updateActiveServiceOptions();
     });
 </script>
 
@@ -25,9 +28,12 @@
         <tr>
             <td>Service name:</td>
             <td>
-                <div class="input-container"><label>
-                <input type="text" value="" name="service_name" class="equal-width" placeholder="service">
-                </label></div>
+                <div class="input-container">
+                    <label>
+                        <input type="text" value="${service_name}"
+                               name="service_name" class="equal-width" placeholder="service">
+                    </label>
+                </div>
             </td>
             <td>
                 (unique)
@@ -36,42 +42,78 @@
         <tr>
             <td>Service url:</td>
             <td>
-                <div class="input-container"><label>
-                    <input type="url" value="" name="service_url" class="equal-width"
-                           placeholder="http://localhost:8093">
-                </label></div>
-            </td>
-            <td>
+                <div class="input-container">
+                    <label>
+                        <input type="url" value="${service_url}"
+                               name="service_url" class="equal-width"
+                               placeholder="http://localhost:8093">
+                    </label>
+                </div>
             </td>
+            <td></td>
         </tr>
         <tr><td>Service type:</td>
             <td>
                 <div class="input-container">
-                <label>
-                <select name="service_type" class="equal-width" id="service_type_select"
-                            onchange="updatePushPhoenixOption()">
-                    %for service_type in service_types:
-                        <option value="${service_type}">${service_type}</option>
-                    %endfor
-                 </select>
-                </label>
+                    <label>
+                        <select name="service_type" class="equal-width" id="service_type_select"
+                                onchange="updateActiveServiceOptions()" required>
+                            %for svc_type in service_types:
+                                <option value="${svc_type}"
+                                %if service_type == svc_type:
+                                    selected
+                                %endif
+                                >${svc_type}
+                                </option>
+                            %endfor
+                        </select>
+                    </label>
                 </div>
             </td>
+            <td></td>
+        </tr>
+    </table>
+    <table class="fields-table">  <!-- separate table to avoid moving contents in other cells above on resize -->
+        <tr id="service_configurable_section">
+            <td class="top-align">Configuration:</td>
             <td>
+                <div class="input-container input-configuration">
+                    <label>
+                        <textarea rows="5" cols="1" value="" name="service_config" class="equal-width" placeholder="{}"
+                        >${service_config}</textarea>  <!-- spacing is important -->
+                    </label>
+                </div>
+            </td>
+            <td class="top-align">
+                <div>
+                    (JSON)
+                </div>
+                %if invalid_config:
+                    <div class="service-config-error">
+                        <img src="${request.static_url('magpie.ui.home:static/exclamation-circle.png')}"
+                             alt="ERROR" class="icon-error" />
+                        <div class="alert-form-text alert-form-text-error">
+                            Invalid
+                        </div>
+                    </div>
+                %endif
             </td>
         </tr>
+    </table>
+    <table class="fields-table">
         <tr id="service_push_phoenix_section">
             <td>Push to Phoenix:</td>
             <td>
-                <div class="input-container"><label>
-                    <input type="checkbox" name="service_push" checked id="service_push_phoenix_checkbox">
-                </label></div>
-            </td>
-        </tr>
-        <tr>
-            <td class="centered" colspan="2">
-                <input type="submit" value="Add Service" name="register" class="button theme">
+                <div class="input-container">
+                    <label>
+                        <input type="checkbox" name="service_push" checked id="service_push_phoenix_checkbox">
+                    </label>
+                </div>
             </td>
+            <td></td>
         </tr>
     </table>
+    <div class="service-button">
+        <input type="submit" value="Add Service" name="register" class="button theme">
+    </div>
 </form>
diff --git a/magpie/ui/management/templates/edit_service.mako b/magpie/ui/management/templates/edit_service.mako
index 07f1e7855..2ccb39a57 100644
--- a/magpie/ui/management/templates/edit_service.mako
+++ b/magpie/ui/management/templates/edit_service.mako
@@ -195,14 +195,6 @@
             <div class="panel-heading subsection">
                 <div class="panel-title">Configuration</div>
             </div>
-            <div class="panel-message">
-                <img src="${request.static_url('magpie.ui.home:static/info.png')}"
-                     alt="INFO" class="icon-info alert-info" title="Service Configuration." />
-                <meta name="source" content="https://commons.wikimedia.org/wiki/File:Infobox_info_icon.svg">
-                <div class="panel-message-text">
-                    This service employs the following custom configuration.
-                </div>
-            </div>
             <div class="clear"></div>
             <div class="panel-code-language">
                 <script>
diff --git a/magpie/ui/management/views.py b/magpie/ui/management/views.py
index 1cf688720..6910ab8a8 100644
--- a/magpie/ui/management/views.py
+++ b/magpie/ui/management/views.py
@@ -23,11 +23,13 @@
 from magpie.cli import sync_resources
 from magpie.cli.sync_resources import OUT_OF_SYNC
 from magpie.constants import get_constant
-# TODO: remove (REMOTE_RESOURCE_TREE_SERVICE, RESOURCE_TYPE_DICT), implement getters via API
+# FIXME: remove (REMOTE_RESOURCE_TREE_SERVICE, RESOURCE_TYPE_DICT), implement getters via API
 from magpie.models import REMOTE_RESOURCE_TREE_SERVICE, RESOURCE_TYPE_DICT, UserGroupStatus, UserStatuses
 from magpie.permissions import Permission, PermissionSet
+# FIXME: remove (SERVICE_TYPE_DICT), implement getters via API
+from magpie.services import SERVICE_TYPE_DICT
 from magpie.ui.utils import AdminRequests, BaseViews, check_response, handle_errors, request_api
-from magpie.utils import CONTENT_TYPE_JSON, get_json, get_logger
+from magpie.utils import CONTENT_TYPE_JSON, get_json, get_logger, is_json_body
 
 if TYPE_CHECKING:
     from typing import Any, Dict, List, Optional, Tuple
@@ -839,29 +841,59 @@ def view_services(self):
     def add_service(self):
         cur_svc_type = self.request.matchdict["cur_svc_type"]
         svc_types, cur_svc_type, _ = self.get_services(cur_svc_type)
+        services_keys_sorted = self.get_service_types()
+        services_phoenix_enabled = [
+            (1 if services_keys_sorted[i] in register.SERVICES_PHOENIX_ALLOWED else 0)
+            for i in range(len(services_keys_sorted))
+        ]
+        # FIXME: retrieve from API
+        services_config_enabled = [
+            int(SERVICE_TYPE_DICT[svc_type].configurable)
+            for svc_type in services_keys_sorted
+        ]
+        data = {
+            "service_name": "",
+            "service_url": "",
+            "service_config": "",
+            "invalid_config": False,
+            "cur_svc_type": cur_svc_type,
+            "service_types": svc_types,
+            "services_phoenix": register.SERVICES_PHOENIX_ALLOWED,
+            "services_phoenix_enabled": services_phoenix_enabled,
+            "services_config_enabled": services_config_enabled,
+        }
 
         if "register" in self.request.POST:
             service_name = self.request.POST.get("service_name")
             service_url = self.request.POST.get("service_url")
             service_type = self.request.POST.get("service_type")
             service_push = self.request.POST.get("service_push")
-            data = {"service_name": service_name,
-                    "service_url": service_url,
-                    "service_type": service_type,
-                    "service_push": service_push}
-            resp = request_api(self.request, schemas.ServicesAPI.path, "POST", data=data)
+            service_config = self.request.POST.get("service_config")
+            json_config = None
+            if service_type in svc_types and SERVICE_TYPE_DICT[service_type].configurable:
+                json_config = None
+                if service_config:
+                    json_config = is_json_body(service_config, return_body=True)
+                    if json_config is None:
+                        data.update({
+                            "service_name": service_name,
+                            "service_type": service_type,
+                            "service_config": service_config,
+                            "invalid_config": True,
+                        })
+                        return self.add_template_data(data)
+
+            body = {
+                "service_name": service_name,
+                "service_url": service_url,
+                "service_type": service_type,
+                "service_push": service_push,
+                "configuration": json_config,
+            }
+            resp = request_api(self.request, schemas.ServicesAPI.path, "POST", data=body)
             check_response(resp)
             return HTTPFound(self.request.route_url("view_services", cur_svc_type=service_type))
 
-        services_keys_sorted = self.get_service_types()
-        services_phoenix_indices = [(1 if services_keys_sorted[i] in register.SERVICES_PHOENIX_ALLOWED else 0)
-                                    for i in range(len(services_keys_sorted))]
-        data = {
-            "cur_svc_type": cur_svc_type,
-            "service_types": svc_types,
-            "services_phoenix": register.SERVICES_PHOENIX_ALLOWED,
-            "services_phoenix_indices": services_phoenix_indices
-        }
         return self.add_template_data(data)
 
     @view_config(route_name="edit_service", renderer="templates/edit_service.mako")
diff --git a/magpie/utils.py b/magpie/utils.py
index 9c5da92c1..79b2e5b72 100644
--- a/magpie/utils.py
+++ b/magpie/utils.py
@@ -816,15 +816,15 @@ def log_exc(request):
     return log_exc
 
 
-def is_json_body(body):
-    # type: (Any) -> bool
+def is_json_body(body, return_body=False):
+    # type: (Any, bool) -> bool
     if not body:
-        return False
+        return None if return_body else False
     try:
-        json.loads(body)
+        content = json.loads(body)
     except (ValueError, TypeError):
-        return False
-    return True
+        return None if return_body else False
+    return content if return_body else True
 
 
 # note: must not define any enum value here to allow inheritance by subclasses

From aa23605bc905ce534a67e0aa507d1e210426653f Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Fri, 7 Jan 2022 19:19:05 -0500
Subject: [PATCH 09/34] add missing WFS permissons

---
 magpie/permissions.py | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/magpie/permissions.py b/magpie/permissions.py
index 0937a76e8..6c25428a5 100644
--- a/magpie/permissions.py
+++ b/magpie/permissions.py
@@ -17,6 +17,7 @@
         AccessControlEntryType,
         AnyPermissionType,
         GroupPriority,
+        JSON,
         PermissionDict,
         ResolvablePermissionType,
         Str
@@ -37,18 +38,24 @@ class Permission(ExtendedEnum):
     WRITE = "write"
     ACCESS = "access"
     BROWSE = "browse"
-    # WPS permissions
+    # WFS/WMS/WPS permissions (https://www.ogc.org/standards/<OWS-type>)
     GET_CAPABILITIES = "getcapabilities"
     GET_MAP = "getmap"
     GET_FEATURE_INFO = "getfeatureinfo"
     GET_LEGEND_GRAPHIC = "getlegendgraphic"
     GET_METADATA = "getmetadata"
+    GET_PROPERTY_VALUE = "getpropertyvalue"
     GET_FEATURE = "getfeature"
+    GET_FEATURE_WITH_LOCK = "getfeaturewithlock"
     DESCRIBE_FEATURE_TYPE = "describefeaturetype"
     DESCRIBE_PROCESS = "describeprocess"
     EXECUTE = "execute"
     LOCK_FEATURE = "lockfeature"
     TRANSACTION = "transaction"
+    CREATE_STORED_QUERY = "createstoredquery"
+    DROP_STORED_QUERY = "dropstoredquery"
+    LIST_STORED_QUERIES = "liststoredqueries"
+    DESCRIBE_STORED_QUERIES = "describestoredqueries"
 
 
 class PermissionType(ExtendedEnum):
@@ -233,6 +240,7 @@ def __repr__(self):
         return perm_repr_template.format(self.name.value, self.access.value, self.scope.value, perm_type, perm_reason)
 
     def like(self, other):
+        # type: (Any) -> bool
         """
         Evaluates if one permission is *similar* to another permission definition regardless of *modifiers*.
 
@@ -258,6 +266,7 @@ def json(self):
         return perm
 
     def webhook_params(self):
+        # type: () -> JSON
         """
         Obtain JSON representation employed for :term:`Webhook` reference.
         """

From 3992207ec6d2c79090d19e3cd9af32f9235e6d19 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Fri, 7 Jan 2022 20:35:14 -0500
Subject: [PATCH 10/34] add tests for new features

---
 tests/interfaces.py    | 178 ++++++++++++++++++++++++++++++++++++++++-
 tests/test_services.py |  50 +++++++++++-
 2 files changed, 226 insertions(+), 2 deletions(-)

diff --git a/tests/interfaces.py b/tests/interfaces.py
index 151234366..3e351cc64 100644
--- a/tests/interfaces.py
+++ b/tests/interfaces.py
@@ -19,7 +19,7 @@
 from magpie.api import schemas as s
 from magpie.api.webhooks import webhook_update_error_status
 from magpie.constants import MAGPIE_ROOT, get_constant
-from magpie.models import RESOURCE_TYPE_DICT, Directory, Route, UserStatuses
+from magpie.models import RESOURCE_TYPE_DICT, Directory, File, Route, UserStatuses
 from magpie.permissions import (
     PERMISSION_REASON_DEFAULT,
     PERMISSION_REASON_MULTIPLE,
@@ -6005,6 +6005,182 @@ def test_GetResourcePermissions_ResponseFormat(self):
         utils.check_val_type(body["permission_names"], list)
         utils.check_all_equal(body["permission_names"], expect_res_perms, any_order=True)
 
+    @runner.MAGPIE_TEST_RESOURCES
+    @runner.MAGPIE_TEST_SERVICES
+    def test_GetResourceTypes_ServiceAccess(self):
+        utils.warn_version(self, "validate allowed nested children resource types structure", "3.21.0", skip=True)
+
+        utils.TestSetup.delete_TestService(self)
+        body = utils.TestSetup.create_TestService(self, override_service_type=ServiceAccess.service_type)
+        info = utils.TestSetup.get_ResourceInfo(self, override_body=body)
+        svc_id = info["resource_id"]
+
+        path = "/resources/{}/types".format(svc_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], self.test_service_name)
+        utils.check_val_is_in(body["resource_type"], "service")
+        utils.check_val_is_in(body["children_resource_types"], [])
+        utils.check_val_is_in(body["children_resource_allowed"], False)
+        utils.check_val_is_in(body["root_service_id"], svc_id)
+        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
+        utils.check_val_is_in(body["root_service_type"], ServiceAccess.service_type)
+
+    @runner.MAGPIE_TEST_RESOURCES
+    @runner.MAGPIE_TEST_SERVICES
+    def test_GetResourceTypes_ServiceAPI(self):
+        utils.warn_version(self, "validate allowed nested children resource types structure", "3.21.0", skip=True)
+
+        utils.TestSetup.delete_TestService(self)
+        body = utils.TestSetup.create_TestServiceResource(self)
+        info = utils.TestSetup.get_ResourceInfo(self, override_body=body)
+        svc_id = info["resource_id"]
+        body = utils.TestSetup.create_TestResource(self, parent_resource_id=svc_id)
+        info = utils.TestSetup.get_ResourceInfo(self, override_body=body)
+        res_id = info["resource_id"]
+
+        path = "/resources/{}/types".format(svc_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], self.test_service_name)
+        utils.check_val_is_in(body["resource_type"], "service")
+        utils.check_val_is_in(body["children_resource_types"], [self.test_resource_type])  # only routes under service
+        utils.check_val_is_in(body["children_resource_allowed"], True)
+        utils.check_val_is_in(body["root_service_id"], svc_id)
+        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
+        utils.check_val_is_in(body["root_service_type"], self.test_service_type)
+
+        path = "/resources/{}/types".format(res_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], self.test_resource_name)
+        utils.check_val_is_in(body["resource_type"], "service")
+        utils.check_val_is_in(body["children_resource_types"], [self.test_resource_type])  # routes nested any depth
+        utils.check_val_is_in(body["children_resource_allowed"], True)
+        utils.check_val_is_in(body["root_service_id"], svc_id)
+        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
+        utils.check_val_is_in(body["root_service_type"], self.test_service_type)
+
+    @runner.MAGPIE_TEST_RESOURCES
+    @runner.MAGPIE_TEST_SERVICES
+    def test_GetResourceTypes_ServiceTHREDDS(self):
+        utils.warn_version(self, "validate allowed nested children resource types structure", "3.21.0", skip=True)
+
+        utils.TestSetup.delete_TestService(self)
+        res_names = [
+            "dir1",
+            "dir2",
+            "file1",
+        ]
+        dir1_name, dir2_name, file_name = res_names
+        res_types = [
+            Directory.resource_type_name,
+            Directory.resource_type_name,
+            File.resource_type_name,
+        ]
+        svc_id, dir1_id, dir2_id, file_id = utils.TestSetup.create_TestServiceResourceTree(
+            self,
+            override_service_type=ServiceTHREDDS.service_type,
+            override_resource_names=res_names,
+            override_resource_types=res_types
+        )
+
+        # nested file/dirs always allowed at any level expect under File
+        res_types_allowed = [Directory.resource_type_name, File.resource_type_name]
+
+        path = "/resources/{}/types".format(svc_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], self.test_service_name)
+        utils.check_val_is_in(body["resource_type"], "service")
+        utils.check_val_is_in(body["children_resource_types"], res_types_allowed)
+        utils.check_val_is_in(body["children_resource_allowed"], True)
+        utils.check_val_is_in(body["root_service_id"], svc_id)
+        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
+        utils.check_val_is_in(body["root_service_type"], ServiceTHREDDS.service_type)
+
+        path = "/resources/{}/types".format(dir1_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], dir1_name)
+        utils.check_val_is_in(body["resource_type"], "service")
+        utils.check_val_is_in(body["children_resource_types"], res_types_allowed)
+        utils.check_val_is_in(body["children_resource_allowed"], True)
+        utils.check_val_is_in(body["root_service_id"], svc_id)
+        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
+        utils.check_val_is_in(body["root_service_type"], ServiceTHREDDS.service_type)
+
+        path = "/resources/{}/types".format(dir2_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], dir2_name)
+        utils.check_val_is_in(body["resource_type"], "service")
+        utils.check_val_is_in(body["children_resource_types"], res_types_allowed)
+        utils.check_val_is_in(body["children_resource_allowed"], True)
+        utils.check_val_is_in(body["root_service_id"], svc_id)
+        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
+        utils.check_val_is_in(body["root_service_type"], ServiceTHREDDS.service_type)
+
+        path = "/resources/{}/types".format(file_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], file_name)
+        utils.check_val_is_in(body["resource_type"], "service")
+        utils.check_val_is_in(body["children_resource_types"], [])
+        utils.check_val_is_in(body["children_resource_allowed"], False)
+        utils.check_val_is_in(body["root_service_id"], svc_id)
+        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
+        utils.check_val_is_in(body["root_service_type"], ServiceTHREDDS.service_type)
+
 
 @runner.MAGPIE_TEST_UI
 @six.add_metaclass(ABCMeta)
diff --git a/tests/test_services.py b/tests/test_services.py
index adf91ddf6..2ea3b2b98 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -21,7 +21,15 @@
 from magpie import __meta__, models, owsrequest
 from magpie.constants import get_constant
 from magpie.permissions import Access, Permission, PermissionSet, PermissionType, Scope
-from magpie.services import ServiceAccess, ServiceAPI, ServiceGeoserverWMS, ServiceInterface, ServiceTHREDDS, ServiceWPS
+from magpie.services import (
+    ServiceAccess,
+    ServiceAPI,
+    ServiceGeoserver,
+    ServiceGeoserverWMS,
+    ServiceInterface,
+    ServiceTHREDDS,
+    ServiceWPS
+)
 from magpie.utils import CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_TXT_XML
 from tests import interfaces as ti
 from tests import runner, utils
@@ -980,6 +988,46 @@ def test_ServiceADES_effective_permissions(self):
         """
         raise NotImplementedError  # FIXME: see https://github.com/Ouranosinc/Magpie/issues/360
 
+    @unittest.skip("not implemented")  # FIXME: not implemented
+    @pytest.mark.skip
+    @utils.mocked_get_settings
+    def test_ServiceGeoserver_effective_permissions(self):
+        """
+        Evaluates functionality of :class:`ServiceGeoserver` against a mocked `Magpie` adapter for `Twitcher`.
+
+        The :class:`ServiceGeoserver` implementation works as a combination of many `OWS` sub-services.
+        Validate that different resource types and distinct permissions can be simultaneously applied on them.
+        Effective permissions must be resolved with the appropriate `OWS` service accordingly with request parameters.
+
+        Legend::
+
+            dp: DescribeProcess permission (WPS Process)
+            gf: GetFeature permission (WFS Layer)
+            gi: GetFeatureInfo permission (WMS Layer)
+            A: allow
+            D: deny
+            M: match        (doesn't matter because service always directly referenced)
+            R: recursive    (doesn't matter because service always directly referenced)
+
+        Permissions Applied::
+                                        user        group               effective (reason)
+            Service1                    (a-A-R)                         a-A
+                Workspace1
+                    Layer1
+                    Layer2
+                    Process1
+                    Process2
+
+            Service2                                (a-A-M)             a-A
+            Service3                    (a-D-M)                         a-D
+            Service4                                (a-D-R)             a-D
+            Service5                    (a-A-R)     (a-D-M)             a-A (user > group)
+            Service6                                                    a-D (nothing defaults like explicit deny)
+        """
+        svc_type = ServiceGeoserver.service_type
+        svc1_name = "unittest-service-geoserver-1"
+        raise NotImplementedError
+
 
 @runner.MAGPIE_TEST_LOCAL
 @runner.MAGPIE_TEST_SERVICES

From d0c45f9883821a2ea9e98f5ebf2e9e96e7f5a5f4 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Fri, 7 Jan 2022 20:45:13 -0500
Subject: [PATCH 11/34] updates to geoserver/ncwms/wms/wfs service definitions
 based on permissions offered by standards/implementations

---
 CHANGES.rst           | 10 ++++--
 docs/services.rst     |  4 +--
 magpie/permissions.py |  1 +
 magpie/services.py    | 72 ++++++++++++++++++++++++++++++++++---------
 4 files changed, 69 insertions(+), 18 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 3d71e0fbb..c39390e8e 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -9,7 +9,11 @@ Changes
 
 Features / Changes
 ~~~~~~~~~~~~~~~~~~~~~
-* Allow ``Resource`` and ``Service`` name to contain colon (``:``) character in order to define scoped names.
+* Add missing ``ServiceWFS`` permissions according to `OGC WFS standard <https://www.ogc.org/standards/wfs>`_.
+* Add missing ``DescribeLayer`` permission to ``ServiceGeoserverWMS`` according
+  to `GeoServer WMS implementation <https://docs.geoserver.org/latest/en/user/services/wms/reference.html>`_.
+* Allow ``Resource`` and ``Service`` name to contain colon (``:``) character in order to define scoped names
+  as it is often the case for ``Layer`` names.
 * Add ``child_structure_allowed`` attribute to ``Service`` implementations allowing them to define specific path-like
   structures of allowed ``Resource`` types hierarchies in order to control at which level and which combinations
   of nested ``Resource`` types are valid under their root ``Service``. When not defined under a ``Service``
@@ -31,7 +35,9 @@ Features / Changes
 
 Bug Fixes
 ~~~~~~~~~~~~~~~~~~~~~
-* Remove invalid ``request`` parameter in ``ServiceTHREDDS`` implementation.
+* Remove invalid ``params_expected`` parameter from ``Service`` implementations (``ServiceAccess``, ``ServiceAPI``,
+  ``ServiceTHREDDS``) that don't make use of it since they don't derive from ``ServiceOWS``.
+* Fix base ``Permission`` definitions for all variants of `WMS` according to their reference implementations.
 * Remove multiple invalid schema path definitions that are not mapped against any concrete API endpoint.
 * Fix reporting of ``Service`` configuration for any type that supports it. Unless overridden during creation with a
   custom configuration, ``ServiceTHREDDS`` implementation would not report their default configuration and would
diff --git a/docs/services.rst b/docs/services.rst
index 5576e8c7d..543b6032f 100644
--- a/docs/services.rst
+++ b/docs/services.rst
@@ -78,8 +78,8 @@ On top of the above methods, the following attributes must be defined.
         :Term:`Allowed Permissions`, their type and further nested children :term:`Resource`.
     * - :attr:`ServiceInterface.params_expected` |br| (``List[str]``)
       - Represents specific parameter names that can be preprocessed during HTTP request parsing to ease following
-        resolution of :term:`ACL` use cases. Employed most notably by :term:`Service` implementations based on
-        :class:`magpie.services.ServiceOWS`.
+        resolution of :term:`ACL` use cases. Employed only by :term:`Service` implementations derived from
+        :class:`magpie.services.ServiceOWS`. Can be omitted otherwise.
 
 
 .. _services_available:
diff --git a/magpie/permissions.py b/magpie/permissions.py
index 6c25428a5..89e6c002b 100644
--- a/magpie/permissions.py
+++ b/magpie/permissions.py
@@ -48,6 +48,7 @@ class Permission(ExtendedEnum):
     GET_FEATURE = "getfeature"
     GET_FEATURE_WITH_LOCK = "getfeaturewithlock"
     DESCRIBE_FEATURE_TYPE = "describefeaturetype"
+    DESCRIBE_LAYER = "describelayer"
     DESCRIBE_PROCESS = "describeprocess"
     EXECUTE = "execute"
     LOCK_FEATURE = "lockfeature"
diff --git a/magpie/services.py b/magpie/services.py
index 042fa39c3..ed077f045 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -83,11 +83,6 @@ class ServiceInterface(object):
     Service type identifier (required, unique across implementation).
     """
 
-    params_expected = []  # type: List[Str]
-    """
-    Request parameters that are expected and required for parsing service or child resource access.
-    """
-
     permissions = []  # type: List[Permission]
     """
     Permission allowed directly on the service as top-level resource.
@@ -651,6 +646,11 @@ class ServiceOWS(ServiceInterface):
     Generic request-to-permission interpretation method of various ``OGC Web Service`` (OWS) implementations.
     """
 
+    params_expected = []  # type: List[Str]
+    """
+    Request query parameters that are expected and should be preprocessed by parsing the submitted request.
+    """
+
     def __init__(self, service, request):
         # type: (models.Service, Request) -> None
         self._request = None
@@ -741,18 +741,20 @@ def resource_requested(self):
 class ServiceBaseWMS(ServiceOWS):
     """
     Service that represents basic capabilities of a ``Web Map Service`` endpoint.
+
+    .. seealso::
+        https://www.ogc.org/standards/wms (OpenGIS WMS 1.3.0 implementation)
     """
 
     @abc.abstractmethod
     def resource_requested(self):
         raise NotImplementedError
 
+    # base implementation only provides the following requests
     permissions = [
         Permission.GET_CAPABILITIES,
         Permission.GET_MAP,
         Permission.GET_FEATURE_INFO,
-        Permission.GET_LEGEND_GRAPHIC,
-        Permission.GET_METADATA,
     ]
 
     params_expected = [
@@ -768,9 +770,25 @@ def resource_requested(self):
 class ServiceNCWMS2(ServiceBaseWMS):
     """
     Service that represents a ``Web Map Service`` endpoint with functionalities specific to ``ncWMS2`` .
+
+    .. seealso::
+        https://reading-escience-centre.gitbooks.io/ncwms-user-guide/content/04-usage.html
     """
     service_type = "ncwms"
 
+    permissions = [
+        Permission.GET_CAPABILITIES,
+        Permission.GET_MAP,
+        Permission.GET_FEATURE_INFO,
+        # ncWMS specific extensions
+        Permission.GET_LEGEND_GRAPHIC,
+        Permission.GET_METADATA,
+        # FIXME: not implemented
+        # Permission.GET_TIMESERIES,
+        # Permission.GET_VERTICAL_PROFILE,
+        # Permission.GET_VERTICAL_TRANSECT,
+    ]
+
     resource_types_permissions = {
         models.File: [
             Permission.GET_CAPABILITIES,
@@ -839,9 +857,23 @@ def resource_requested(self):
 class ServiceGeoserverWMS(ServiceBaseWMS):
     """
     Service that represents a ``Web Map Service`` endpoint with functionalities specific to ``GeoServer``.
+
+    .. seealso::
+        https://docs.geoserver.org/latest/en/user/services/wms/reference.html
     """
     service_type = "geoserverwms"
 
+    permissions = [
+        Permission.GET_CAPABILITIES,
+        Permission.GET_MAP,
+        Permission.GET_FEATURE_INFO,
+        # GeoServer specific extensions
+        Permission.GET_LEGEND_GRAPHIC,
+        Permission.DESCRIBE_LAYER,
+        # FIXME: not implemented
+        # Permission.EXCEPTIONS,
+    ]
+
     resource_types_permissions = {
         # workspace must allow permissions for layers as well as parent in hierarchy
         models.Workspace: models.Workspace.permissions + models.Layer.permissions,
@@ -893,8 +925,6 @@ class ServiceAccess(ServiceInterface):
 
     permissions = [Permission.ACCESS]
 
-    params_expected = []
-
     resource_types_permissions = {}
 
     def resource_requested(self):
@@ -912,8 +942,6 @@ class ServiceAPI(ServiceInterface):
 
     permissions = models.Route.permissions
 
-    params_expected = []
-
     resource_types_permissions = {
         models.Route: models.Route.permissions
     }
@@ -952,10 +980,15 @@ class ServiceWFS(ServiceOWS):
 
     permissions = [
         Permission.GET_CAPABILITIES,
-        Permission.DESCRIBE_FEATURE_TYPE,
         Permission.GET_FEATURE,
+        Permission.GET_FEATURE_WITH_LOCK,
+        Permission.DESCRIBE_FEATURE_TYPE,
         Permission.LOCK_FEATURE,
         Permission.TRANSACTION,
+        Permission.CREATE_STORED_QUERY,
+        Permission.DROP_STORED_QUERY,
+        Permission.LIST_STORED_QUERIES,
+        Permission.DESCRIBE_STORED_QUERIES,
     ]
 
     params_expected = [
@@ -966,12 +999,23 @@ class ServiceWFS(ServiceOWS):
     ]
 
     resource_types_permissions = {
-        # workspace must allow permissions for layers as well as parent in hierarchy
-        models.Workspace: models.Workspace.permissions + models.Layer.permissions,
+        # note: basic WFS does not implement Workspace
         models.Layer: models.Layer.permissions
     }
 
     def resource_requested(self):
+        if not self.parser.params["typenames"]:
+            return self.service, False
+        names = self.parser.params["typenames"]  # can be comma-separated or single layer
+        layer = names.split(",")[0]  # FIXME: multi-resource not supported, must update effective permissions handling
+        if layer:
+            session = get_connected_session(self.request)
+            layer_res = models.find_children_by_name(child_name=layer,
+                                                     parent_id=self.service.resource_id,
+                                                     db_session=session)
+            if layer_res is not None:
+                return layer_res, True
+            return self.service, False
         return self.service, True   # no children resource, so can only be the service
 
 

From 7d501a6ae87d6f258f17d07b01cbf0beb8fe0f0e Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Fri, 7 Jan 2022 20:51:11 -0500
Subject: [PATCH 12/34] provide values defined by user on UI invalid value
 during add service check + auto-switch to incoming page current service type
 for convenience

---
 magpie/ui/management/templates/add_service.mako | 2 +-
 magpie/ui/management/views.py                   | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/magpie/ui/management/templates/add_service.mako b/magpie/ui/management/templates/add_service.mako
index cd1d66403..c2e57503a 100644
--- a/magpie/ui/management/templates/add_service.mako
+++ b/magpie/ui/management/templates/add_service.mako
@@ -60,7 +60,7 @@
                                 onchange="updateActiveServiceOptions()" required>
                             %for svc_type in service_types:
                                 <option value="${svc_type}"
-                                %if service_type == svc_type:
+                                %if (service_type or cur_svc_type) == svc_type:
                                     selected
                                 %endif
                                 >${svc_type}
diff --git a/magpie/ui/management/views.py b/magpie/ui/management/views.py
index 6910ab8a8..17be9683c 100644
--- a/magpie/ui/management/views.py
+++ b/magpie/ui/management/views.py
@@ -876,9 +876,12 @@ def add_service(self):
                     json_config = is_json_body(service_config, return_body=True)
                     if json_config is None:
                         data.update({
+                            # forward any fields to avoid dropping values filled by user
                             "service_name": service_name,
                             "service_type": service_type,
+                            "service_url": service_url,
                             "service_config": service_config,
+                            "service_push": service_push,
                             "invalid_config": True,
                         })
                         return self.add_template_data(data)

From e4f16acaf3fda8e45277bcaf740e2acd18f30f19 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Fri, 7 Jan 2022 21:45:00 -0500
Subject: [PATCH 13/34] add workspace/layer hierarchy under geoserverwms +
 update changelog

---
 CHANGES.rst        |  3 +++
 magpie/services.py | 31 +++++++++++++++++++++++++++----
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index c39390e8e..0fe040868 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -12,6 +12,9 @@ Features / Changes
 * Add missing ``ServiceWFS`` permissions according to `OGC WFS standard <https://www.ogc.org/standards/wfs>`_.
 * Add missing ``DescribeLayer`` permission to ``ServiceGeoserverWMS`` according
   to `GeoServer WMS implementation <https://docs.geoserver.org/latest/en/user/services/wms/reference.html>`_.
+* Add support of specific hierarchy of ``Resource`` type ``Layer`` nested under ``Workspace``
+  for ``ServiceGeoserverWMS``.
+* Add support of ``Resource`` type ``Layer`` under ``ServiceWFS``.
 * Allow ``Resource`` and ``Service`` name to contain colon (``:``) character in order to define scoped names
   as it is often the case for ``Layer`` names.
 * Add ``child_structure_allowed`` attribute to ``Service`` implementations allowing them to define specific path-like
diff --git a/magpie/services.py b/magpie/services.py
index ed077f045..7d2d8f4ae 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -875,11 +875,23 @@ class ServiceGeoserverWMS(ServiceBaseWMS):
     ]
 
     resource_types_permissions = {
-        # workspace must allow permissions for layers as well as parent in hierarchy
-        models.Workspace: models.Workspace.permissions + models.Layer.permissions,
-        models.Layer: models.Layer.permissions
+        models.Workspace: permissions,
+        models.Layer: permissions,
     }
 
+    # only workspace directly followed by layers
+    child_structure_allowed = [
+        "{}/{}".format(
+            models.Service.resource_type_name,
+            models.Workspace.resource_type_name,
+        ),
+        "{}/{}/{}".format(
+            models.Service.resource_type_name,
+            models.Workspace.resource_type_name,
+            models.Layer.resource_type_name,
+        ),
+    ]
+
     def resource_requested(self):
         # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
         path_parts = self._get_request_path_parts()
@@ -894,6 +906,7 @@ def resource_requested(self):
             path_parts = path_parts[1:]
             parts_lower = parts_lower[1:]
         workspace_name = None
+        layer_name = None
         if len(parts_lower) > 1 and parts_lower[1] == "wms":
             workspace_name = path_parts[0]
         if permission == Permission.GET_CAPABILITIES:
@@ -916,7 +929,14 @@ def resource_requested(self):
                                                  parent_id=self.service.resource_id,
                                                  db_session=session)
         if workspace:
-            return workspace, True
+            if not layer_name:
+                return workspace, True
+            layer = models.find_children_by_name(child_name=layer_name,
+                                                 parent_id=workspace.resource_id,
+                                                 db_session=session)
+            if layer:
+                return layer, True
+            return workspace, False
         return self.service, False
 
 
@@ -975,6 +995,9 @@ def permission_requested(self):
 class ServiceWFS(ServiceOWS):
     """
     Service that represents a ``Web Feature Service`` endpoint.
+
+    .. seealso::
+        https://www.ogc.org/standards/wfs (OpenGIS WFS 2.0.0 implementation)
     """
     service_type = "wfs"
 

From a62ea1ae390c8717329325d0577ae8d296187baa Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Mon, 10 Jan 2022 15:08:50 -0500
Subject: [PATCH 14/34] reuse geoserver workspace/layer resource resolver for
 all geoserver service implementations + fix access of ServiceGeoserverWMS

---
 CHANGES.rst            |   2 +
 magpie/models.py       |  18 +++-
 magpie/permissions.py  |   1 +
 magpie/services.py     | 210 +++++++++++++++++++++++++++++++----------
 magpie/typedefs.py     |   5 +-
 tests/test_services.py | 174 +++++++++++++++++++++++++++++-----
 6 files changed, 336 insertions(+), 74 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 0fe040868..b2d5f5460 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -46,6 +46,8 @@ Bug Fixes
   custom configuration, ``ServiceTHREDDS`` implementation would not report their default configuration and would
   instead return ``null``, making it difficult to know from the API if default or no configuration was being applied
   for a given ``Service``.
+* Fix `Effective Resolution` of ``Permission`` applied for ``ServiceGeoserverWMS`` to consider ``Scope`` modifier
+  of ``Service`` and ``Workspace`` for access to be resolved at the ``Layer`` level.
 
 `3.20.0 <https://github.com/Ouranosinc/Magpie/tree/3.20.0>`_ (2022-01-06)
 ------------------------------------------------------------------------------------
diff --git a/magpie/models.py b/magpie/models.py
index bcf894035..621d6a3df 100644
--- a/magpie/models.py
+++ b/magpie/models.py
@@ -35,15 +35,17 @@
 
 if TYPE_CHECKING:
     # pylint: disable=W0611,unused-import
-    from typing import Dict, Iterable, List, Optional, Set, Type, Union
+    from typing import Any, Dict, Iterable, List, Optional, Set, Type, Union
 
+    from pyramid.request import Request
     from sqlalchemy.orm.query import Query
     from sqlalchemy.orm.session import Session
 
-    from magpie.typedefs import JSON, AccessControlListType, GroupPriority, Str
+    from magpie.typedefs import AnySettingsContainer, AccessControlListType, GroupPriority, JSON, Str
 
     # for convenience of methods using both, using strings because of future definition
     AnyUser = Union["User", "UserPending"]
+    AnyUserStatus = Union["UserGroupStatus", int, Str]
 
 # backward compat enums
 try:
@@ -57,6 +59,7 @@
 
 
 def get_session_callable(request):
+    # type: (Request) -> Session
     return request.db
 
 
@@ -64,6 +67,7 @@ class Group(GroupMixin, Base):
     _priority = None
 
     def get_member_count(self, db_session=None):
+        # type: (Optional[Session]) -> int
         return BaseService.all(UserGroup, db_session=db_session).filter(UserGroup.group_id == self.id).count()
 
     @declared_attr
@@ -262,6 +266,7 @@ def groups(self):
         return []
 
     def get_groups_by_status(self, status, db_session=None):
+        # type: (UserGroupStatus, Session) -> List[Str]
         """
         Pending user is not a member of any group.
 
@@ -339,6 +344,7 @@ class UserStatuses(IntFlag, FlexibleNameEnum):
 
     @classmethod
     def _get_one(cls, status):
+        # type: (AnyUserStatus) -> Optional[UserStatuses]
         # matches the literal number, the direct enum object, exact name, or flexible name (inherited)
         status = super(UserStatuses, cls).get(int(status) if str.isnumeric(str(status)) else status)
         if status:
@@ -388,6 +394,7 @@ def allowed(cls):
 
     @classmethod
     def all(cls):
+        # type: () -> UserStatuses
         """
         Representation of all flags combined.
         """
@@ -537,6 +544,7 @@ class RootFactory(object):
     __parent__ = ""
 
     def __init__(self, request):
+        # type: (Request) -> None
         self.request = request
 
     @property
@@ -566,10 +574,12 @@ def __acl__(self):
 
 class UserFactory(RootFactory):
     def __init__(self, request):
+        # type: (Request) -> None
         super(UserFactory, self).__init__(request)
         self.path_user = None
 
     def __getitem__(self, user_name):
+        # type: (Str) -> None
         context = UserFactory(self.request)
         if user_name == get_constant("MAGPIE_LOGGED_USER", self.request):
             self.path_user = self.request.user
@@ -921,10 +931,12 @@ def user(self, user):
             self._pending_user = user
 
     def url(self, settings=None):
+        # type: (AnySettingsContainer) -> Str
         from magpie.api import schemas as s
         return get_magpie_url(settings) + s.TemporaryUrlAPI.path.format(token=self.token)
 
     def expired(self):
+        # type: () -> bool
         expire = int(get_constant("MAGPIE_TOKEN_EXPIRE", raise_missing=False, raise_not_set=False, default_value=86400))
         return (datetime.datetime.utcnow() - self.created) > datetime.timedelta(seconds=expire)
 
@@ -969,6 +981,7 @@ def json(self):
 
 
 def resource_factory(**kwargs):
+    # type: (Any) -> Resource
     resource_type = ax.evaluate_call(lambda: kwargs["resource_type"], http_error=HTTPInternalServerError,
                                      msg_on_fail="kwargs do not contain required 'resource_type'",
                                      content={"kwargs": repr(kwargs)})
@@ -979,6 +992,7 @@ def resource_factory(**kwargs):
 
 
 def find_children_by_name(child_name, parent_id, db_session):
+    # type: (Str, Optional[int], Session) -> Optional[Resource]
     tree_struct = RESOURCE_TREE_SERVICE.from_parent_deeper(parent_id=parent_id, limit_depth=1, db_session=db_session)
     tree_level_filtered = [node.Resource for node in list(tree_struct) if
                            node.Resource.resource_name.lower() == child_name.lower()]
diff --git a/magpie/permissions.py b/magpie/permissions.py
index 89e6c002b..c909cae02 100644
--- a/magpie/permissions.py
+++ b/magpie/permissions.py
@@ -47,6 +47,7 @@ class Permission(ExtendedEnum):
     GET_PROPERTY_VALUE = "getpropertyvalue"
     GET_FEATURE = "getfeature"
     GET_FEATURE_WITH_LOCK = "getfeaturewithlock"
+    GET_GML_OBJECT = "getgmlobject"
     DESCRIBE_FEATURE_TYPE = "describefeaturetype"
     DESCRIBE_LAYER = "describelayer"
     DESCRIBE_PROCESS = "describeprocess"
diff --git a/magpie/services.py b/magpie/services.py
index 7d2d8f4ae..019c733e5 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -36,7 +36,14 @@
 
     from pyramid.request import Request
 
-    from magpie.typedefs import AccessControlListType, ServiceConfiguration, ServiceOrResourceType, Str
+    from magpie.typedefs import (
+        AccessControlListType,
+        PermissionRequested,
+        ResourceRequested,
+        ServiceConfiguration,
+        ServiceOrResourceType,
+        Str
+    )
 
 
 class ServiceMeta(type):
@@ -78,10 +85,14 @@ def child_resource_allowed(cls):
 
 @six.add_metaclass(ServiceMeta)
 class ServiceInterface(object):
-    service_type = None  # type: Optional[Str]  # MUST be overridden
-    """
-    Service type identifier (required, unique across implementation).
-    """
+    @property
+    @abc.abstractmethod
+    def service_type(self):
+        # type: () -> Optional[Str]
+        """
+        Service type identifier (required, unique across implementation).
+        """
+        raise NotImplementedError
 
     permissions = []  # type: List[Permission]
     """
@@ -146,7 +157,7 @@ def __str__(self):
 
     @abc.abstractmethod
     def permission_requested(self):
-        # type: () -> Optional[Union[Permission, Collection[Permission]]]
+        # type: () -> PermissionRequested
         """
         Defines how to interpret the incoming request into :class:`Permission` definitions for the given service.
 
@@ -167,7 +178,7 @@ def permission_requested(self):
 
     @abc.abstractmethod
     def resource_requested(self):
-        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
+        # type: () -> ResourceRequested
         """
         Defines how to interpret the incoming request into the targeted :class:`model.Resource` for the given service.
 
@@ -854,30 +865,37 @@ def resource_requested(self):
         return found_child, target
 
 
-class ServiceGeoserverWMS(ServiceBaseWMS):
+class ServiceGeoserverBase(ServiceInterface):
     """
-    Service that represents a ``Web Map Service`` endpoint with functionalities specific to ``GeoServer``.
-
-    .. seealso::
-        https://docs.geoserver.org/latest/en/user/services/wms/reference.html
+    Provides basic configuration parameters and functionalities shared by `Geoserver` implementations.
     """
-    service_type = "geoserverwms"
 
-    permissions = [
-        Permission.GET_CAPABILITIES,
-        Permission.GET_MAP,
-        Permission.GET_FEATURE_INFO,
-        # GeoServer specific extensions
-        Permission.GET_LEGEND_GRAPHIC,
-        Permission.DESCRIBE_LAYER,
-        # FIXME: not implemented
-        # Permission.EXCEPTIONS,
-    ]
+    @property
+    @abc.abstractmethod
+    def service_base(self):
+        # type: () -> Str
+        """
+        Name of the base `OWS` functionality serviced by `Geoserver`.
+        """
+        raise NotImplementedError
 
-    resource_types_permissions = {
-        models.Workspace: permissions,
-        models.Layer: permissions,
-    }
+    @property
+    @abc.abstractmethod
+    def layer_param(self):
+        # type: () -> Str
+        """
+        Name of the request query parameter to access requested :class:`models.Layer` children resource.
+        """
+        raise NotImplementedError
+
+    @property
+    @abc.abstractmethod
+    def resource_types_permissions(self):
+        # type: () -> Dict[Type[models.Resource], List[Permission]]
+        """
+        Explicit permissions provided for resources for a given `OWS` implementation.
+        """
+        raise NotImplementedError
 
     # only workspace directly followed by layers
     child_structure_allowed = [
@@ -893,7 +911,13 @@ class ServiceGeoserverWMS(ServiceBaseWMS):
     ]
 
     def resource_requested(self):
-        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
+        # type: () -> ResourceRequested
+        """
+        Parse the requested resource down to the applicable :class:`models.Workspace`.
+
+        .. note::
+            Further child resource processing must be accomplished by the derived implementation based on their
+        """
         path_parts = self._get_request_path_parts()
         if not path_parts:
             return self.service, False
@@ -907,21 +931,26 @@ def resource_requested(self):
             parts_lower = parts_lower[1:]
         workspace_name = None
         layer_name = None
-        if len(parts_lower) > 1 and parts_lower[1] == "wms":
+        if len(parts_lower) > 1 and parts_lower[1] == self.service_base:
             workspace_name = path_parts[0]
         if permission == Permission.GET_CAPABILITIES:
             # here we need to check the workspace in the path
-            #   /geoserver/wms?request=getcapabilities (get all workspaces)
-            #   /geoserver/WATERSHED/wms?request=getcapabilities (only for the workspace in the path)
-            if not path_parts or "wms" not in parts_lower or (len(parts_lower) == 1 and parts_lower[0] == "wms"):
+            #   /geoserver/<OWS>?request=getcapabilities (get all workspaces)
+            #   /geoserver/<WORKSPACE>/<OWS>?request=getcapabilities (only for the workspace in the path)
+            if (
+                not path_parts or
+                self.service_base not in parts_lower or
+                (len(parts_lower) == 1 and parts_lower[0] == self.service_base)
+            ):
                 return self.service, True
         else:
-            # those two request lead to the same thing so, here we need to check the workspace in the layer
-            #   /geoserver/WATERSHED/wms?layers=WATERSHED:BV_1NS&request=getmap
-            #   /geoserver/wms?layers=WATERERSHED:BV1_NS&request=getmap
+            # following requests lead to the same resolution, need to check the workspace in the layer
+            #   /geoserver/<WORKSPACE>/<OWS>?<LAYER_PARAM>=[<WORKSPACE>:]<LAYER_NAME>&request=<PERMISSION>
+            #   /geoserver/<OWS>?<LAYER_PARAM>=<WORKSPACE>:<LAYER_NAME>&request=<PERMISSION>
             if not workspace_name:
-                layer_name = self.parser.params["layers"] or ""
-                workspace_name = layer_name.split(":")[0]
+                layer_name = self.parser.params[self.layer_param] or ""
+                if ":" in layer_name:  # if missing, consider layer name as not scoped under workspace
+                    workspace_name, layer_name = layer_name.rsplit(":", 1)
         if not workspace_name:
             return self.service, False
         session = get_connected_session(self.request)
@@ -930,7 +959,7 @@ def resource_requested(self):
                                                  db_session=session)
         if workspace:
             if not layer_name:
-                return workspace, True
+                return workspace, False
             layer = models.find_children_by_name(child_name=layer_name,
                                                  parent_id=workspace.resource_id,
                                                  db_session=session)
@@ -940,6 +969,39 @@ def resource_requested(self):
         return self.service, False
 
 
+class ServiceGeoserverWMS(ServiceBaseWMS, ServiceGeoserverBase):
+    """
+    Service that represents a ``Web Map Service`` endpoint with functionalities specific to ``GeoServer``.
+
+    .. seealso::
+        https://docs.geoserver.org/latest/en/user/services/wms/reference.html
+    """
+    service_base = "wms"
+    service_type = "geoserverwms"
+
+    layer_param = "layers"
+
+    permissions = [
+        Permission.GET_CAPABILITIES,
+        Permission.GET_MAP,
+        Permission.GET_FEATURE_INFO,
+        # GeoServer specific extensions
+        Permission.GET_LEGEND_GRAPHIC,
+        Permission.DESCRIBE_LAYER,
+        # FIXME: not implemented
+        # Permission.EXCEPTIONS,
+    ]
+
+    resource_types_permissions = {
+        models.Workspace: permissions,
+        models.Layer: permissions,
+    }
+
+    def resource_requested(self):
+        # type: () -> ResourceRequested
+        return ServiceGeoserverBase.resource_requested(self)
+
+
 class ServiceAccess(ServiceInterface):
     service_type = "access"
 
@@ -948,9 +1010,11 @@ class ServiceAccess(ServiceInterface):
     resource_types_permissions = {}
 
     def resource_requested(self):
+        # type: () -> ResourceRequested
         return self.service, True
 
     def permission_requested(self):
+        # type: () -> PermissionRequested
         return Permission.ACCESS
 
 
@@ -967,7 +1031,7 @@ class ServiceAPI(ServiceInterface):
     }
 
     def resource_requested(self):
-        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
+        # type: () -> ResourceRequested
         route_parts = self._get_request_path_parts()
         if not route_parts:
             return self.service, True
@@ -987,6 +1051,7 @@ def resource_requested(self):
         return route_found, route_target
 
     def permission_requested(self):
+        # type: () -> PermissionRequested
         if self.request.method.upper() in ["GET", "HEAD"]:
             return Permission.READ
         return Permission.WRITE
@@ -998,16 +1063,19 @@ class ServiceWFS(ServiceOWS):
 
     .. seealso::
         https://www.ogc.org/standards/wfs (OpenGIS WFS 2.0.0 implementation)
+        - https://docs.geoserver.org/latest/en/user/services/wfs/reference.html
     """
     service_type = "wfs"
 
     permissions = [
+        # v1.0.0
         Permission.GET_CAPABILITIES,
         Permission.GET_FEATURE,
-        Permission.GET_FEATURE_WITH_LOCK,
         Permission.DESCRIBE_FEATURE_TYPE,
         Permission.LOCK_FEATURE,
         Permission.TRANSACTION,
+        # v2.0.0 only
+        Permission.GET_FEATURE_WITH_LOCK,
         Permission.CREATE_STORED_QUERY,
         Permission.DROP_STORED_QUERY,
         Permission.LIST_STORED_QUERIES,
@@ -1027,11 +1095,17 @@ class ServiceWFS(ServiceOWS):
     }
 
     def resource_requested(self):
+        # type: () -> ResourceRequested
         if not self.parser.params["typenames"]:
             return self.service, False
         names = self.parser.params["typenames"]  # can be comma-separated or single layer
-        layer = names.split(",")[0]  # FIXME: multi-resource not supported, must update effective permissions handling
+        layer = names.split(",")
         if layer:
+            # FIXME: multi-resource not supported, must update effective permissions handling
+            if len(layer) > 1:
+                LOGGER.warning("Multiple WFS layers access not implemented, considering access using parent workspace.")
+                return self.service, False
+            layer = layer[0]
             session = get_connected_session(self.request)
             layer_res = models.find_children_by_name(child_name=layer,
                                                      parent_id=self.service.resource_id,
@@ -1042,6 +1116,35 @@ def resource_requested(self):
         return self.service, True   # no children resource, so can only be the service
 
 
+class ServiceGeoserverWFS(ServiceWFS, ServiceGeoserverBase):
+    """
+    Service that represents a ``Web Feature Service`` endpoint with functionalities specific to ``GeoServer``.
+
+    .. seealso::
+        https://docs.geoserver.org/latest/en/user/services/wfs/reference.html
+    """
+    service_base = "wfs"
+    service_type = "geoserverwfs"
+
+    layer_param = "typenames"
+
+    permissions = ServiceWFS.permissions + [
+        # v1.1.0 only
+        Permission.GET_GML_OBJECT,
+        # v2.0.0 only
+        Permission.GET_PROPERTY_VALUE
+    ]
+
+    resource_types_permissions = {
+        models.Workspace: permissions,
+        models.Layer: permissions,
+    }
+
+    def resource_requested(self):
+        # type: () -> ResourceRequested
+        return ServiceGeoserverBase.resource_requested(self)
+
+
 class ServiceTHREDDS(ServiceInterface):
     """
     Service that represents a ``THREDDS Data Server`` endpoint.
@@ -1101,7 +1204,7 @@ def is_match(value, pattern):
             return None
 
     def resource_requested(self):
-        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
+        # type: () -> ResourceRequested
         path_parts = self.get_path_parts()
 
         # handle optional prefix as targeting the service directly
@@ -1137,6 +1240,7 @@ def resource_requested(self):
         return found_resource, target
 
     def permission_requested(self):
+        # type: () -> PermissionRequested
         cfg = self.get_config()
         path_parts = self.get_path_parts()
         path_prefix = None  # in case of no `<prefix>`, simulate as `null`
@@ -1159,11 +1263,20 @@ class ServiceGeoserverMeta(ServiceMeta):
     Mapping and grouping of property definitions for ``GeoServer`` services from distinct `OWS` implementations.
     """
     service_map = {
-        "wfs": ServiceWFS,
+        "wfs": ServiceGeoserverWFS,
         "wms": ServiceGeoserverWMS,
         "wps": ServiceWPS,
     }
 
+    @property
+    def params_expected(self):
+        # type: () -> List[Str]
+        params = set()
+        for svc in self.supported_ows:
+            if issubclass(svc, ServiceOWS) and hasattr(svc, "params_expected"):
+                params.update(svc.params_expected)
+        return list(params)
+
     @property
     def permissions(self):
         # type: () -> List[Permission]
@@ -1198,11 +1311,6 @@ class ServiceGeoserver(ServiceOWS):
     """
     service_type = "geoserver"
 
-    params_expected = [
-        "request",
-        "service"
-    ]
-
     # only allow workspace directly under service
     # then, only layer or process under that workspace
     child_structure_allowed = [
@@ -1265,14 +1373,14 @@ def service_requested(self):
         return type(self).service_map[svc]
 
     def resource_requested(self):
-        # type: () -> Optional[Tuple[ServiceOrResourceType, bool]]
+        # type: () -> ResourceRequested
         svc = self.service_requested()
         if not svc:
             return None
         return svc(self.service, self.request).resource_requested()
 
     def permission_requested(self):
-        # type: () -> Optional[Union[Permission, Collection[Permission]]]
+        # type: () -> PermissionRequested
         svc = self.service_requested()
         if not svc:
             return None
@@ -1283,6 +1391,7 @@ def permission_requested(self):
     ServiceAccess,
     ServiceAPI,
     ServiceGeoserver,
+    ServiceGeoserverWFS,
     ServiceGeoserverWMS,
     ServiceNCWMS2,
     ServiceTHREDDS,
@@ -1311,6 +1420,7 @@ def service_factory(service, request):
                     msg_on_fail="Undefined service type mapping to service object.")
 
     def _make_service(_typ, _svc, _req):
+        # type: (Str, models.Service, Request) -> ServiceInterface
         try:
             return SERVICE_TYPE_DICT[_typ](_svc, _req)
         except Exception as exc:
diff --git a/magpie/typedefs.py b/magpie/typedefs.py
index 2227e6ec1..0c26c66dd 100644
--- a/magpie/typedefs.py
+++ b/magpie/typedefs.py
@@ -8,7 +8,7 @@
 if TYPE_CHECKING:
     import math
     import typing
-    from typing import Any, AnyStr, Dict, Iterable, List, Optional, Tuple, Type, Union
+    from typing import Any, AnyStr, Collection, Dict, Iterable, List, Optional, Tuple, Type, Union
 
     import six
     from pyramid.config import Configurator
@@ -83,6 +83,9 @@
     AccessControlEntryType = Union[Tuple[Str, Str, Str], Str]
     AccessControlListType = List[AccessControlEntryType]
 
+    ResourceRequested = Optional[Tuple[ServiceOrResourceType, bool]]
+    PermissionRequested = Optional[Union[Permission, Collection[Permission]]]
+
     # note:
     #   For all following items 'Settings' suffix refer to loaded definitions AFTER resolution.
     #   When 'Config' suffix is used, it instead refers to raw definitions BEFORE resolution.
diff --git a/tests/test_services.py b/tests/test_services.py
index 2ea3b2b98..fe7831110 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -618,8 +618,10 @@ def test_ServiceGeoserverWMS_effective_permissions(self):
             Service1                                    (c-A-R)         c-A, m-D
                 Workspace1              (c-D-M)                         c-D, m-D
                 Workspace2              (m-A-M)                         c-A, m-A
+                    [Layer]                                             c-A, m-D
             Service2                                    (m-A-R)         c-D, m-A
                 Workspace3                              (c-A-M)         c-A, m-A
+                    [Layer]                                             c-A, m-A
         """
         svc1_name = "unittest-service-geoserverwms1"
         svc2_name = "unittest-service-geoserverwms2"
@@ -665,15 +667,17 @@ def test_ServiceGeoserverWMS_effective_permissions(self):
             utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden)
 
             # GetCapabilities of specific Workspace
+            # GetCapabilities is always applicable on Service only
+            #   allow/deny applied on children resources should not impact result according to permission on service
             path = "/ows/proxy/{}{}/{}/wms?request=getcapabilities".format(svc1_name, prefix, res1_name)
             req = self.mock_request(path, method="GET")
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden)
+            utils.check_no_raise(lambda: self.ows.check_request(req))
             path = "/ows/proxy/{}{}/{}/wms?request=getcapabilities".format(svc1_name, prefix, res2_name)
             req = self.mock_request(path, method="GET")
             utils.check_no_raise(lambda: self.ows.check_request(req))
             path = "/ows/proxy/{}{}/{}/wms?request=getcapabilities".format(svc2_name, prefix, res3_name)
             req = self.mock_request(path, method="GET")
-            utils.check_no_raise(lambda: self.ows.check_request(req))
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden)
 
             # GetMap of layer in Workspace (Workspace inferred from path prefix or layer name)
             # workspace 1
@@ -690,7 +694,7 @@ def test_ServiceGeoserverWMS_effective_permissions(self):
                 path = "{}{}/wms?request=getmap&layers={}".format(svc_prefix, workspace_prefix, layer_name)
                 req = self.mock_request(path, method="GET")
                 msg = "Using combination [{}, {}]".format("GET", path)
-                utils.check_no_raise(lambda: self.ows.check_request(req), msg=msg)
+                utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=msg)
             # workspace 3
             svc_prefix = "/ows/proxy/{}{}".format(svc2_name, prefix)
             layer_name = "{}:TEST_LAYER".format(res3_name)
@@ -988,8 +992,6 @@ def test_ServiceADES_effective_permissions(self):
         """
         raise NotImplementedError  # FIXME: see https://github.com/Ouranosinc/Magpie/issues/360
 
-    @unittest.skip("not implemented")  # FIXME: not implemented
-    @pytest.mark.skip
     @utils.mocked_get_settings
     def test_ServiceGeoserver_effective_permissions(self):
         """
@@ -1001,32 +1003,162 @@ def test_ServiceGeoserver_effective_permissions(self):
 
         Legend::
 
+            []: Resource does not exist in Magpie, but position matches actual resource for the target service
+            gc: GetCapabilities (shared by all OWS)
+            gf: GetFeature permission (WFS/WMS Layer)
+            gi: GetFeatureInfo permission (WFS/WMS Layer)
             dp: DescribeProcess permission (WPS Process)
-            gf: GetFeature permission (WFS Layer)
-            gi: GetFeatureInfo permission (WMS Layer)
             A: allow
             D: deny
-            M: match        (doesn't matter because service always directly referenced)
-            R: recursive    (doesn't matter because service always directly referenced)
+            M: match        (makes sense only on layer for any permission except GetCapabilities on service itself)
+            R: recursive    (resolution for multiple layers, permissions have no use on Service or Workspace themselves)
 
         Permissions Applied::
-                                        user        group               effective (reason)
-            Service1                    (a-A-R)                         a-A
-                Workspace1
-                    Layer1
-                    Layer2
+                                        user        group                       effective (detail)
+            Service1                    (gc-A-R)                                gc-A
+                Workspace1                          (gf-A-R)                    gf-A (but no use on Workspace itself)
+                    Layer1                          (gi-A-R)                    gf-A, gi-A
+                    Layer2              (gf-D-M)                                gf-D, gi-A
+                    [Layer3]                                                    gf-A, gi-D (doesn't exist, only R apply)
                     Process1
                     Process2
-
-            Service2                                (a-A-M)             a-A
-            Service3                    (a-D-M)                         a-D
-            Service4                                (a-D-R)             a-D
-            Service5                    (a-A-R)     (a-D-M)             a-A (user > group)
-            Service6                                                    a-D (nothing defaults like explicit deny)
         """
         svc_type = ServiceGeoserver.service_type
         svc1_name = "unittest-service-geoserver-1"
-        raise NotImplementedError
+        w1_name = "workspace1"
+        l1_name = "layer1"
+        l2_name = "layer2"
+
+        svc1_id, w1_id = utils.TestSetup.create_TestServiceResourceTree(
+            self,
+            override_service_name=svc1_name, override_service_type=svc_type,
+            override_resource_names=[w1_name], override_resource_types=[models.Workspace.resource_type_name],
+        )
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w1_id,
+            override_resource_name=l1_name,
+            override_resource_type=models.Layer.resource_type_name
+        )
+        l1_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w1_id,
+            override_resource_name=l2_name,
+            override_resource_type=models.Layer.resource_type_name
+        )
+        l2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+
+        # create permissions
+        gcAR = PermissionSet(Permission.GET_CAPABILITIES, Access.ALLOW, Scope.RECURSIVE)    # noqa
+        gfAR = PermissionSet(Permission.GET_FEATURE, Access.ALLOW, Scope.RECURSIVE)         # noqa
+        gfDM = PermissionSet(Permission.GET_FEATURE, Access.DENY, Scope.MATCH)              # noqa
+        giAR = PermissionSet(Permission.GET_FEATURE_INFO, Access.ALLOW, Scope.RECURSIVE)    # noqa
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=svc1_id, override_permission=gcAR)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=w1_id, override_permission=gfAR)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l1_id, override_permission=giAR)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l2_id, override_permission=gfDM)
+
+        # login test user for which the permissions were set
+        self.login_test_user()
+
+        # service calls
+        svc_path = "/ows/proxy/{}".format(svc1_name)
+
+        # request for any OWS
+        #   <HOST>/geoserver[/<WORKSPACE>]/<OWS>?request=GetCapabilities
+        for path in [svc_path, "{}/{}".format(svc_path, w1_name)]:
+            for ows in ["WFS", "WMS", "WPS"]:
+                ows_path = "{}/{}".format(path, ows.lower())
+                msg = "Using combination [{}, {}]".format("GET", ows_path)
+                req = self.mock_request(ows_path, method="GET", params={"request": Permission.GET_CAPABILITIES.title})
+                utils.check_no_raise(lambda: self.ows.check_request(req), msg=msg)
+
+        # request that applies only to WMS
+        # permission is valid on resource for both WFS and WMS, but they expect different parameter names
+        #   <HOST>/geoserver[/<WORKSPACE>]/[wfs|wms]?request=GetFeatureInfo&version=<>&[typeNames|layers]=<LAYER>
+        for path in [svc_path, "{}/{}".format(svc_path, w1_name)]:
+            wfs_path = "{}/wfs".format(path)
+            wms_path = "{}/wms".format(path)
+
+            def _msg(_path, _params):
+                _qs = "&".join("{}={}".format(k, v) for k, v in _params.items()) if _params else ""
+                return "Using combination [{}, {}]".format("GET", _path, _qs)
+
+            # Layer1, valid requests
+            params = {"request": Permission.GET_FEATURE.title, "layers": l1_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "typeNames": l1_name}
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
+
+            # Layer1, mismatched OWS path/param
+            #   because GetFeature is applied recursively on Workspace,
+            #   access is granted even if request is erroneous to retrieve its appropriate Layer resource
+            #   OWS service would normally return a bad request, but Magpie/Twitcher job is over at that point
+            params = {"request": Permission.GET_FEATURE.title, "typeNames": l1_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "layers": l1_name}
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
+
+            # Layer1, valid requests
+            params = {"request": Permission.GET_FEATURE_INFO.title, "layers": l1_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
+            params = {"request": Permission.GET_FEATURE_INFO.title, "typeNames": l1_name}
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
+
+            # Layer1, mismatched OWS path/param
+            #   in this case, GetFeatureInfo permission is applied directly on Layer
+            #   invalid params makes retrieval of the Layer resource to fail, and therefore access is blocked
+            params = {"request": Permission.GET_FEATURE_INFO.title, "typeNames": l1_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
+            params = {"request": Permission.GET_FEATURE_INFO.title, "layers": l1_name}
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
+
+            # Layer2, valid requests and mismatched OWS/path
+            #   resource is always blocked because of explicit deny permission on it, whether resource is found or not
+            params = {"request": Permission.GET_FEATURE.title, "layers": l2_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "typeNames": l2_name}
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "typeNames": l2_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "layers": l2_name}
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
+
+            # Layer2, valid requests and mismatched OWS/path
+            #   resource allowed because of Workspace permission
+            #   mismatched OWS/path would fail on target service side, but not Magpie/Twitcher
+            params = {"request": Permission.GET_FEATURE_INFO.title, "layers": l2_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "typeNames": l2_name}
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "typeNames": l2_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "layers": l2_name}
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
+
+            # invalid permission not applicable to WFS/WMS
+            params = {"request": Permission.DESCRIBE_PROCESS.title, "process": l1_name}
+            req = self.mock_request(wms_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
+            req = self.mock_request(wfs_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
 
 
 @runner.MAGPIE_TEST_LOCAL

From a120adf0b9d2c2be98fb142ea08130e59713f42f Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Mon, 10 Jan 2022 15:47:32 -0500
Subject: [PATCH 15/34] add wps test for geoserver(wfs+wms+wps) impl

---
 magpie/services.py     | 25 +++++++++----
 magpie/typedefs.py     |  1 +
 tests/test_services.py | 81 +++++++++++++++++++++++++++++++++---------
 3 files changed, 84 insertions(+), 23 deletions(-)

diff --git a/magpie/services.py b/magpie/services.py
index 019c733e5..2a3a2218c 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -40,6 +40,7 @@
         AccessControlListType,
         PermissionRequested,
         ResourceRequested,
+        ResourceTypePermissions,
         ServiceConfiguration,
         ServiceOrResourceType,
         Str
@@ -49,7 +50,7 @@
 class ServiceMeta(type):
     @property
     def resource_types(cls):
-        # type: (Type[ServiceInterface]) -> List[models.Resource]
+        # type: (Type[ServiceInterface]) -> List[Type[models.Resource]]
         """
         Allowed resources type classes under the service.
         """
@@ -99,7 +100,7 @@ def service_type(self):
     Permission allowed directly on the service as top-level resource.
     """
 
-    resource_types_permissions = {}  # type: Dict[Type[models.Resource], List[Permission]]
+    resource_types_permissions = {}  # type: ResourceTypePermissions
     """
     Mapping of resource types to lists of permissions defining allowed children resource permissions under the service.
     """
@@ -392,7 +393,7 @@ def get_resource_permissions(cls, resource_type_name):
         """
         Obtains the allowed permissions of the service's child resource fetched by resource type name.
         """
-        for res in cls.resource_types_permissions:  # type: Type[models.Resource]
+        for res in cls.resource_types_permissions:
             if res.resource_type_name == resource_type_name:
                 return cls.resource_types_permissions[res]
         return []
@@ -891,7 +892,7 @@ def layer_param(self):
     @property
     @abc.abstractmethod
     def resource_types_permissions(self):
-        # type: () -> Dict[Type[models.Resource], List[Permission]]
+        # type: () -> ResourceTypePermissions
         """
         Explicit permissions provided for resources for a given `OWS` implementation.
         """
@@ -916,7 +917,7 @@ def resource_requested(self):
         Parse the requested resource down to the applicable :class:`models.Workspace`.
 
         .. note::
-            Further child resource processing must be accomplished by the derived implementation based on their
+            Further child resource processing must be accomplished by the derived implementation as needed.
         """
         path_parts = self._get_request_path_parts()
         if not path_parts:
@@ -1288,11 +1289,16 @@ def permissions(self):
 
     @property
     def resource_types_permissions(self):
-        # type: () -> Dict[models.Resource, List[Permission]]
+        # type: () -> ResourceTypePermissions
         perms = {}
         for svc in self.supported_ows:
             if issubclass(svc, ServiceOWS) and hasattr(svc, "resource_types_permissions"):
-                perms.update(svc.resource_types_permissions)
+                svc_res_perms = svc.resource_types_permissions
+                for res_type, res_perms in svc_res_perms.items():
+                    if res_type in perms:
+                        perms[res_type] = list(set(perms[res_type]) | set(res_perms))
+                    else:
+                        perms[res_type] = list(res_perms)
         return perms
 
     @property
@@ -1323,6 +1329,11 @@ class ServiceGeoserver(ServiceOWS):
             models.Workspace.resource_type_name,
             models.Layer.resource_type_name,
         ),
+        # note:
+        #   In the context of Geoserver, WPS are applied on available resources (WFS, WMS, etc.)
+        #   For this reason, the Process also needs scoped Workspace access to work on them,
+        #   but the Workspace name MUST be in the path (identifier=<WORKSPACE>:<PROCESS_ID>) does not work.
+        #   Without the Workspace scope in the path, 'identifier' parameter resolves as if it was unspecified.
         "{}/{}/{}".format(
             models.Service.resource_type_name,
             models.Workspace.resource_type_name,
diff --git a/magpie/typedefs.py b/magpie/typedefs.py
index 0c26c66dd..8e28ae2a6 100644
--- a/magpie/typedefs.py
+++ b/magpie/typedefs.py
@@ -85,6 +85,7 @@
 
     ResourceRequested = Optional[Tuple[ServiceOrResourceType, bool]]
     PermissionRequested = Optional[Union[Permission, Collection[Permission]]]
+    ResourceTypePermissions = Dict[Type[models.Resource], List[Permission]]
 
     # note:
     #   For all following items 'Settings' suffix refer to loaded definitions AFTER resolution.
diff --git a/tests/test_services.py b/tests/test_services.py
index fe7831110..c23bb1c84 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -1014,20 +1014,27 @@ def test_ServiceGeoserver_effective_permissions(self):
             R: recursive    (resolution for multiple layers, permissions have no use on Service or Workspace themselves)
 
         Permissions Applied::
-                                        user        group                       effective (detail)
-            Service1                    (gc-A-R)                                gc-A
-                Workspace1                          (gf-A-R)                    gf-A (but no use on Workspace itself)
-                    Layer1                          (gi-A-R)                    gf-A, gi-A
-                    Layer2              (gf-D-M)                                gf-D, gi-A
-                    [Layer3]                                                    gf-A, gi-D (doesn't exist, only R apply)
-                    Process1
-                    Process2
+                                        user        group       effective (detail)
+            Service1                    (gc-A-R)                gc-A             (for each OWS)
+                Workspace1              (dp-A-R)    (gf-A-R)    dp-A, gf-A, gi-D (no match use on Workspace itself)
+                    Layer1                          (gi-A-R)    dp-D, gf-A, gi-A
+                    Layer2              (gf-D-M)                dp-D, gf-D, gi-A
+                    [Layer3]                                    dp-D, gf-A, gi-D (doesn't exist, only R apply)
+                    Process1                                    dp-A, gf-D, gi-D (gf/gi don't apply on Process)
+                    Process2                        (dp-D-M)    dp-D, gf-D, gi-D
+                    [Process3]                                  dp-A, gf-D, gi-D
+
+        .. note::
+            Permissions that do not applied to a given sub-`OWS` implementation are automatically denied.
+            For example, 'GetFeatureInfo' cannot be applied for a 'Process' nor can 'DescribeProcess' for a 'Layer'.
         """
         svc_type = ServiceGeoserver.service_type
         svc1_name = "unittest-service-geoserver-1"
         w1_name = "workspace1"
         l1_name = "layer1"
         l2_name = "layer2"
+        p1_name = "process1"
+        p2_name = "process2"
 
         svc1_id, w1_id = utils.TestSetup.create_TestServiceResourceTree(
             self,
@@ -1048,16 +1055,32 @@ def test_ServiceGeoserver_effective_permissions(self):
             override_resource_type=models.Layer.resource_type_name
         )
         l2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w1_id,
+            override_resource_name=p1_name,
+            override_resource_type=models.Process.resource_type_name
+        )
+        p1_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w1_id,
+            override_resource_name=p2_name,
+            override_resource_type=models.Process.resource_type_name
+        )
+        p2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
 
         # create permissions
         gcAR = PermissionSet(Permission.GET_CAPABILITIES, Access.ALLOW, Scope.RECURSIVE)    # noqa
         gfAR = PermissionSet(Permission.GET_FEATURE, Access.ALLOW, Scope.RECURSIVE)         # noqa
         gfDM = PermissionSet(Permission.GET_FEATURE, Access.DENY, Scope.MATCH)              # noqa
         giAR = PermissionSet(Permission.GET_FEATURE_INFO, Access.ALLOW, Scope.RECURSIVE)    # noqa
+        dpDM = PermissionSet(Permission.DESCRIBE_PROCESS, Access.DENY, Scope.MATCH)         # noqa
         utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=svc1_id, override_permission=gcAR)
         utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=w1_id, override_permission=gfAR)
         utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l1_id, override_permission=giAR)
         utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l2_id, override_permission=gfDM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=p2_id, override_permission=dpDM)
 
         # login test user for which the permissions were set
         self.login_test_user()
@@ -1065,14 +1088,18 @@ def test_ServiceGeoserver_effective_permissions(self):
         # service calls
         svc_path = "/ows/proxy/{}".format(svc1_name)
 
+        def _msg(_path, _params):
+            _qs = "&".join("{}={}".format(k, v) for k, v in _params.items()) if _params else ""
+            return "Using combination [{}, {}]".format("GET", _path, _qs)
+
         # request for any OWS
         #   <HOST>/geoserver[/<WORKSPACE>]/<OWS>?request=GetCapabilities
         for path in [svc_path, "{}/{}".format(svc_path, w1_name)]:
             for ows in ["WFS", "WMS", "WPS"]:
                 ows_path = "{}/{}".format(path, ows.lower())
-                msg = "Using combination [{}, {}]".format("GET", ows_path)
-                req = self.mock_request(ows_path, method="GET", params={"request": Permission.GET_CAPABILITIES.title})
-                utils.check_no_raise(lambda: self.ows.check_request(req), msg=msg)
+                params = {"request": Permission.GET_CAPABILITIES.title}
+                req = self.mock_request(ows_path, method="GET", params=params)
+                utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(ows_path, params))
 
         # request that applies only to WMS
         # permission is valid on resource for both WFS and WMS, but they expect different parameter names
@@ -1080,10 +1107,7 @@ def test_ServiceGeoserver_effective_permissions(self):
         for path in [svc_path, "{}/{}".format(svc_path, w1_name)]:
             wfs_path = "{}/wfs".format(path)
             wms_path = "{}/wms".format(path)
-
-            def _msg(_path, _params):
-                _qs = "&".join("{}={}".format(k, v) for k, v in _params.items()) if _params else ""
-                return "Using combination [{}, {}]".format("GET", _path, _qs)
+            wps_path = "{}/wps".format(path)
 
             # Layer1, valid requests
             params = {"request": Permission.GET_FEATURE.title, "layers": l1_name}
@@ -1154,12 +1178,37 @@ def _msg(_path, _params):
             utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
 
             # invalid permission not applicable to WFS/WMS
-            params = {"request": Permission.DESCRIBE_PROCESS.title, "process": l1_name}
+            params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": l1_name}
             req = self.mock_request(wms_path, method="GET", params=params)
             utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
             req = self.mock_request(wfs_path, method="GET", params=params)
             utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
 
+            # invalid permission not applicable to WPS
+            params = {"request": Permission.GET_FEATURE.title, "layers": l1_name}
+            req = self.mock_request(wps_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
+            params = {"request": Permission.GET_FEATURE.title, "typeNames": l1_name}
+            req = self.mock_request(wps_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
+            params = {"request": Permission.GET_FEATURE_INFO.title, "layers": l1_name}
+            req = self.mock_request(wps_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
+            params = {"request": Permission.GET_FEATURE_INFO.title, "typeNames": l1_name}
+            req = self.mock_request(wps_path, method="GET", params=params)
+            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
+
+        # valid WPS requests (workspace only expected to work when in path)
+        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}
+        req = self.mock_request(wps_path, method="GET", params=params)
+        utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
+        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}
+        req = self.mock_request(wps_path, method="GET", params=params)
+        utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wps_path, params))
+        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}
+        req = self.mock_request(wps_path, method="GET", params=params)
+        utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
+
 
 @runner.MAGPIE_TEST_LOCAL
 @runner.MAGPIE_TEST_SERVICES

From c6b84d5b162a801a35f6d68ac6feb4d376f40ec9 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Mon, 10 Jan 2022 16:11:48 -0500
Subject: [PATCH 16/34] fix lint

---
 .../api/management/resource/resource_utils.py | 26 ++++++++++---------
 magpie/models.py                              |  2 +-
 magpie/permissions.py                         |  2 +-
 magpie/services.py                            | 18 ++++++-------
 magpie/utils.py                               |  2 +-
 tests/test_services.py                        | 21 ++++++---------
 6 files changed, 34 insertions(+), 37 deletions(-)

diff --git a/magpie/api/management/resource/resource_utils.py b/magpie/api/management/resource/resource_utils.py
index cdb978985..ff9df3c51 100644
--- a/magpie/api/management/resource/resource_utils.py
+++ b/magpie/api/management/resource/resource_utils.py
@@ -84,18 +84,20 @@ def check_valid_service_resource(parent_resource, resource_type, db_session):
     ax.verify_param(resource_type, is_in=True, http_error=HTTPForbidden,
                     param_name="resource_type", param_compare=root_svc_cls.resource_type_names,
                     msg_on_fail="Invalid 'resource_type' specified for service type '{}'".format(root_service.type))
-    ax.verify_param(root_svc_cls.validate_nested_resource_type(parent_resource, resource_type), is_true=True,
-                    param_content={
-                        "resource_structure_allowed": root_svc_cls.child_structure_allowed,
-                        "resource_types_allowed": [
-                            res.resource_type for res in root_svc_cls.nested_resource_allowed(parent_resource)
-                        ]
-                    },
-                    http_error=HTTPUnprocessableEntity,
-                    msg_on_fail=(
-                        "Invalid 'resource_type' specified for service type '{}' is not allowed at this position "
-                        "under '{}' resource.".format(root_service.type, parent_type)
-                    ))
+    ax.verify_param(
+        root_svc_cls.validate_nested_resource_type(parent_resource, resource_type), is_true=True,
+        param_content={
+            "resource_structure_allowed": root_svc_cls.child_structure_allowed,
+            "resource_types_allowed": [
+                res.resource_type for res in root_svc_cls.nested_resource_allowed(parent_resource)
+            ]
+        },
+        http_error=HTTPUnprocessableEntity,
+        msg_on_fail=(
+            "Invalid 'resource_type' specified for service type '{}' is not allowed at this position "
+            "under '{}' resource.".format(root_service.type, parent_type)
+        )
+    )
     return root_service
 
 
diff --git a/magpie/models.py b/magpie/models.py
index 621d6a3df..d4ea591a7 100644
--- a/magpie/models.py
+++ b/magpie/models.py
@@ -41,7 +41,7 @@
     from sqlalchemy.orm.query import Query
     from sqlalchemy.orm.session import Session
 
-    from magpie.typedefs import AnySettingsContainer, AccessControlListType, GroupPriority, JSON, Str
+    from magpie.typedefs import JSON, AccessControlListType, AnySettingsContainer, GroupPriority, Str
 
     # for convenience of methods using both, using strings because of future definition
     AnyUser = Union["User", "UserPending"]
diff --git a/magpie/permissions.py b/magpie/permissions.py
index c909cae02..ed24e0c5d 100644
--- a/magpie/permissions.py
+++ b/magpie/permissions.py
@@ -14,10 +14,10 @@
 
     from magpie import models
     from magpie.typedefs import (
+        JSON,
         AccessControlEntryType,
         AnyPermissionType,
         GroupPriority,
-        JSON,
         PermissionDict,
         ResolvablePermissionType,
         Str
diff --git a/magpie/services.py b/magpie/services.py
index 2a3a2218c..486cff93c 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -866,7 +866,7 @@ def resource_requested(self):
         return found_child, target
 
 
-class ServiceGeoserverBase(ServiceInterface):
+class ServiceGeoserverBase(ServiceOWS):
     """
     Provides basic configuration parameters and functionalities shared by `Geoserver` implementations.
     """
@@ -1270,28 +1270,28 @@ class ServiceGeoserverMeta(ServiceMeta):
     }
 
     @property
-    def params_expected(self):
+    def params_expected(cls):
         # type: () -> List[Str]
         params = set()
-        for svc in self.supported_ows:
+        for svc in cls.supported_ows:  # pylint: disable=E1133,not-an-iterable
             if issubclass(svc, ServiceOWS) and hasattr(svc, "params_expected"):
                 params.update(svc.params_expected)
         return list(params)
 
     @property
-    def permissions(self):
+    def permissions(cls):
         # type: () -> List[Permission]
         perms = set()
-        for svc in self.supported_ows:
+        for svc in cls.supported_ows:  # pylint: disable=E1133,not-an-iterable
             if issubclass(svc, ServiceOWS) and hasattr(svc, "permissions"):
                 perms.update(svc.permissions)
         return list(perms)
 
     @property
-    def resource_types_permissions(self):
+    def resource_types_permissions(cls):
         # type: () -> ResourceTypePermissions
         perms = {}
-        for svc in self.supported_ows:
+        for svc in cls.supported_ows:  # pylint: disable=E1133,not-an-iterable
             if issubclass(svc, ServiceOWS) and hasattr(svc, "resource_types_permissions"):
                 svc_res_perms = svc.resource_types_permissions
                 for res_type, res_perms in svc_res_perms.items():
@@ -1302,9 +1302,9 @@ def resource_types_permissions(self):
         return perms
 
     @property
-    def supported_ows(self):
+    def supported_ows(cls):
         # type: () -> Set[Type[ServiceOWS]]
-        return set(self.service_map.values())
+        return set(cls.service_map.values())
 
 
 @six.add_metaclass(ServiceGeoserverMeta)
diff --git a/magpie/utils.py b/magpie/utils.py
index 79b2e5b72..35302dfe0 100644
--- a/magpie/utils.py
+++ b/magpie/utils.py
@@ -888,7 +888,7 @@ def title(self):
 
         Title use the original enum element name with capitalization considering underscores for separate words.
         """
-        return self.name.title().replace("_", "")
+        return self.name.title().replace("_", "")  # pylint: disable=E1101,no-member
 
 
 # note: must not define any enum value here to allow inheritance by subclasses
diff --git a/tests/test_services.py b/tests/test_services.py
index c23bb1c84..875256656 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -1035,6 +1035,7 @@ def test_ServiceGeoserver_effective_permissions(self):
         l2_name = "layer2"
         p1_name = "process1"
         p2_name = "process2"
+        p3_name = "process3"
 
         svc1_id, w1_id = utils.TestSetup.create_TestServiceResourceTree(
             self,
@@ -1055,13 +1056,6 @@ def test_ServiceGeoserver_effective_permissions(self):
             override_resource_type=models.Layer.resource_type_name
         )
         l2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
-        info = utils.TestSetup.create_TestResource(
-            self,
-            parent_resource_id=w1_id,
-            override_resource_name=p1_name,
-            override_resource_type=models.Process.resource_type_name
-        )
-        p1_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
         info = utils.TestSetup.create_TestResource(
             self,
             parent_resource_id=w1_id,
@@ -1089,8 +1083,9 @@ def test_ServiceGeoserver_effective_permissions(self):
         svc_path = "/ows/proxy/{}".format(svc1_name)
 
         def _msg(_path, _params):
-            _qs = "&".join("{}={}".format(k, v) for k, v in _params.items()) if _params else ""
-            return "Using combination [{}, {}]".format("GET", _path, _qs)
+            _qs = "&".join("{}={}".format(k, v) for k, v in _params.items())
+            path_qs = "{}?{}".format(_path, _qs) if _qs else _path
+            return "Using combination [{}, {}]".format("GET", path_qs)
 
         # request for any OWS
         #   <HOST>/geoserver[/<WORKSPACE>]/<OWS>?request=GetCapabilities
@@ -1201,13 +1196,13 @@ def _msg(_path, _params):
         # valid WPS requests (workspace only expected to work when in path)
         params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}
         req = self.mock_request(wps_path, method="GET", params=params)
-        utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
-        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}
-        req = self.mock_request(wps_path, method="GET", params=params)
         utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wps_path, params))
-        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}
+        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p2_name}
         req = self.mock_request(wps_path, method="GET", params=params)
         utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
+        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p3_name}
+        req = self.mock_request(wps_path, method="GET", params=params)
+        utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wps_path, params))
 
 
 @runner.MAGPIE_TEST_LOCAL

From 4b3699d218b57f5991b6f37848fbc6d8bb6d9640 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 11 Jan 2022 16:16:23 -0500
Subject: [PATCH 17/34] fix typo and add resource descriptions

---
 magpie/models.py       | 27 +++++++++++++++++++++++++++
 magpie/services.py     | 16 ++++++++--------
 tests/test_services.py |  7 ++++---
 3 files changed, 39 insertions(+), 11 deletions(-)

diff --git a/magpie/models.py b/magpie/models.py
index d4ea591a7..4da92e3a6 100644
--- a/magpie/models.py
+++ b/magpie/models.py
@@ -694,17 +694,35 @@ class PathBase(object):
 
 
 class File(Resource, PathBase):
+    """
+    Resource that represents the leaf node in a file-system-like hierarchy.
+
+    In the context of `THREDDS`, this represents the corresponding files exposed by the service.
+    This resource cannot have any children resource under it.
+    """
     child_resource_allowed = False
     resource_type_name = "file"
     __mapper_args__ = {"polymorphic_identity": resource_type_name}
 
 
 class Directory(Resource, PathBase):
+    """
+    Resource that represents an intermediate directory node within a file-system-like hierarchy.
+
+    In the context of `THREDDS`, this represents the corresponding directories exposed by the service.
+    Any amount of :class:`Directory` can be nested under itself to form the tree hierarchy.
+    """
     resource_type_name = "directory"
     __mapper_args__ = {"polymorphic_identity": resource_type_name}
 
 
 class Layer(Resource):
+    """
+    Resource that defines multiple corresponding representations of a layer according to the :term:`OWS` it lies under.
+
+    In the context of `WFS`, this is the represented collection of features.
+    In the context of `WMS`, this is the referenced features employed to generate the map.
+    """
     child_resource_allowed = False
     resource_type_name = "layer"
     __mapper_args__ = {"polymorphic_identity": resource_type_name}
@@ -718,6 +736,9 @@ class Layer(Resource):
 
 
 class Workspace(Resource):
+    """
+    Resource employed to contain a group of scoped :class:`Layer` within a `Geoserver` instance.
+    """
     resource_type_name = "workspace"
     __mapper_args__ = {"polymorphic_identity": resource_type_name}
 
@@ -730,6 +751,9 @@ class Workspace(Resource):
 
 
 class Route(Resource):
+    """
+    Resource employed to represent a single request path fragment.
+    """
     resource_type_name = "route"
     __mapper_args__ = {"polymorphic_identity": resource_type_name}
 
@@ -740,6 +764,9 @@ class Route(Resource):
 
 
 class Process(Resource):
+    """
+    Resource that represents a process under an :term:`OWS` instance servicing a `WPS` endpoint.
+    """
     child_resource_allowed = False
     resource_type_name = "process"
     __mapper_args__ = {"polymorphic_identity": resource_type_name}
diff --git a/magpie/services.py b/magpie/services.py
index 486cff93c..7f159fea4 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -446,7 +446,7 @@ def validate_nested_resource_type(cls, parent_resource, child_resource_type):
     def nested_resource_allowed(cls, parent_resource):
         # type: (ServiceOrResourceType) -> List[Type[models.Resource]]
         """
-        Obtain the nested resource types allowed as children children resource within structure definitions.
+        Obtain the nested resource types allowed as children resource within structure definitions.
         """
         if not cls.child_resource_allowed:
             return []
@@ -876,7 +876,7 @@ class ServiceGeoserverBase(ServiceOWS):
     def service_base(self):
         # type: () -> Str
         """
-        Name of the base `OWS` functionality serviced by `Geoserver`.
+        Name of the base :term:`OWS` functionality serviced by `Geoserver`.
         """
         raise NotImplementedError
 
@@ -894,7 +894,7 @@ def layer_param(self):
     def resource_types_permissions(self):
         # type: () -> ResourceTypePermissions
         """
-        Explicit permissions provided for resources for a given `OWS` implementation.
+        Explicit permissions provided for resources for a given :term:`OWS` implementation.
         """
         raise NotImplementedError
 
@@ -1261,7 +1261,7 @@ def permission_requested(self):
 
 class ServiceGeoserverMeta(ServiceMeta):
     """
-    Mapping and grouping of property definitions for ``GeoServer`` services from distinct `OWS` implementations.
+    Mapping and grouping of property definitions for `GeoServer` services from distinct :term:`OWS` implementations.
     """
     service_map = {
         "wfs": ServiceGeoserverWFS,
@@ -1310,7 +1310,7 @@ def supported_ows(cls):
 @six.add_metaclass(ServiceGeoserverMeta)
 class ServiceGeoserver(ServiceOWS):
     """
-    Service that encapsulates the multiple `OWS` endpoints from ``GeoServer`` services.
+    Service that encapsulates the multiple :term:`OWS` endpoints from `GeoServer` services.
 
     .. seealso::
         https://docs.geoserver.org/stable/en/user/services/index.html
@@ -1346,9 +1346,9 @@ class ServiceGeoserver(ServiceOWS):
     def get_config(self):
         # type: () -> ServiceConfiguration
         """
-        Obtain the configuration defining which `OWS` services are enabled under this instance.
+        Obtain the configuration defining which :term:`OWS` services are enabled under this instance.
 
-        Should provide a mapping of all `OWS` service type names to enabled boolean status.
+        Should provide a mapping of all :term:`OWS` service type names to enabled boolean status.
         """
         if self._config is not None:
             return self._config
@@ -1363,7 +1363,7 @@ def get_config(self):
     def service_requested(self):
         # type: () -> Optional[Type[ServiceOWS]]
         """
-        Obtain the applicable `OWS` implementation according to parsed request parameters.
+        Obtain the applicable :term:`OWS` implementation according to parsed request parameters.
         """
         # guaranteed to exist and lowercase string if provided, otherwise None
         svc = self.parser.params["service"]
diff --git a/tests/test_services.py b/tests/test_services.py
index 875256656..c121310ee 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -997,9 +997,10 @@ def test_ServiceGeoserver_effective_permissions(self):
         """
         Evaluates functionality of :class:`ServiceGeoserver` against a mocked `Magpie` adapter for `Twitcher`.
 
-        The :class:`ServiceGeoserver` implementation works as a combination of many `OWS` sub-services.
+        The :class:`ServiceGeoserver` implementation works as a combination of many :term:`OWS` sub-services.
         Validate that different resource types and distinct permissions can be simultaneously applied on them.
-        Effective permissions must be resolved with the appropriate `OWS` service accordingly with request parameters.
+        Effective permissions must be resolved with the appropriate :term:`OWS` service accordingly with request
+        parameters.
 
         Legend::
 
@@ -1025,7 +1026,7 @@ def test_ServiceGeoserver_effective_permissions(self):
                     [Process3]                                  dp-A, gf-D, gi-D
 
         .. note::
-            Permissions that do not applied to a given sub-`OWS` implementation are automatically denied.
+            Permissions that do not applied to a given sub-:term:`OWS` implementation are automatically denied.
             For example, 'GetFeatureInfo' cannot be applied for a 'Process' nor can 'DescribeProcess' for a 'Layer'.
         """
         svc_type = ServiceGeoserver.service_type

From 932b7ab9667202c365294bfb21eb32a434f4cebb Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 11 Jan 2022 16:36:28 -0500
Subject: [PATCH 18/34] use function for recuring children-allowed
 verifications

---
 .../api/management/resource/resource_views.py | 12 ++-----
 magpie/services.py                            | 33 ++++++++++++-------
 2 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/magpie/api/management/resource/resource_views.py b/magpie/api/management/resource/resource_views.py
index 59fcc438a..d3a13259d 100644
--- a/magpie/api/management/resource/resource_views.py
+++ b/magpie/api/management/resource/resource_views.py
@@ -12,7 +12,7 @@
 from magpie.api.management.service.service_utils import get_services_by_type
 from magpie.permissions import PermissionType, format_permissions
 from magpie.register import sync_services_phoenix
-from magpie.services import SERVICE_TYPE_DICT
+from magpie.services import SERVICE_TYPE_DICT, get_resource_child_allowed
 
 
 @s.ResourcesAPI.get(tags=[s.ResourcesTag], response_schemas=s.Resources_GET_responses)
@@ -143,19 +143,11 @@ def get_res_types(res):
         svc_impl = SERVICE_TYPE_DICT[svc_root.type]
         return svc_impl.nested_resource_allowed(res), svc_root
 
-    def get_res_child_allowed(res):
-        # make sure to obtain the specific resource/service implementation to avoid using the default
-        if res.resource_type_name == models.Service.resource_type_name:
-            res_impl = SERVICE_TYPE_DICT[res.type]
-        else:
-            res_impl = models.RESOURCE_TYPE_DICT[res.resource_type_name]
-        return res_impl.child_resource_allowed
-
     res_types, svc = ax.evaluate_call(lambda: get_res_types(resource),
                                       fallback=lambda: request.db.rollback(), http_error=HTTPInternalServerError,
                                       msg_on_fail="Error occurred while computing applicable children resource types.",
                                       content={"resource": rf.format_resource(resource, basic_info=True)})
-    child_allowed = ax.evaluate_call(lambda: get_res_child_allowed(resource),
+    child_allowed = ax.evaluate_call(lambda: get_resource_child_allowed(resource),
                                      http_error=HTTPInternalServerError,
                                      msg_on_fail="Error occurred while computing allowed children resource status.",
                                      content={"resource": rf.format_resource(resource, basic_info=True)})
diff --git a/magpie/services.py b/magpie/services.py
index 7f159fea4..5b9eb5f4c 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -426,12 +426,7 @@ def validate_nested_resource_type(cls, parent_resource, child_resource_type):
         """
         if not cls.child_resource_allowed:
             return False
-        # make sure to obtain the specific resource/service implementation to avoid using the default
-        if parent_resource.resource_type_name == models.Service.resource_type_name:
-            res_impl = SERVICE_TYPE_DICT[parent_resource.type]
-        else:
-            res_impl = models.RESOURCE_TYPE_DICT[parent_resource.resource_type_name]
-        if not res_impl.child_resource_allowed:
+        if not get_resource_child_allowed(parent_resource):
             return False
         # if undefined control structures, assume any combination of nested resource is allowed (original behaviour)
         if not cls.child_structure_allowed:
@@ -450,12 +445,7 @@ def nested_resource_allowed(cls, parent_resource):
         """
         if not cls.child_resource_allowed:
             return []
-        # make sure to obtain the specific resource/service implementation to avoid using the default
-        if parent_resource.resource_type_name == models.Service.resource_type_name:
-            res_impl = SERVICE_TYPE_DICT[parent_resource.type]
-        else:
-            res_impl = models.RESOURCE_TYPE_DICT[parent_resource.resource_type_name]
-        if not res_impl.child_resource_allowed:
+        if not get_resource_child_allowed(parent_resource):
             return []
         # if undefined control structures, any combination is allowed (original behaviour)
         if not cls.child_structure_allowed:
@@ -1444,6 +1434,25 @@ def _make_service(_typ, _svc, _req):
                             msg_on_fail="Failed to find requested service type.")
 
 
+def get_resource_child_allowed(resource):
+    # type: (ServiceOrResourceType) -> bool
+    """
+    Verifies if the specified resource allows nesting children resources under it considering its specific type.
+
+    Makes sure to obtain the specific :class:`Service` or :class:`Resource` implementation to verify children support.
+    If this is not accomplished, the default attribute of base :class:`Service` or :class:`Resource` would erroneously
+    indicate that children are allowed.
+
+    :param resource: Item for which to verify if children resources are allowed.
+    :return: Whether the resource can nest more resources or not.
+    """
+    if resource.resource_type_name == models.Service.resource_type_name:
+        res_impl = SERVICE_TYPE_DICT[resource.type]
+    else:
+        res_impl = models.RESOURCE_TYPE_DICT[resource.resource_type_name]
+    return res_impl.child_resource_allowed
+
+
 def invalidate_service(service_name):
     # type: (Str) -> None
     """

From 47feda7a98192c259d2473637410cc3fd92886a8 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 11 Jan 2022 17:42:24 -0500
Subject: [PATCH 19/34] fix css checker & css lint

---
 Makefile                        | 2 +-
 magpie/ui/home/static/style.css | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 2511a8a74..35bf04d2a 100644
--- a/Makefile
+++ b/Makefile
@@ -396,7 +396,7 @@ install-npm:    		## install npm package manager if it cannot be found
 	)
 	@[ `npm ls 2>/dev/null | grep stylelint-config-standard | wc -l` = 1 ] || ( \
 		echo "Install required libraries for style checks." && \
-		npm install stylelint stylelint-config-standard --save-dev \
+		npm install stylelint@13.13.1 stylelint-config-standard@22.0.0 --save-dev \
 	)
 
 ## --- Launchers targets --- ##
diff --git a/magpie/ui/home/static/style.css b/magpie/ui/home/static/style.css
index 69fe61957..6f3526631 100644
--- a/magpie/ui/home/static/style.css
+++ b/magpie/ui/home/static/style.css
@@ -1299,7 +1299,7 @@ table.fields-table input[type="radio"] {
 }
 
 .service-button {
-    margin-left: 40%
+    margin-left: 40%;
 }
 
 .service-config-error {

From 86bc072f0f35e12e6fe6a4cadb4c31ef9703bb82 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 11 Jan 2022 23:06:24 -0500
Subject: [PATCH 20/34] fixes and even more tests to validate Geoserver
 effective resolution

---
 CHANGES.rst                         |   2 +-
 magpie/adapter/magpieowssecurity.py |   1 +
 magpie/services.py                  | 123 ++++++++---
 tests/interfaces.py                 | 162 +++++++++-----
 tests/test_services.py              | 322 ++++++++++++++++++----------
 5 files changed, 405 insertions(+), 205 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 60c50c4a6..681ecb1e1 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -48,7 +48,7 @@ Bug Fixes
 * Fix base ``Permission`` definitions for all variants of `WMS` according to their reference implementations.
 * Remove multiple invalid schema path definitions that are not mapped against any concrete API endpoint.
 * Fix reporting of ``Service`` configuration for any type that supports it. Unless overridden during creation with a
-  custom configuration, ``ServiceTHREDDS`` implementation would not report their default configuration and would
+  custom configuration, ``ServiceTHREDDS`` instances would not report their default ``configuration`` field and would
   instead return ``null``, making it difficult to know from the API if default or no configuration was being applied
   for a given ``Service``.
 * Fix `Effective Resolution` of ``Permission`` applied for ``ServiceGeoserverWMS`` to consider ``Scope`` modifier
diff --git a/magpie/adapter/magpieowssecurity.py b/magpie/adapter/magpieowssecurity.py
index 3dd5324a3..b68279219 100644
--- a/magpie/adapter/magpieowssecurity.py
+++ b/magpie/adapter/magpieowssecurity.py
@@ -259,6 +259,7 @@ def check_request(self, request):
             raise OWSAccessForbidden(error_desc, status_base=error_base, **error_kw)
 
     def update_request_cookies(self, request):
+        # type: (Request) -> None
         """
         Ensure login of the user and update the request cookies if Twitcher is in a special configuration.
 
diff --git a/magpie/services.py b/magpie/services.py
index 5b9eb5f4c..b44d428bd 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -670,16 +670,25 @@ def _set_request(self, request):
             return  # avoid error parsing undefined request
         # must reset the parser from scratch if request changes to ensure everything is updated with new inputs
         self.parser = ows_parser_factory(request)
-        self.parser.parse(self.params_expected)  # run parsing to obtain guaranteed lowered-name parameters
+        self.parser.parse(type(self).params_expected)  # run parsing to obtain guaranteed lowercase parameters
 
     request = property(_get_request, _set_request)
 
+    @property
+    @abc.abstractmethod
+    def service_base(self):
+        # type: () -> Str
+        """
+        Name of the base :term:`OWS` functionality serviced by `Geoserver`.
+        """
+        raise NotImplementedError
+
     @abc.abstractmethod
     def resource_requested(self):
         raise NotImplementedError
 
     def permission_requested(self):
-        # type: () -> Permission
+        # type: () -> PermissionRequested
         try:
             req = self.parser.params["request"]
             perm = Permission.get(str(req).lower())
@@ -691,6 +700,8 @@ def permission_requested(self):
                     "Unable to resolve the requested access for service: [{!s}].".format(self.service.resource_name)
                 )
             )
+            if perm not in self.permissions:
+                return None
             return perm
         except KeyError as exc:
             raise NotImplementedError("Exception: [{!r}] for class '{}'.".format(exc, type(self)))
@@ -700,7 +711,7 @@ class ServiceWPS(ServiceOWS):
     """
     Service that represents a ``Web Processing Service`` endpoint.
     """
-
+    service_base = "wps"
     service_type = "wps"
 
     permissions = [
@@ -737,7 +748,8 @@ def resource_requested(self):
             if proc:
                 return proc, True
             return self.service, False
-        raise NotImplementedError("Unknown WPS operation for permission: {}".format(wps_request))
+        LOGGER.debug("Unknown WPS operation for permission: %s", wps_request)
+        return None
 
 
 class ServiceBaseWMS(ServiceOWS):
@@ -776,6 +788,7 @@ class ServiceNCWMS2(ServiceBaseWMS):
     .. seealso::
         https://reading-escience-centre.gitbooks.io/ncwms-user-guide/content/04-usage.html
     """
+    service_base = "wms"
     service_type = "ncwms"
 
     permissions = [
@@ -863,19 +876,24 @@ class ServiceGeoserverBase(ServiceOWS):
 
     @property
     @abc.abstractmethod
-    def service_base(self):
-        # type: () -> Str
+    def resource_scoped(self):
+        # type: () -> bool
         """
-        Name of the base :term:`OWS` functionality serviced by `Geoserver`.
+        Indicates if the resource is allowed to employ scoped workspace naming.
+
+        When allowed, the :class:`models.Workspace` can be inferred from the request parameter
+        defined by :attr:`resource_param` to retrieve scoped name as ``<WORKSPACE>:<RESOURCE>``.
+        When not allowed, the resource name is left untouched can will not attempt to infer
+        any :class:`models.Workspace` from it.
         """
         raise NotImplementedError
 
     @property
     @abc.abstractmethod
-    def layer_param(self):
+    def resource_param(self):
         # type: () -> Str
         """
-        Name of the request query parameter to access requested :class:`models.Layer` children resource.
+        Name of the request query parameter to access requested leaf children resource.
         """
         raise NotImplementedError
 
@@ -888,6 +906,16 @@ def resource_types_permissions(self):
         """
         raise NotImplementedError
 
+    @property
+    def params_expected(self):
+        # type: () -> List[Str]
+        return [
+            "request",
+            "service",
+            "version",
+            self.resource_param,
+        ]
+
     # only workspace directly followed by layers
     child_structure_allowed = [
         "{}/{}".format(
@@ -921,7 +949,7 @@ def resource_requested(self):
             path_parts = path_parts[1:]
             parts_lower = parts_lower[1:]
         workspace_name = None
-        layer_name = None
+        res_name = None
         if len(parts_lower) > 1 and parts_lower[1] == self.service_base:
             workspace_name = path_parts[0]
         if permission == Permission.GET_CAPABILITIES:
@@ -936,12 +964,20 @@ def resource_requested(self):
                 return self.service, True
         else:
             # following requests lead to the same resolution, need to check the workspace in the layer
-            #   /geoserver/<WORKSPACE>/<OWS>?<LAYER_PARAM>=[<WORKSPACE>:]<LAYER_NAME>&request=<PERMISSION>
-            #   /geoserver/<OWS>?<LAYER_PARAM>=<WORKSPACE>:<LAYER_NAME>&request=<PERMISSION>
-            if not workspace_name:
-                layer_name = self.parser.params[self.layer_param] or ""
-                if ":" in layer_name:  # if missing, consider layer name as not scoped under workspace
-                    workspace_name, layer_name = layer_name.rsplit(":", 1)
+            #   /geoserver/<WORKSPACE>/<OWS>?<RESOURCE_PARAM>=[<WORKSPACE>:]<LAYER_NAME>&request=<PERMISSION>
+            #   /geoserver/<OWS>?<RESOURCE_PARAM>=<WORKSPACE>:<LAYER_NAME>&request=<PERMISSION>
+            res_name = self.parser.params[self.resource_param] or ""
+            # if missing, consider layer name as not scoped under workspace
+            if self.resource_scoped and ":" in res_name:
+                workspace_scope, res_name = res_name.rsplit(":", 1)
+                if not workspace_name:
+                    workspace_name = workspace_scope
+                elif workspace_name != workspace_scope:
+                    # In case the request was formed with both workspace in path and scoped layer name,
+                    # consider the workspace as not resolved since we cannot know which one to target.
+                    # This avoids erroneously granting access to restricted layer from another workspace by
+                    # forging a request that would include some workspace for which the user does have access.
+                    workspace_name = None
         if not workspace_name:
             return self.service, False
         session = get_connected_session(self.request)
@@ -949,13 +985,13 @@ def resource_requested(self):
                                                  parent_id=self.service.resource_id,
                                                  db_session=session)
         if workspace:
-            if not layer_name:
+            if not res_name:
                 return workspace, False
-            layer = models.find_children_by_name(child_name=layer_name,
-                                                 parent_id=workspace.resource_id,
-                                                 db_session=session)
-            if layer:
-                return layer, True
+            resource = models.find_children_by_name(child_name=res_name,
+                                                    parent_id=workspace.resource_id,
+                                                    db_session=session)
+            if resource:
+                return resource, True
             return workspace, False
         return self.service, False
 
@@ -970,7 +1006,8 @@ class ServiceGeoserverWMS(ServiceBaseWMS, ServiceGeoserverBase):
     service_base = "wms"
     service_type = "geoserverwms"
 
-    layer_param = "layers"
+    resource_scoped = True
+    resource_param = "layers"
 
     permissions = [
         Permission.GET_CAPABILITIES,
@@ -1054,8 +1091,8 @@ class ServiceWFS(ServiceOWS):
 
     .. seealso::
         https://www.ogc.org/standards/wfs (OpenGIS WFS 2.0.0 implementation)
-        - https://docs.geoserver.org/latest/en/user/services/wfs/reference.html
     """
+    service_base = "wfs"
     service_type = "wfs"
 
     permissions = [
@@ -1117,7 +1154,8 @@ class ServiceGeoserverWFS(ServiceWFS, ServiceGeoserverBase):
     service_base = "wfs"
     service_type = "geoserverwfs"
 
-    layer_param = "typenames"
+    resource_scoped = True
+    resource_param = "typenames"
 
     permissions = ServiceWFS.permissions + [
         # v1.1.0 only
@@ -1249,6 +1287,25 @@ def permission_requested(self):
         return None  # automatically deny
 
 
+class ServiceGeoserverWPS(ServiceWPS, ServiceGeoserverBase):
+    """
+    Service that represents a ``Web Processing Service`` under a `Geoserver` instance.
+    """
+    service_type = "geoserverwps"
+
+    resource_scoped = False  # name in 'identifier' must not be split and does not match WORKSPACE
+    resource_param = "identifier"
+
+    resource_types_permissions = {
+        models.Workspace: ServiceWPS.permissions,
+        models.Process: models.Process.permissions,
+    }
+
+    def resource_requested(self):
+        # type: () -> ResourceRequested
+        return ServiceGeoserverBase.resource_requested(self)
+
+
 class ServiceGeoserverMeta(ServiceMeta):
     """
     Mapping and grouping of property definitions for `GeoServer` services from distinct :term:`OWS` implementations.
@@ -1256,7 +1313,7 @@ class ServiceGeoserverMeta(ServiceMeta):
     service_map = {
         "wfs": ServiceGeoserverWFS,
         "wms": ServiceGeoserverWMS,
-        "wps": ServiceWPS,
+        "wps": ServiceGeoserverWPS,
     }
 
     @property
@@ -1280,7 +1337,7 @@ def permissions(cls):
     @property
     def resource_types_permissions(cls):
         # type: () -> ResourceTypePermissions
-        perms = {}
+        perms = {}  # type: ResourceTypePermissions
         for svc in cls.supported_ows:  # pylint: disable=E1133,not-an-iterable
             if issubclass(svc, ServiceOWS) and hasattr(svc, "resource_types_permissions"):
                 svc_res_perms = svc.resource_types_permissions
@@ -1305,6 +1362,7 @@ class ServiceGeoserver(ServiceOWS):
     .. seealso::
         https://docs.geoserver.org/stable/en/user/services/index.html
     """
+    service_base = None  # use ServiceGeoserverMeta.service_map
     service_type = "geoserver"
 
     # only allow workspace directly under service
@@ -1361,13 +1419,12 @@ def service_requested(self):
         if not svc and req:
             # geoserver allows omitting 'service' request query parameter because it can be inferred from the path
             # since all OWS services are accessed using '/geoserver/<SERVICE>?request=...'
-            # attempt to match using applicable 'request' parameter
+            # attempt to match using applicable path fragment
+            svc_path = self.request.path.rsplit("/", 1)[-1].lower()
             for svc_ows in type(self).supported_ows:
-                if issubclass(svc_ows, ServiceInterface) and hasattr(svc_ows, "permissions"):
-                    perm = Permission(req)
-                    if perm in svc_ows.permissions:
-                        svc = svc_ows
-                        break
+                if svc_path == svc_ows.service_base:
+                    svc = svc_ows.service_base
+                    break
         config = self.get_config()
         if svc not in config or not config[svc]:
             return None
diff --git a/tests/interfaces.py b/tests/interfaces.py
index 3e351cc64..dffec64ae 100644
--- a/tests/interfaces.py
+++ b/tests/interfaces.py
@@ -5270,7 +5270,10 @@ def test_PatchService_NoUpdateInfo(self):
         data = {"service_name": svc_name, "configuration": svc_config}
         resp = utils.test_request(self, self.update_method, path, data=data, expect_errors=True,
                                   headers=self.json_headers, cookies=self.cookies)
-        utils.check_response_basic_info(resp, 200, expected_method=self.update_method)
+        body = utils.check_response_basic_info(resp, 200, expected_method=self.update_method)
+        if TestVersion(self.version) >= TestVersion("3.21.0"):
+            # obtain full configuration (with non-provided defaults included) to attempt update with exact value
+            svc_config = body["service"]["configuration"]
 
         # test case of omitted update fields
         resp = utils.test_request(self, self.update_method, path, data={}, expect_errors=True,
@@ -5308,6 +5311,9 @@ def test_PatchService_UpdateConfigOnly(self):
         Validate that an update of only the additional JSON configuration field is accepted.
 
         Updates should allow both modification or erasure of the configuration without any other field.
+
+        .. versionchanged:: 3.21
+            Newer versions report the full configuration including defaults for fields that were not provided.
         """
         # Prior to this version, config-only was refused (had to be combined with service name or url field)
         utils.warn_version(self, "update only service configuration field", "3.15", skip=True)
@@ -5320,22 +5326,49 @@ def test_PatchService_UpdateConfigOnly(self):
         apply_config_data = {"configuration": {"ignore_prefix": "something"}}
         modif_config_data = {"configuration": {"ignore_prefix": "other", "file_patterns": [".+\\.nc"]}}
         erase_config_data = {"configuration": None}
+        expected_fields = ["ignore_prefix", "skip_prefix", "file_patterns", "data_type", "metadata_type"]
 
         resp = utils.test_request(self, self.update_method, path, data=apply_config_data,
                                   headers=self.json_headers, cookies=self.cookies)
         body = utils.check_response_basic_info(resp, 200, expected_method=self.update_method)
-        utils.check_val_equal(body["service"]["configuration"], apply_config_data["configuration"], diff=True)
+        if TestVersion(self.version) <= TestVersion("3.20.0"):
+            utils.check_val_equal(body["service"]["configuration"], apply_config_data["configuration"], diff=True)
+        else:
+            for field in expected_fields:
+                utils.check_val_is_in(field, body["service"]["configuration"])
+            post_ignore_prefix = apply_config_data["configuration"]["ignore_prefix"]
+            body_ignore_prefix = body["service"]["configuration"]["ignore_prefix"]  # type: ignore
+            utils.check_val_equal(body_ignore_prefix, post_ignore_prefix)
 
         resp = utils.test_request(self, self.update_method, path, data=modif_config_data,
                                   headers=self.json_headers, cookies=self.cookies)
         body = utils.check_response_basic_info(resp, 200, expected_method=self.update_method)
-        utils.check_val_equal(body["service"]["configuration"], modif_config_data["configuration"], diff=True)
+        if TestVersion(self.version) <= TestVersion("3.20.0"):
+            utils.check_val_equal(body["service"]["configuration"], modif_config_data["configuration"], diff=True)
+        else:
+            for field in expected_fields:
+                utils.check_val_is_in(field, body["service"]["configuration"])
+            for field in modif_config_data["configuration"]:
+                post_field = modif_config_data["configuration"][field]
+                body_field = body["service"]["configuration"]["ignore_prefix"]  # type: ignore
+                utils.check_val_equal(body_field, post_field)
 
         resp = utils.test_request(self, self.update_method, path, data=erase_config_data,
                                   headers=self.json_headers, cookies=self.cookies)
         body = utils.check_response_basic_info(resp, 200, expected_method=self.update_method)
-        utils.check_val_equal(body["service"]["configuration"], None, diff=True,
-                              msg="Erase should be allowed with explicit None (null) JSON configuration.")
+        if TestVersion(self.version) <= TestVersion("3.20.0"):
+            utils.check_val_equal(body["service"]["configuration"], None, diff=True,
+                                  msg="Erase should be allowed with explicit None (null) JSON configuration.")
+        else:
+            for field in expected_fields:
+                utils.check_val_is_in(field, body["service"]["configuration"])
+
+            class MockServiceResource(object):
+                configuration = None
+
+            default_thredds_config = ServiceTHREDDS(MockServiceResource(), None).get_config()  # type: ignore
+            utils.check_val_equal(body["service"]["configuration"], default_thredds_config, diff=True,
+                                  msg="JSON configuration following explicit None (null) erase should use default.")
 
     @runner.MAGPIE_TEST_SERVICES
     def test_PatchService_ReservedKeyword_Types(self):
@@ -6026,12 +6059,12 @@ def test_GetResourceTypes_ServiceAccess(self):
         utils.check_val_is_in("root_service_name", body)
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], self.test_service_name)
-        utils.check_val_is_in(body["resource_type"], "service")
-        utils.check_val_is_in(body["children_resource_types"], [])
-        utils.check_val_is_in(body["children_resource_allowed"], False)
-        utils.check_val_is_in(body["root_service_id"], svc_id)
-        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
-        utils.check_val_is_in(body["root_service_type"], ServiceAccess.service_type)
+        utils.check_val_equal(body["resource_type"], "service")
+        utils.check_val_equal(body["children_resource_types"], [])
+        utils.check_val_equal(body["children_resource_allowed"], False)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], ServiceAccess.service_type)
 
     @runner.MAGPIE_TEST_RESOURCES
     @runner.MAGPIE_TEST_SERVICES
@@ -6039,12 +6072,17 @@ def test_GetResourceTypes_ServiceAPI(self):
         utils.warn_version(self, "validate allowed nested children resource types structure", "3.21.0", skip=True)
 
         utils.TestSetup.delete_TestService(self)
-        body = utils.TestSetup.create_TestServiceResource(self)
+        body = utils.TestSetup.create_TestService(self)
         info = utils.TestSetup.get_ResourceInfo(self, override_body=body)
         svc_id = info["resource_id"]
-        body = utils.TestSetup.create_TestResource(self, parent_resource_id=svc_id)
+        res1_name = "test1"
+        res2_name = "test2"
+        body = utils.TestSetup.create_TestResource(self, parent_resource_id=svc_id, override_resource_name=res1_name)
         info = utils.TestSetup.get_ResourceInfo(self, override_body=body)
-        res_id = info["resource_id"]
+        res1_id = info["resource_id"]
+        body = utils.TestSetup.create_TestResource(self, parent_resource_id=res1_id, override_resource_name=res2_name)
+        info = utils.TestSetup.get_ResourceInfo(self, override_body=body)
+        res2_id = info["resource_id"]
 
         path = "/resources/{}/types".format(svc_id)
         resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
@@ -6057,14 +6095,14 @@ def test_GetResourceTypes_ServiceAPI(self):
         utils.check_val_is_in("root_service_name", body)
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], self.test_service_name)
-        utils.check_val_is_in(body["resource_type"], "service")
-        utils.check_val_is_in(body["children_resource_types"], [self.test_resource_type])  # only routes under service
-        utils.check_val_is_in(body["children_resource_allowed"], True)
-        utils.check_val_is_in(body["root_service_id"], svc_id)
-        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
-        utils.check_val_is_in(body["root_service_type"], self.test_service_type)
-
-        path = "/resources/{}/types".format(res_id)
+        utils.check_val_equal(body["resource_type"], "service")
+        utils.check_val_equal(body["children_resource_types"], [self.test_resource_type])  # only routes under service
+        utils.check_val_equal(body["children_resource_allowed"], True)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], self.test_service_type)
+
+        path = "/resources/{}/types".format(res1_id)
         resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
         body = utils.check_response_basic_info(resp)
         utils.check_val_is_in("resource_name", body)
@@ -6074,13 +6112,31 @@ def test_GetResourceTypes_ServiceAPI(self):
         utils.check_val_is_in("root_service_id", body)
         utils.check_val_is_in("root_service_name", body)
         utils.check_val_is_in("root_service_type", body)
-        utils.check_val_equal(body["resource_name"], self.test_resource_name)
-        utils.check_val_is_in(body["resource_type"], "service")
-        utils.check_val_is_in(body["children_resource_types"], [self.test_resource_type])  # routes nested any depth
-        utils.check_val_is_in(body["children_resource_allowed"], True)
-        utils.check_val_is_in(body["root_service_id"], svc_id)
-        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
-        utils.check_val_is_in(body["root_service_type"], self.test_service_type)
+        utils.check_val_equal(body["resource_name"], res1_name)
+        utils.check_val_equal(body["resource_type"], self.test_resource_type)
+        utils.check_val_equal(body["children_resource_types"], [self.test_resource_type])  # routes nested any depth
+        utils.check_val_equal(body["children_resource_allowed"], True)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], self.test_service_type)
+
+        path = "/resources/{}/types".format(res2_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], res2_name)
+        utils.check_val_equal(body["resource_type"], self.test_resource_type)
+        utils.check_val_equal(body["children_resource_types"], [self.test_resource_type])  # routes nested any depth
+        utils.check_val_equal(body["children_resource_allowed"], True)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], self.test_service_type)
 
     @runner.MAGPIE_TEST_RESOURCES
     @runner.MAGPIE_TEST_SERVICES
@@ -6120,12 +6176,12 @@ def test_GetResourceTypes_ServiceTHREDDS(self):
         utils.check_val_is_in("root_service_name", body)
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], self.test_service_name)
-        utils.check_val_is_in(body["resource_type"], "service")
-        utils.check_val_is_in(body["children_resource_types"], res_types_allowed)
-        utils.check_val_is_in(body["children_resource_allowed"], True)
-        utils.check_val_is_in(body["root_service_id"], svc_id)
-        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
-        utils.check_val_is_in(body["root_service_type"], ServiceTHREDDS.service_type)
+        utils.check_val_equal(body["resource_type"], "service")
+        utils.check_val_equal(body["children_resource_types"], res_types_allowed)
+        utils.check_val_equal(body["children_resource_allowed"], True)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], ServiceTHREDDS.service_type)
 
         path = "/resources/{}/types".format(dir1_id)
         resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
@@ -6138,12 +6194,12 @@ def test_GetResourceTypes_ServiceTHREDDS(self):
         utils.check_val_is_in("root_service_name", body)
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], dir1_name)
-        utils.check_val_is_in(body["resource_type"], "service")
-        utils.check_val_is_in(body["children_resource_types"], res_types_allowed)
-        utils.check_val_is_in(body["children_resource_allowed"], True)
-        utils.check_val_is_in(body["root_service_id"], svc_id)
-        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
-        utils.check_val_is_in(body["root_service_type"], ServiceTHREDDS.service_type)
+        utils.check_val_equal(body["resource_type"], Directory.resource_type_name)
+        utils.check_val_equal(body["children_resource_types"], res_types_allowed)
+        utils.check_val_equal(body["children_resource_allowed"], True)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], ServiceTHREDDS.service_type)
 
         path = "/resources/{}/types".format(dir2_id)
         resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
@@ -6156,12 +6212,12 @@ def test_GetResourceTypes_ServiceTHREDDS(self):
         utils.check_val_is_in("root_service_name", body)
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], dir2_name)
-        utils.check_val_is_in(body["resource_type"], "service")
-        utils.check_val_is_in(body["children_resource_types"], res_types_allowed)
-        utils.check_val_is_in(body["children_resource_allowed"], True)
-        utils.check_val_is_in(body["root_service_id"], svc_id)
-        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
-        utils.check_val_is_in(body["root_service_type"], ServiceTHREDDS.service_type)
+        utils.check_val_equal(body["resource_type"], Directory.resource_type_name)
+        utils.check_val_equal(body["children_resource_types"], res_types_allowed)
+        utils.check_val_equal(body["children_resource_allowed"], True)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], ServiceTHREDDS.service_type)
 
         path = "/resources/{}/types".format(file_id)
         resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
@@ -6174,12 +6230,12 @@ def test_GetResourceTypes_ServiceTHREDDS(self):
         utils.check_val_is_in("root_service_name", body)
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], file_name)
-        utils.check_val_is_in(body["resource_type"], "service")
-        utils.check_val_is_in(body["children_resource_types"], [])
-        utils.check_val_is_in(body["children_resource_allowed"], False)
-        utils.check_val_is_in(body["root_service_id"], svc_id)
-        utils.check_val_is_in(body["root_service_name"], self.test_service_name)
-        utils.check_val_is_in(body["root_service_type"], ServiceTHREDDS.service_type)
+        utils.check_val_equal(body["resource_type"], File.resource_type_name)
+        utils.check_val_equal(body["children_resource_types"], [])
+        utils.check_val_equal(body["children_resource_allowed"], False)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], ServiceTHREDDS.service_type)
 
 
 @runner.MAGPIE_TEST_UI
diff --git a/tests/test_services.py b/tests/test_services.py
index c121310ee..a9f97a9f8 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -1006,8 +1006,9 @@ def test_ServiceGeoserver_effective_permissions(self):
 
             []: Resource does not exist in Magpie, but position matches actual resource for the target service
             gc: GetCapabilities (shared by all OWS)
-            gf: GetFeature permission (WFS/WMS Layer)
-            gi: GetFeatureInfo permission (WFS/WMS Layer)
+            gf: GetFeature permission (WFS Layer)
+            gi: GetFeatureInfo permission (WMS Layer)
+            gm: GetMap (WMS Layer)
             dp: DescribeProcess permission (WPS Process)
             A: allow
             D: deny
@@ -1016,14 +1017,16 @@ def test_ServiceGeoserver_effective_permissions(self):
 
         Permissions Applied::
                                         user        group       effective (detail)
-            Service1                    (gc-A-R)                gc-A             (for each OWS)
-                Workspace1              (dp-A-R)    (gf-A-R)    dp-A, gf-A, gi-D (no match use on Workspace itself)
-                    Layer1                          (gi-A-R)    dp-D, gf-A, gi-A
-                    Layer2              (gf-D-M)                dp-D, gf-D, gi-A
-                    [Layer3]                                    dp-D, gf-A, gi-D (doesn't exist, only R apply)
+            Service1                    (gc-A-R)    (gm-D-R)    gc-A, gf-D, gi-D, gm-D
+                Workspace1              (dp-A-R)    (gf-A-R)    dp-A, gf-A, gi-D, gm-D (no match on Workspace itself)
+                    Layer1                          (gi-A-R)    dp-D, gf-A, gi-A, gm-D
+                    Layer2              (gf-D-M)    (gm-A-M)    dp-D, gf-D, gi-A, gm-A (match > recursive)
+                    Layer3              (gm-A-R)                dp-D, gf-A, gi-A, gm-A (effective user > group)
+                    [Layer4]                                    dp-D, gf-A, gi-D (doesn't exist, only R apply)
                     Process1                                    dp-A, gf-D, gi-D (gf/gi don't apply on Process)
-                    Process2                        (dp-D-M)    dp-D, gf-D, gi-D
-                    [Process3]                                  dp-A, gf-D, gi-D
+                    Process2            (dp-D-M)                dp-D, gf-D, gi-D
+                    Process3                        (dp-D-M)    dp-A, gf-D, gi-D (effective workspace user > group)
+                    [Process4]                                  dp-A, gf-D, gi-D
 
         .. note::
             Permissions that do not applied to a given sub-:term:`OWS` implementation are automatically denied.
@@ -1032,12 +1035,17 @@ def test_ServiceGeoserver_effective_permissions(self):
         svc_type = ServiceGeoserver.service_type
         svc1_name = "unittest-service-geoserver-1"
         w1_name = "workspace1"
+        wx_name = "fake-workspace"
         l1_name = "layer1"
         l2_name = "layer2"
+        l3_name = "layer3"
+        l4_name = "layer4"
         p1_name = "process1"
         p2_name = "process2"
         p3_name = "process3"
+        p4_name = "process4"
 
+        utils.TestSetup.delete_TestService(self, svc1_name)
         svc1_id, w1_id = utils.TestSetup.create_TestServiceResourceTree(
             self,
             override_service_name=svc1_name, override_service_type=svc_type,
@@ -1057,6 +1065,13 @@ def test_ServiceGeoserver_effective_permissions(self):
             override_resource_type=models.Layer.resource_type_name
         )
         l2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w1_id,
+            override_resource_name=l3_name,
+            override_resource_type=models.Layer.resource_type_name
+        )
+        l3_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
         info = utils.TestSetup.create_TestResource(
             self,
             parent_resource_id=w1_id,
@@ -1064,18 +1079,34 @@ def test_ServiceGeoserver_effective_permissions(self):
             override_resource_type=models.Process.resource_type_name
         )
         p2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w1_id,
+            override_resource_name=p3_name,
+            override_resource_type=models.Process.resource_type_name
+        )
+        p3_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
 
         # create permissions
         gcAR = PermissionSet(Permission.GET_CAPABILITIES, Access.ALLOW, Scope.RECURSIVE)    # noqa
         gfAR = PermissionSet(Permission.GET_FEATURE, Access.ALLOW, Scope.RECURSIVE)         # noqa
         gfDM = PermissionSet(Permission.GET_FEATURE, Access.DENY, Scope.MATCH)              # noqa
         giAR = PermissionSet(Permission.GET_FEATURE_INFO, Access.ALLOW, Scope.RECURSIVE)    # noqa
+        gmAM = PermissionSet(Permission.GET_MAP, Access.ALLOW, Scope.MATCH)                 # noqa
+        gmAR = PermissionSet(Permission.GET_MAP, Access.ALLOW, Scope.RECURSIVE)             # noqa
+        gmDR = PermissionSet(Permission.GET_MAP, Access.DENY, Scope.RECURSIVE)              # noqa
+        dpAR = PermissionSet(Permission.DESCRIBE_PROCESS, Access.ALLOW, Scope.RECURSIVE)    # noqa
         dpDM = PermissionSet(Permission.DESCRIBE_PROCESS, Access.DENY, Scope.MATCH)         # noqa
         utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=svc1_id, override_permission=gcAR)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=svc1_id, override_permission=gmDR)
         utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=w1_id, override_permission=gfAR)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=w1_id, override_permission=dpAR)
         utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l1_id, override_permission=giAR)
         utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l2_id, override_permission=gfDM)
-        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=p2_id, override_permission=dpDM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l2_id, override_permission=gmAM)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l3_id, override_permission=gmAR)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=p2_id, override_permission=dpDM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=p3_id, override_permission=dpDM)
 
         # login test user for which the permissions were set
         self.login_test_user()
@@ -1084,126 +1115,181 @@ def test_ServiceGeoserver_effective_permissions(self):
         svc_path = "/ows/proxy/{}".format(svc1_name)
 
         def _msg(_path, _params):
+            # type: (Str, Dict[Str, Str]) -> Str
             _qs = "&".join("{}={}".format(k, v) for k, v in _params.items())
             path_qs = "{}?{}".format(_path, _qs) if _qs else _path
             return "Using combination [{}, {}]".format("GET", path_qs)
 
+        def _scope(workspace, layer):
+            # type: (Str, Str) -> Str
+            return "{}:{}".format(workspace, layer)
+
+        def _test(_path, _params, allow):
+            # type: (Str, Dict[Str, Str], bool) -> None
+            req = self.mock_request(_path, method="GET", params=_params)
+            if allow:
+                utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(_path, _params))
+            else:
+                utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(_path, _params))
+
         # request for any OWS
         #   <HOST>/geoserver[/<WORKSPACE>]/<OWS>?request=GetCapabilities
         for path in [svc_path, "{}/{}".format(svc_path, w1_name)]:
             for ows in ["WFS", "WMS", "WPS"]:
                 ows_path = "{}/{}".format(path, ows.lower())
-                params = {"request": Permission.GET_CAPABILITIES.title}
-                req = self.mock_request(ows_path, method="GET", params=params)
-                utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(ows_path, params))
+                _test(ows_path, {"request": Permission.GET_CAPABILITIES.title}, allow=True)
 
-        # request that applies only to WMS
         # permission is valid on resource for both WFS and WMS, but they expect different parameter names
         #   <HOST>/geoserver[/<WORKSPACE>]/[wfs|wms]?request=GetFeatureInfo&version=<>&[typeNames|layers]=<LAYER>
-        for path in [svc_path, "{}/{}".format(svc_path, w1_name)]:
-            wfs_path = "{}/wfs".format(path)
-            wms_path = "{}/wms".format(path)
-            wps_path = "{}/wps".format(path)
-
-            # Layer1, valid requests
-            params = {"request": Permission.GET_FEATURE.title, "layers": l1_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "typeNames": l1_name}
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
-
-            # Layer1, mismatched OWS path/param
-            #   because GetFeature is applied recursively on Workspace,
-            #   access is granted even if request is erroneous to retrieve its appropriate Layer resource
-            #   OWS service would normally return a bad request, but Magpie/Twitcher job is over at that point
-            params = {"request": Permission.GET_FEATURE.title, "typeNames": l1_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "layers": l1_name}
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
-
-            # Layer1, valid requests
-            params = {"request": Permission.GET_FEATURE_INFO.title, "layers": l1_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
-            params = {"request": Permission.GET_FEATURE_INFO.title, "typeNames": l1_name}
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
-
-            # Layer1, mismatched OWS path/param
-            #   in this case, GetFeatureInfo permission is applied directly on Layer
-            #   invalid params makes retrieval of the Layer resource to fail, and therefore access is blocked
-            params = {"request": Permission.GET_FEATURE_INFO.title, "typeNames": l1_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
-            params = {"request": Permission.GET_FEATURE_INFO.title, "layers": l1_name}
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
-
-            # Layer2, valid requests and mismatched OWS/path
-            #   resource is always blocked because of explicit deny permission on it, whether resource is found or not
-            params = {"request": Permission.GET_FEATURE.title, "layers": l2_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "typeNames": l2_name}
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "typeNames": l2_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "layers": l2_name}
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
-
-            # Layer2, valid requests and mismatched OWS/path
-            #   resource allowed because of Workspace permission
-            #   mismatched OWS/path would fail on target service side, but not Magpie/Twitcher
-            params = {"request": Permission.GET_FEATURE_INFO.title, "layers": l2_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "typeNames": l2_name}
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "typeNames": l2_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wms_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "layers": l2_name}
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wfs_path, params))
-
-            # invalid permission not applicable to WFS/WMS
-            params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": l1_name}
-            req = self.mock_request(wms_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wms_path, params))
-            req = self.mock_request(wfs_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wfs_path, params))
-
-            # invalid permission not applicable to WPS
-            params = {"request": Permission.GET_FEATURE.title, "layers": l1_name}
-            req = self.mock_request(wps_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
-            params = {"request": Permission.GET_FEATURE.title, "typeNames": l1_name}
-            req = self.mock_request(wps_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
-            params = {"request": Permission.GET_FEATURE_INFO.title, "layers": l1_name}
-            req = self.mock_request(wps_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
-            params = {"request": Permission.GET_FEATURE_INFO.title, "typeNames": l1_name}
-            req = self.mock_request(wps_path, method="GET", params=params)
-            utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
-
-        # valid WPS requests (workspace only expected to work when in path)
-        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}
-        req = self.mock_request(wps_path, method="GET", params=params)
-        utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wps_path, params))
-        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p2_name}
-        req = self.mock_request(wps_path, method="GET", params=params)
-        utils.check_raises(lambda: self.ows.check_request(req), OWSAccessForbidden, msg=_msg(wps_path, params))
-        params = {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p3_name}
-        req = self.mock_request(wps_path, method="GET", params=params)
-        utils.check_no_raise(lambda: self.ows.check_request(req), msg=_msg(wps_path, params))
+        w1_wfs_path = "{}/{}/wfs".format(svc_path, w1_name)
+        w1_wms_path = "{}/{}/wms".format(svc_path, w1_name)
+        w1_wps_path = "{}/{}/wps".format(svc_path, w1_name)
+        wx_wfs_path = "{}/{}/wfs".format(svc_path, wx_name)
+        wx_wms_path = "{}/{}/wms".format(svc_path, wx_name)
+        svc_wfs_path = "{}/wfs".format(svc_path)
+        svc_wms_path = "{}/wms".format(svc_path)
+        svc_wps_path = "{}/wps".format(svc_path)
+        wx_l1 = _scope(wx_name, l1_name)
+        w1_l1 = _scope(w1_name, l1_name)
+        w1_l2 = _scope(w1_name, l2_name)
+        w1_l3 = _scope(w1_name, l3_name)
+        w1_l4 = _scope(w1_name, l4_name)
+        w1_p1 = _scope(w1_name, p1_name)
+        w1_p2 = _scope(w1_name, p2_name)
+        w1_p3 = _scope(w1_name, p3_name)
+        w1_p4 = _scope(w1_name, p4_name)
+
+        # Layer1, mismatching permission for WMS
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=False)
+
+        # Layer1, valid requests (WFS)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1}, allow=True)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1}, allow=True)
+
+        # Layer1, mismatched OWS path/param
+        #   - When <WORKSPACE> is not directly in the path, because query parameters to extract <WORKSPACE>:<LAYER>
+        #     mismatch the expected OWS service from the path, resolved requested resource is the service itself.
+        #     That service does not have the requested permissions (directly on it), so access is forbidden.
+        #   - When <WORKSPACE> is directly in the path, the requested resource can be resolved more precisely as the
+        #     Workspace instead of the top-level service. Because GetFeature is applied recursively on Workspace,
+        #     access is granted even if request is erroneous to retrieve its appropriate Layer resource. The OWS
+        #     would still normally respond with bad request since the wrong request parameter is provided for that
+        #     OWS. The request remains invalid even if accessible, but Magpie/Twitcher job is over at that point.
+        #   - When OWS is WMS, GetFeature does not apply. Therefore, access refused.
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=True)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_name}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, "layers": w1_name}, allow=True)
+
+        # Layer1, valid requests (WMS)
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l1}, allow=True)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l1}, allow=True)
+
+        # Layer1, mismatching permission for WFS
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l1}, allow=False)
+
+        # Layer1, missing workspace
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_name}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_name}, allow=False)
+
+        # Layer1, mismatched OWS path/param
+        #   in this case, GetFeatureInfo permission is applied directly on Layer
+        #   invalid params makes retrieval of the Layer resource to fail, and therefore access is blocked
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l1}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l1}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l1}, allow=False)
+
+        # Layer2, valid requests and mismatched OWS/path
+        #   - Resource is always blocked because of explicit deny permission on it when it is matched.
+        #   - When OWS service and request parameters mismatch, the parent workspace is resolved.
+        #     In that case, access can be granted because recursive Workspace permission is allowed.
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l2}, allow=False)
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l2}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l2}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l2}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l2}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l2}, allow=False)
+        # mismatch OWS params resolve using workspace permission
+        # WMS fails because of invalid permission, WFS 'succeeds' access because of valid permission.
+        # WFS should fail on the instance side because of missing 'typeNames' parameter though.
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l2}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l2}, allow=True)
+
+        # Layer2, valid requests and mismatched OWS/path
+        #   - Resource blocked when matched because no permission directly on the layer.
+        #   - When mismatched OWS/path, fail to get target layer, but still blocked because
+        #     Workspace also doesn't have that permission.
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l2}, allow=False)
+        _test(svc_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l2}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l2}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l2}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l2}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l2}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l2}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l2}, allow=False)
+
+        # invalid permission not applicable to WFS/WMS
+        _test(svc_wms_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_l1}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_l1}, allow=False)
+        _test(w1_wms_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_l1}, allow=False)
+
+        # mismatch workspace between path and scoped layer
+        # result is no workspace being matched, therefore permissions on them are not applied
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE.title, "layers": wx_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": wx_l1}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": wx_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": wx_l1}, allow=False)
+        _test(wx_wms_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=False)
+        _test(wx_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1}, allow=False)
+        _test(wx_wms_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l1}, allow=False)
+        _test(wx_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l1}, allow=False)
+
+        # invalid permission not applicable to WPS
+        _test(svc_wps_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=False)
+        _test(svc_wps_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1}, allow=False)
+        _test(svc_wps_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l1}, allow=False)
+        _test(svc_wps_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l1}, allow=False)
+        _test(w1_wps_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=False)
+        _test(w1_wps_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1}, allow=False)
+        _test(w1_wps_path, {"request": Permission.GET_FEATURE_INFO.title, "layers": w1_l1}, allow=False)
+        _test(w1_wps_path, {"request": Permission.GET_FEATURE_INFO.title, "typeNames": w1_l1}, allow=False)
+
+        # valid WPS requests
+        #   - Workspace only expected to work when in path because 'identifier' is not linked to workspace
+        #   - Process2 is explicitly denied, so access still blocked even when resource is properly resolved.
+        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}, allow=True)
+        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p2_name}, allow=False)
+        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p3_name}, allow=True)
+        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p4_name}, allow=True)
+        # other cases all invalid since workspace cannot be resolved
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p2_name}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p3_name}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_p1}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_p2}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_p3}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_p4}, allow=False)
+
+        # valid WMS requests
+        # validate that effective resolution considering user/group priority and recursive/match scope priority work
+        _test(svc_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l1}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l1}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l1_name}, allow=False)
+        _test(svc_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l2}, allow=True)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l2}, allow=True)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l2_name}, allow=True)
+        _test(svc_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l3}, allow=True)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l3}, allow=True)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l3_name}, allow=True)
+        _test(svc_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l4}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l4}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l4_name}, allow=False)
 
 
 @runner.MAGPIE_TEST_LOCAL

From 5d74a435c20247aa6d6664540b420b59582ba4c1 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Wed, 12 Jan 2022 11:24:00 -0500
Subject: [PATCH 21/34] fix tests

---
 .../api/management/service/service_views.py   | 13 +++++---
 tests/interfaces.py                           | 32 ++++++++++++++++---
 2 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/magpie/api/management/service/service_views.py b/magpie/api/management/service/service_views.py
index cbfbc852a..333189dce 100644
--- a/magpie/api/management/service/service_views.py
+++ b/magpie/api/management/service/service_views.py
@@ -20,13 +20,15 @@
 from magpie.api.management.service import service_utils as su
 from magpie.permissions import Permission, PermissionType, format_permissions
 from magpie.register import SERVICES_PHOENIX_ALLOWED, sync_services_phoenix
-from magpie.services import SERVICE_TYPE_DICT, invalidate_service
+from magpie.services import SERVICE_TYPE_DICT, invalidate_service, service_factory
 from magpie.utils import CONTENT_TYPE_JSON
 
 if TYPE_CHECKING:
-    from typing import List, Union
+    from typing import List, Optional, Union
 
-    from magpie.typedefs import JSON
+    from sqlalchemy.orm.session import Session
+
+    from magpie.typedefs import JSON, Str
 
 
 @s.ServiceTypesAPI.get(tags=[s.ServicesTag], response_schemas=s.ServiceTypes_GET_responses)
@@ -130,8 +132,10 @@ def update_service_view(request):
     """
     service = ar.get_service_matchdict_checked(request)
     service_push = asbool(ar.get_multiformat_body(request, "service_push", default=False))
+    service_impl = service_factory(service, request)
 
     def select_update(new_value, old_value):
+        # type: (Optional[Str], Optional[Str]) -> Optional[Str]
         return new_value if new_value is not None and not new_value == "" else old_value
 
     # None/Empty values are accepted in case of unspecified
@@ -149,7 +153,7 @@ def select_update(new_value, old_value):
                     param_name="service_name", http_error=HTTPForbidden,
                     msg_on_fail=s.Service_PATCH_ForbiddenResponseSchema_ReservedKeyword.description)
     ax.verify_param(svc_name == cur_svc_name and svc_url == service.url and
-                    (not has_svc_config or old_svc_config == new_svc_config),
+                    (not service_impl.configurable or not has_svc_config or old_svc_config == new_svc_config),
                     not_equal=True, param_compare=True, param_name="service_name/service_url",
                     http_error=HTTPBadRequest, msg_on_fail=s.Service_PATCH_BadRequestResponseSchema.description)
 
@@ -171,6 +175,7 @@ def select_update(new_value, old_value):
                         msg_on_fail=s.Service_PATCH_UnprocessableEntityResponseSchema.description)
 
     def update_service_magpie_and_phoenix(_svc, new_name, new_url, svc_push, db_session):
+        # type: (models.Service, Str, Str, bool, Session) -> None
         _svc.resource_name = new_name
         _svc.url = new_url
         has_getcap = Permission.GET_CAPABILITIES in SERVICE_TYPE_DICT[_svc.type].permissions
diff --git a/tests/interfaces.py b/tests/interfaces.py
index dffec64ae..2e3cc45b7 100644
--- a/tests/interfaces.py
+++ b/tests/interfaces.py
@@ -5326,7 +5326,8 @@ def test_PatchService_UpdateConfigOnly(self):
         apply_config_data = {"configuration": {"ignore_prefix": "something"}}
         modif_config_data = {"configuration": {"ignore_prefix": "other", "file_patterns": [".+\\.nc"]}}
         erase_config_data = {"configuration": None}
-        expected_fields = ["ignore_prefix", "skip_prefix", "file_patterns", "data_type", "metadata_type"]
+        default_expected_fields = ["skip_prefix", "file_patterns", "data_type", "metadata_type"]
+        custom_expected_fields = ["ignore_prefix"]
 
         resp = utils.test_request(self, self.update_method, path, data=apply_config_data,
                                   headers=self.json_headers, cookies=self.cookies)
@@ -5334,7 +5335,7 @@ def test_PatchService_UpdateConfigOnly(self):
         if TestVersion(self.version) <= TestVersion("3.20.0"):
             utils.check_val_equal(body["service"]["configuration"], apply_config_data["configuration"], diff=True)
         else:
-            for field in expected_fields:
+            for field in custom_expected_fields + default_expected_fields:
                 utils.check_val_is_in(field, body["service"]["configuration"])
             post_ignore_prefix = apply_config_data["configuration"]["ignore_prefix"]
             body_ignore_prefix = body["service"]["configuration"]["ignore_prefix"]  # type: ignore
@@ -5346,11 +5347,11 @@ def test_PatchService_UpdateConfigOnly(self):
         if TestVersion(self.version) <= TestVersion("3.20.0"):
             utils.check_val_equal(body["service"]["configuration"], modif_config_data["configuration"], diff=True)
         else:
-            for field in expected_fields:
+            for field in custom_expected_fields + default_expected_fields:
                 utils.check_val_is_in(field, body["service"]["configuration"])
             for field in modif_config_data["configuration"]:
                 post_field = modif_config_data["configuration"][field]
-                body_field = body["service"]["configuration"]["ignore_prefix"]  # type: ignore
+                body_field = body["service"]["configuration"][field]  # type: ignore
                 utils.check_val_equal(body_field, post_field)
 
         resp = utils.test_request(self, self.update_method, path, data=erase_config_data,
@@ -5360,8 +5361,10 @@ def test_PatchService_UpdateConfigOnly(self):
             utils.check_val_equal(body["service"]["configuration"], None, diff=True,
                                   msg="Erase should be allowed with explicit None (null) JSON configuration.")
         else:
-            for field in expected_fields:
+            for field in default_expected_fields:
                 utils.check_val_is_in(field, body["service"]["configuration"])
+            for field in custom_expected_fields:
+                utils.check_val_not_in(field, body["service"]["configuration"])
 
             class MockServiceResource(object):
                 configuration = None
@@ -5370,6 +5373,25 @@ class MockServiceResource(object):
             utils.check_val_equal(body["service"]["configuration"], default_thredds_config, diff=True,
                                   msg="JSON configuration following explicit None (null) erase should use default.")
 
+    @runner.MAGPIE_TEST_SERVICES
+    def test_PatchService_UpdateNonConfigurable(self):
+        """
+        Services defined as not configurable should fail update request with provided configuration.
+        """
+        utils.warn_version(self, "update service configuration on non-configurable implementation", "3.21", skip=True)
+
+        svc_name = "test-service-no-config"
+        svc_type = ServiceAPI.service_type
+        utils.TestSetup.delete_TestService(self, override_service_name=svc_name)
+        utils.TestSetup.create_TestService(self, override_service_name=svc_name, override_service_type=svc_type)
+
+        path = "/services/{}".format(svc_name)
+        for config in [None, {}, {"value": "test"}]:
+            data = {"configuration": config}
+            resp = utils.test_request(self, self.update_method, path, data=data, expect_errors=True,
+                                      headers=self.json_headers, cookies=self.cookies)
+            utils.check_response_basic_info(resp, 400, expected_method=self.update_method)
+
     @runner.MAGPIE_TEST_SERVICES
     def test_PatchService_ReservedKeyword_Types(self):
         """

From 9c298f5ebd923f910e8f6ee318b8a74b58f7c5ec Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Wed, 12 Jan 2022 12:30:25 -0500
Subject: [PATCH 22/34] update 'child_structure_allowed' property to employ
 dict-list resource mapping representation

---
 CHANGES.rst        |  12 ++---
 magpie/services.py | 120 ++++++++++++++++-----------------------------
 2 files changed, 47 insertions(+), 85 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 681ecb1e1..78e26b3e4 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -22,12 +22,12 @@ Features / Changes
 * Add support of ``Resource`` type ``Layer`` under ``ServiceWFS``.
 * Allow ``Resource`` and ``Service`` name to contain colon (``:``) character in order to define scoped names
   as it is often the case for ``Layer`` names.
-* Add ``child_structure_allowed`` attribute to ``Service`` implementations allowing them to define specific path-like
-  structures of allowed ``Resource`` types hierarchies in order to control at which level and which combinations
-  of nested ``Resource`` types are valid under their root ``Service``. When not defined under a ``Service``
-  implementation, any defined ``Resource`` type will remain available for creation at any level of the hierarchy,
-  unless the corresponding ``Resource`` in the tree already defined ``child_resource_allowed = False``. This was
-  already the original behaviour in previous versions.
+* Add ``child_structure_allowed`` attribute to ``Service`` implementations allowing them to define specific
+  structures of allowed ``Resource`` types hierarchies in order to control which combinations of nested ``Resource``
+  types are valid under their root ``Service``. When not defined under a ``Service`` implementation, any defined
+  ``Resource`` type will remain available for creation at any level of the hierarchy, unless the corresponding
+  ``Resource`` in the tree already defined ``child_resource_allowed = False``. This was already the original behaviour
+  in previous versions.
 * Add ``GET /resources/{id}/types`` endpoint that allows retrieval of applicable children ``Resource`` types under
   a given ``Resource`` considering the nested hierarchy definition of its root ``Service`` defined by the new
   attribute ``child_structure_allowed``.
diff --git a/magpie/services.py b/magpie/services.py
index b44d428bd..82cba9390 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -105,32 +105,27 @@ def service_type(self):
     Mapping of resource types to lists of permissions defining allowed children resource permissions under the service.
     """
 
-    child_structure_allowed = []  # type: List[Str]
+    child_structure_allowed = {}  # type: Dict[Type[ServiceOrResourceType], List[Type[models.Resource]]]
     """
-    Control listing of path-like resource types limiting the allowed structure of nested children resources.
+    Control mapping of resource types limiting the allowed structure of nested children resources.
 
     When not defined, any nested resource type combination is allowed if they themselves allow children resources.
     Otherwise, nested child resource under the service can only be created at specific positions within the hierarchy
-    that matches exactly one of the listed control path-like definition. All definitions must start with ``service``
-    and must contain at least one separator and a sub-resource to ensure working behaviour of child resource under
-    the service.
+    that matches exactly one of the defined control conditions.
 
     For example, the below definition allows only resources typed ``route`` directly under the service.
     The following nested resource under that first-level ``route`` can then be either another ``route`` followed
     by a child ``process`` or directly a ``process``. Because ``process`` type doesn't allow any children resource
     (see :attr:`models.Process.child_resource_allowed`), those are the only allowed combinations (cannot further nest
-    resources under the final ``process`` resource). Note that because intermediate ``route`` resources need to be
-    created at some point before the last ``process`` can even exist, partial paths (without ``process``) must also
-    be allowed as valid structures.
+    resources under the final ``process`` resource).
 
     .. code-block:: python
 
-        child_structure_allowed = [
-            "service/route",
-            "service/route/process",
-            "service/route/route",
-            "service/route/route/process",
-        ]
+        child_structure_allowed = {
+            models.Service: [models.Route],
+            models.Route: [models.Route, models.Process],
+            models.Process: [],
+        }
 
     .. seealso::
         - Validation of allowed nested children resource insertion of a given type under a parent resource is provided
@@ -398,22 +393,6 @@ def get_resource_permissions(cls, resource_type_name):
                 return cls.resource_types_permissions[res]
         return []
 
-    @classmethod
-    def get_resource_type_path(cls, resource, extra_path=None):
-        # type: (ServiceOrResourceType, Optional[Str]) -> Str
-        """
-        Generate the resource type path-like definition from the top service down to the specified resource.
-
-        :param resource: leaf resource for which to generate the resource type path.
-        :param extra_path: optional resource path to append after the generated path.
-        :return: path like representation of the resource types from service to leaf resource path.
-        """
-        session = get_db_session(obj=resource)
-        res_tree = reversed(list(models.RESOURCE_TREE_SERVICE.path_upper(resource.resource_id, db_session=session)))
-        res_extra_path = [] if extra_path is None else [extra_path]
-        res_types_path = "/".join([res.resource_type_name for res in res_tree] + res_extra_path)
-        return res_types_path
-
     @classmethod
     def validate_nested_resource_type(cls, parent_resource, child_resource_type):
         # type: (ServiceOrResourceType, Str) -> bool
@@ -424,18 +403,11 @@ def validate_nested_resource_type(cls, parent_resource, child_resource_type):
         :param child_resource_type: Type to validate at the position defined under the parent resource.
         :return: status indicating if insertion is allowed for this type and at this parent position.
         """
-        if not cls.child_resource_allowed:
+        child_resources = cls.nested_resource_allowed(parent_resource)
+        if not child_resources:
             return False
-        if not get_resource_child_allowed(parent_resource):
-            return False
-        # if undefined control structures, assume any combination of nested resource is allowed (original behaviour)
-        if not cls.child_structure_allowed:
-            return True
-        res_types_path = cls.get_resource_type_path(parent_resource, extra_path=child_resource_type)
-        for allow_types_path in cls.child_structure_allowed:
-            if allow_types_path == res_types_path:
-                return True
-        return False
+        child_allow_types = [res.resource_type_name for res in child_resources]
+        return child_resource_type in child_allow_types
 
     @classmethod
     def nested_resource_allowed(cls, parent_resource):
@@ -450,12 +422,10 @@ def nested_resource_allowed(cls, parent_resource):
         # if undefined control structures, any combination is allowed (original behaviour)
         if not cls.child_structure_allowed:
             return cls.resource_types
-        res_types_path = cls.get_resource_type_path(parent_resource, extra_path="")  # terminate as ".../"
-        res_types_next = [  # retain only paths that correspond to immediately the next resource type
-            path.replace(res_types_path, "", 1) for path in cls.child_structure_allowed
-            if path.startswith(res_types_path) and len(path.replace(res_types_path, "", 1).split("/")) == 1
-        ]
-        return [models.RESOURCE_TYPE_DICT[res_type] for res_type in res_types_next]
+        child_allow_types = [res.resource_type_name for res in cls.child_structure_allowed]
+        if parent_resource.resource_type_name not in child_allow_types:
+            return []
+        return cls.child_structure_allowed[type(parent_resource)]
 
     def allowed_permissions(self, resource):
         # type: (ServiceOrResourceType) -> List[Permission]
@@ -917,17 +887,11 @@ def params_expected(self):
         ]
 
     # only workspace directly followed by layers
-    child_structure_allowed = [
-        "{}/{}".format(
-            models.Service.resource_type_name,
-            models.Workspace.resource_type_name,
-        ),
-        "{}/{}/{}".format(
-            models.Service.resource_type_name,
-            models.Workspace.resource_type_name,
-            models.Layer.resource_type_name,
-        ),
-    ]
+    child_structure_allowed = {
+        models.Service: [models.Workspace],
+        models.Workspace: [models.Layer],
+        models.Layer: [],
+    }
 
     def resource_requested(self):
         # type: () -> ResourceRequested
@@ -1367,27 +1331,25 @@ class ServiceGeoserver(ServiceOWS):
 
     # only allow workspace directly under service
     # then, only layer or process under that workspace
-    child_structure_allowed = [
-        "{}/{}".format(
-            models.Service.resource_type_name,
-            models.Workspace.resource_type_name,
-        ),
-        "{}/{}/{}".format(
-            models.Service.resource_type_name,
-            models.Workspace.resource_type_name,
-            models.Layer.resource_type_name,
-        ),
-        # note:
-        #   In the context of Geoserver, WPS are applied on available resources (WFS, WMS, etc.)
-        #   For this reason, the Process also needs scoped Workspace access to work on them,
-        #   but the Workspace name MUST be in the path (identifier=<WORKSPACE>:<PROCESS_ID>) does not work.
-        #   Without the Workspace scope in the path, 'identifier' parameter resolves as if it was unspecified.
-        "{}/{}/{}".format(
-            models.Service.resource_type_name,
-            models.Workspace.resource_type_name,
-            models.Process.resource_type_name,
-        ),
-    ]
+
+    child_structure_allowed = {
+        models.Service: [models.Workspace],
+        models.Workspace: [models.Layer, models.Process],
+        models.Layer: [],
+        models.Process: [],
+    }
+    """
+    Allowed children resource structure for `Geoserver`.
+    
+    .. note::
+        In the context of `Geoserver`, `WPS` are applied on available resources (`WFS`, `WMS`, etc.).
+        For this reason, the :class:`models.Process` also needs to be scoped under :class:`models.Workspace` in order 
+        to grant access to those resources to work on them, but the :class:`models.Workspace` name **MUST** be in the 
+        path (i.e.: ``identifier=<WORKSPACE>:<PROCESS_ID>`` request parameter does not work).
+        Without the :class:`models.Workspace` scope in the path, ``identifier`` parameter fails to be resolved by 
+        `Geoserver`, as if it was unspecified. Attribute :attr:`ServiceGeoserverWPS.resource_scoped` controls the 
+        behaviour of splitting the defined :attr:`resource_param` into :class:`models.Workspace` and child components.
+    """
 
     configurable = True
 

From 49cf03d50922898a68d54a5f8554b31c0e5dd215 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Wed, 12 Jan 2022 13:39:54 -0500
Subject: [PATCH 23/34] fix lint

---
 magpie/services.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/magpie/services.py b/magpie/services.py
index 82cba9390..9258c73af 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -1340,14 +1340,14 @@ class ServiceGeoserver(ServiceOWS):
     }
     """
     Allowed children resource structure for `Geoserver`.
-    
+
     .. note::
         In the context of `Geoserver`, `WPS` are applied on available resources (`WFS`, `WMS`, etc.).
-        For this reason, the :class:`models.Process` also needs to be scoped under :class:`models.Workspace` in order 
-        to grant access to those resources to work on them, but the :class:`models.Workspace` name **MUST** be in the 
+        For this reason, the :class:`models.Process` also needs to be scoped under :class:`models.Workspace` in order
+        to grant access to those resources to work on them, but the :class:`models.Workspace` name **MUST** be in the
         path (i.e.: ``identifier=<WORKSPACE>:<PROCESS_ID>`` request parameter does not work).
-        Without the :class:`models.Workspace` scope in the path, ``identifier`` parameter fails to be resolved by 
-        `Geoserver`, as if it was unspecified. Attribute :attr:`ServiceGeoserverWPS.resource_scoped` controls the 
+        Without the :class:`models.Workspace` scope in the path, ``identifier`` parameter fails to be resolved by
+        `Geoserver`, as if it was unspecified. Attribute :attr:`ServiceGeoserverWPS.resource_scoped` controls the
         behaviour of splitting the defined :attr:`resource_param` into :class:`models.Workspace` and child components.
     """
 

From 7d51d3b38d5b2ee4092e968c9264e9670e0ee0ce Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Wed, 19 Jan 2022 14:10:57 -0500
Subject: [PATCH 24/34] fix formatting of service with child structured allowed
 definition

---
 magpie/api/management/service/service_formats.py |  7 +++++--
 magpie/services.py                               | 10 +++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/magpie/api/management/service/service_formats.py b/magpie/api/management/service/service_formats.py
index ab6c9af96..157a67230 100644
--- a/magpie/api/management/service/service_formats.py
+++ b/magpie/api/management/service/service_formats.py
@@ -75,7 +75,7 @@ def fmt_svc():
             svc_info["service{}url".format(sep)] = str(service.url)
         if basic_info:
             return svc_info
-        svc_type = SERVICE_TYPE_DICT[service.type]
+        svc_type = SERVICE_TYPE_DICT[service.type]  # type: Type[ServiceInterface]
         if show_configuration:
             # make sure to generate the default configuration if applicable
             if svc_type.configurable:
@@ -88,7 +88,10 @@ def fmt_svc():
         if show_resources_allowed:
             svc_info["resource_child_allowed"] = svc_type.child_resource_allowed
             svc_info["resource_types_allowed"] = sorted(svc_type.resource_type_names)
-            svc_info["resource_structure_allowed"] = sorted(svc_type.child_structure_allowed)
+            svc_info["resource_structure_allowed"] = {
+                res.resource_type_name: list(sorted(child_res.resource_type_name for child_res in children_res))
+                for res, children_res in svc_type.child_structure_allowed.items()
+            }
         return svc_info
 
     return evaluate_call(
diff --git a/magpie/services.py b/magpie/services.py
index 9258c73af..9e71b10cd 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -141,7 +141,15 @@ def service_type(self):
     """
 
     def __init__(self, service, request):
-        # type: (models.Service, Request) -> None
+        # type: (models.Service, Optional[Request]) -> None
+        """
+        Initialize the service.
+
+        :param service: Base service resource that must be handled by this service implementation.
+        :param request: Active request to handle requested resources, permissions and effective access.
+            The request can be omitted if basic service definition details are to be retrieved.
+            It is mandatory for any ``requested`` or ``effective`` component that should be resolved.
+        """
         self.service = service          # type: models.Service
         self.request = request          # type: Request
         self._flag_acl_cached = {}      # type: Dict[Tuple[Str, Str, Str, Optional[int]], bool]

From ba9a5664a0988df55a53882cfcf59ae9165cd4a4 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Wed, 19 Jan 2022 14:22:59 -0500
Subject: [PATCH 25/34] adjust changelog

---
 CHANGES.rst | 27 +++++++++++----------------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index db732e7ba..b445bd663 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -7,22 +7,6 @@ Changes
 `Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
 ------------------------------------------------------------------------------------
 
-* Nothing new for the moment.
-
-`3.20.1 <https://github.com/Ouranosinc/Magpie/tree/3.20.1>`_ (2022-01-19)
-------------------------------------------------------------------------------------
-
-Bug Fixes
-~~~~~~~~~~~~~~~~~~~~~
-* Fix `Twitcher` ``/verify`` endpoint integrated through ``MagpieAdapter`` to validate synchronized authentication
-  policies across both services. The endpoint now supports query parameter credentials to facilitate call directly
-  within a web browser (not assuming JSON contents) and properly parses cookies from both policies to report more
-  detailed error messages in case of failure.
-* Fix ``error`` and ``type`` representation when handling raised exception by ``evaluate_call`` utility function.
-
-`3.20.0 <https://github.com/Ouranosinc/Magpie/tree/3.20.0>`_ (2022-01-06)
-------------------------------------------------------------------------------------
-
 Features / Changes
 ~~~~~~~~~~~~~~~~~~~~~
 * Add missing ``ServiceWFS`` permissions according to `OGC WFS standard <https://www.ogc.org/standards/wfs>`_.
@@ -65,6 +49,17 @@ Bug Fixes
 * Fix `Effective Resolution` of ``Permission`` applied for ``ServiceGeoserverWMS`` to consider ``Scope`` modifier
   of ``Service`` and ``Workspace`` for access to be resolved at the ``Layer`` level.
 
+`3.20.1 <https://github.com/Ouranosinc/Magpie/tree/3.20.1>`_ (2022-01-19)
+------------------------------------------------------------------------------------
+
+Bug Fixes
+~~~~~~~~~~~~~~~~~~~~~
+* Fix `Twitcher` ``/verify`` endpoint integrated through ``MagpieAdapter`` to validate synchronized authentication
+  policies across both services. The endpoint now supports query parameter credentials to facilitate call directly
+  within a web browser (not assuming JSON contents) and properly parses cookies from both policies to report more
+  detailed error messages in case of failure.
+* Fix ``error`` and ``type`` representation when handling raised exception by ``evaluate_call`` utility function.
+
 `3.20.0 <https://github.com/Ouranosinc/Magpie/tree/3.20.0>`_ (2022-01-06)
 ------------------------------------------------------------------------------------
 

From 974b951681bca0a807d02d7a6864e90d17c8dea9 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Wed, 19 Jan 2022 19:26:55 -0500
Subject: [PATCH 26/34] add more tests to valiate service res-type strucutures
 + add them for API, THREDDS, Access + update res-type structure schema

---
 CHANGES.rst                                   |   3 +
 Makefile                                      |   2 +-
 .../api/management/service/service_formats.py |   8 +-
 magpie/api/schemas.py                         |  21 ++-
 magpie/services.py                            |  11 ++
 tests/interfaces.py                           | 158 +++++++++++++++++-
 6 files changed, 190 insertions(+), 13 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index b445bd663..1cb369b51 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -35,6 +35,9 @@ Features / Changes
 * Adjust UI to consider ``child_structure_allowed`` definitions to propose only applicable ``Resource`` types in the
   combobox when creating a new ``Resource`` in the tree hierarchy.
 * Add UI submission field to provide ``Service`` JSON configuration at creation when supported by the type.
+* Add ``child_structure_allowed`` to ``ServiceAPI`` and ``ServiceTHREDDS`` to be more explicit about allowed structure
+  hierarchies in API responses. Their original behaviour remains unchanged, but is further enforced during validation
+  of their children resource type creation against explicit structure.
 
 Bug Fixes
 ~~~~~~~~~~~~~~~~~~~~~
diff --git a/Makefile b/Makefile
index 6fce17e69..1420e2d09 100644
--- a/Makefile
+++ b/Makefile
@@ -696,7 +696,7 @@ test-remote-only:		## run only remote tests with the environment Python
 .PHONY: test-custom-only
 test-custom-only:		## run custom marker tests using SPEC="<marker-specification>"
 	@echo "Running custom tests..."
-	@[ "${SPEC}" ] || ( echo ">> 'TESTS' is not set"; exit 1 )
+	@[ "${SPEC}" ] || ( echo ">> 'SPEC' is not set"; exit 1 )
 	@bash -c '$(CONDA_CMD) pytest tests $(TEST_VERBOSITY) -m "${SPEC}" --junitxml "$(APP_ROOT)/tests/results.xml"'
 
 .PHONY: test-docker
diff --git a/magpie/api/management/service/service_formats.py b/magpie/api/management/service/service_formats.py
index 157a67230..a39c0e5e2 100644
--- a/magpie/api/management/service/service_formats.py
+++ b/magpie/api/management/service/service_formats.py
@@ -16,7 +16,7 @@
     from sqlalchemy.orm.session import Session
 
     from magpie.models import Resource, Service
-    from magpie.permissions import PermissionSet
+    from magpie.permissions import Permission, PermissionSet
     from magpie.services import ServiceInterface
     from magpie.typedefs import JSON, ResourcePermissionMap
 
@@ -59,13 +59,15 @@ def format_service(service,                         # type: Service
         :func:`magpie.api.management.resource.resource_formats.format_resource`
     """
     def fmt_svc():
+        # type: () -> JSON
         sep = "." if dotted else "_"
         svc_sync_type = str(service.sync_type) if service.sync_type is not None else service.sync_type
+        svc_type = SERVICE_TYPE_DICT[service.type]
         svc_info = {
             "service{}name".format(sep): str(service.resource_name),
             "service{}type".format(sep): str(service.type),
             "service{}sync_type".format(sep): svc_sync_type,
-            "service{}configurable".format(sep): SERVICE_TYPE_DICT[service.type].configurable,
+            "service{}configurable".format(sep): svc_type.configurable,
             "resource{}id".format(sep): service.resource_id,
         }
         if show_public_url:
@@ -75,7 +77,6 @@ def fmt_svc():
             svc_info["service{}url".format(sep)] = str(service.url)
         if basic_info:
             return svc_info
-        svc_type = SERVICE_TYPE_DICT[service.type]  # type: Type[ServiceInterface]
         if show_configuration:
             # make sure to generate the default configuration if applicable
             if svc_type.configurable:
@@ -130,6 +131,7 @@ def format_service_resources(service,                       # type: Service
     :return: JSON body representation of the service resource tree
     """
     def fmt_svc_res(svc, db, svc_perms, res_perms, show_all):
+        # type: (Service, Session, Optional[List[Permission]], Optional[List[Permission]], bool) -> JSON
         tree = get_resource_children(svc, db)
         if not show_all:
             filter_res_ids = list(res_perms) if res_perms else []
diff --git a/magpie/api/schemas.py b/magpie/api/schemas.py
index fc34a3225..285f0d93d 100644
--- a/magpie/api/schemas.py
+++ b/magpie/api/schemas.py
@@ -1669,11 +1669,24 @@ class ResourceTypesAllowed(colander.SequenceSchema):
     )
 
 
-class ResourceStructuresAllowed(colander.SequenceSchema):
-    description = "List of allowed combinations of resource type hierarchical structures under the service."
-    res_type_path = colander.SchemaNode(
+class ResourceTypeChildrenAllowed(colander.SequenceSchema):
+    title = "ResourceTypeChildrenAllowed"
+    res_type = colander.SchemaNode(
         colander.String(),
-        description="Path-like resource type structure allowed under the service."
+        description="Allowed child resource type."
+    )
+
+
+class ResourceStructuresAllowed(colander.MappingSchema):
+    description = (
+        "Mapping of allowed combinations of nested resource type structures under the service. "
+        "If undefined, the service does not impose any specific resource type hierarchy other "
+        "than whether individual resource types themselves allow children resources."
+    )
+    unknown = "preserve"
+    res_type = ResourceTypeChildrenAllowed(
+        name="{resource_type}",
+        description="List of children resource types in structure allowed under the parent resource type."
     )
 
 
diff --git a/magpie/services.py b/magpie/services.py
index 9e71b10cd..280d37be0 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -1030,6 +1030,11 @@ class ServiceAPI(ServiceInterface):
         models.Route: models.Route.permissions
     }
 
+    child_structure_allowed = {
+        models.Service: [models.Route],
+        models.Route: [models.Route],
+    }
+
     def resource_requested(self):
         # type: () -> ResourceRequested
         route_parts = self._get_request_path_parts()
@@ -1163,6 +1168,12 @@ class ServiceTHREDDS(ServiceInterface):
         models.File: permissions,
     }
 
+    child_structure_allowed = {
+        models.Service: [models.Directory, models.File],
+        models.Directory: [models.Directory, models.File],
+        models.File: [],
+    }
+
     configurable = True
 
     def get_config(self):
diff --git a/tests/interfaces.py b/tests/interfaces.py
index ab3918516..fef998518 100644
--- a/tests/interfaces.py
+++ b/tests/interfaces.py
@@ -20,7 +20,7 @@
 from magpie.api import schemas as s
 from magpie.api.webhooks import webhook_update_error_status
 from magpie.constants import MAGPIE_ROOT, get_constant
-from magpie.models import RESOURCE_TYPE_DICT, Directory, File, Route, UserStatuses
+from magpie.models import RESOURCE_TYPE_DICT, Directory, File, Layer, Process, Route, Service, UserStatuses, Workspace
 from magpie.permissions import (
     PERMISSION_REASON_DEFAULT,
     PERMISSION_REASON_MULTIPLE,
@@ -31,7 +31,14 @@
     Scope
 )
 from magpie.register import pseudo_random_string
-from magpie.services import SERVICE_TYPE_DICT, ServiceAccess, ServiceAPI, ServiceNCWMS2, ServiceTHREDDS
+from magpie.services import (
+    SERVICE_TYPE_DICT,
+    ServiceAccess,
+    ServiceAPI,
+    ServiceGeoserver,
+    ServiceNCWMS2,
+    ServiceTHREDDS
+)
 from magpie.utils import (
     CONTENT_TYPE_FORM,
     CONTENT_TYPE_HTML,
@@ -6070,6 +6077,17 @@ def test_GetResourceTypes_ServiceAccess(self):
         info = utils.TestSetup.get_ResourceInfo(self, override_body=body)
         svc_id = info["resource_id"]
 
+        path = "/services/{}".format(self.test_service_name)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        svc = body["service"]
+        utils.check_val_is_in("resource_child_allowed", svc)
+        utils.check_val_is_in("resource_types_allowed", svc)
+        utils.check_val_is_in("resource_structure_allowed", svc)
+        utils.check_val_equal(svc["resource_child_allowed"], False)
+        utils.check_val_equal(svc["resource_types_allowed"], [])
+        utils.check_val_equal(svc["resource_structure_allowed"], {})
+
         path = "/resources/{}/types".format(svc_id)
         resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
         body = utils.check_response_basic_info(resp)
@@ -6106,6 +6124,23 @@ def test_GetResourceTypes_ServiceAPI(self):
         info = utils.TestSetup.get_ResourceInfo(self, override_body=body)
         res2_id = info["resource_id"]
 
+        res_types_allowed = [Route.resource_type_name]
+        struct_allowed = {
+            "service": res_types_allowed,
+            Route.resource_type_name: res_types_allowed
+        }
+
+        path = "/services/{}".format(self.test_service_name)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        svc = body["service"]
+        utils.check_val_is_in("resource_child_allowed", svc)
+        utils.check_val_is_in("resource_types_allowed", svc)
+        utils.check_val_is_in("resource_structure_allowed", svc)
+        utils.check_val_equal(svc["resource_child_allowed"], True)
+        utils.check_val_equal(svc["resource_types_allowed"], res_types_allowed)
+        utils.check_val_equal(svc["resource_structure_allowed"], struct_allowed)
+
         path = "/resources/{}/types".format(svc_id)
         resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
         body = utils.check_response_basic_info(resp)
@@ -6118,7 +6153,7 @@ def test_GetResourceTypes_ServiceAPI(self):
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], self.test_service_name)
         utils.check_val_equal(body["resource_type"], "service")
-        utils.check_val_equal(body["children_resource_types"], [self.test_resource_type])  # only routes under service
+        utils.check_val_equal(body["children_resource_types"], res_types_allowed)  # only routes under service
         utils.check_val_equal(body["children_resource_allowed"], True)
         utils.check_val_equal(body["root_service_id"], svc_id)
         utils.check_val_equal(body["root_service_name"], self.test_service_name)
@@ -6136,7 +6171,7 @@ def test_GetResourceTypes_ServiceAPI(self):
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], res1_name)
         utils.check_val_equal(body["resource_type"], self.test_resource_type)
-        utils.check_val_equal(body["children_resource_types"], [self.test_resource_type])  # routes nested any depth
+        utils.check_val_equal(body["children_resource_types"], res_types_allowed)  # routes nested any depth
         utils.check_val_equal(body["children_resource_allowed"], True)
         utils.check_val_equal(body["root_service_id"], svc_id)
         utils.check_val_equal(body["root_service_name"], self.test_service_name)
@@ -6154,7 +6189,7 @@ def test_GetResourceTypes_ServiceAPI(self):
         utils.check_val_is_in("root_service_type", body)
         utils.check_val_equal(body["resource_name"], res2_name)
         utils.check_val_equal(body["resource_type"], self.test_resource_type)
-        utils.check_val_equal(body["children_resource_types"], [self.test_resource_type])  # routes nested any depth
+        utils.check_val_equal(body["children_resource_types"], res_types_allowed)  # routes nested any depth
         utils.check_val_equal(body["children_resource_allowed"], True)
         utils.check_val_equal(body["root_service_id"], svc_id)
         utils.check_val_equal(body["root_service_name"], self.test_service_name)
@@ -6186,6 +6221,22 @@ def test_GetResourceTypes_ServiceTHREDDS(self):
 
         # nested file/dirs always allowed at any level expect under File
         res_types_allowed = [Directory.resource_type_name, File.resource_type_name]
+        struct_allowed = {
+            "service": res_types_allowed,
+            Directory.resource_type_name: res_types_allowed,
+            File.resource_type_name: [],
+        }
+
+        path = "/services/{}".format(self.test_service_name)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        svc = body["service"]
+        utils.check_val_is_in("resource_child_allowed", svc)
+        utils.check_val_is_in("resource_types_allowed", svc)
+        utils.check_val_is_in("resource_structure_allowed", svc)
+        utils.check_val_equal(svc["resource_child_allowed"], True)
+        utils.check_val_equal(svc["resource_types_allowed"], res_types_allowed)
+        utils.check_val_equal(svc["resource_structure_allowed"], struct_allowed)
 
         path = "/resources/{}/types".format(svc_id)
         resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
@@ -6259,6 +6310,103 @@ def test_GetResourceTypes_ServiceTHREDDS(self):
         utils.check_val_equal(body["root_service_name"], self.test_service_name)
         utils.check_val_equal(body["root_service_type"], ServiceTHREDDS.service_type)
 
+    @runner.MAGPIE_TEST_RESOURCES
+    @runner.MAGPIE_TEST_SERVICES
+    def test_GetResourceTypes_ServiceGeoserver(self):
+        utils.warn_version(self, "validate allowed nested children resource types structure", "3.21.0", skip=True)
+        utils.warn_version(self, "multi-ows GeoServer service implementation", "3.21.0", skip=True)
+
+        utils.TestSetup.delete_TestService(self)
+        res_names = [
+            "workspace1",
+            "layer1",
+        ]
+        w1_name, l1_name = res_names
+        res_types = [
+            Workspace.resource_type_name,
+            Layer.resource_type_name,
+        ]
+        svc_id, w1_id, l1_id = utils.TestSetup.create_TestServiceResourceTree(
+            self,
+            override_service_type=ServiceGeoserver.service_type,
+            override_resource_names=res_names,
+            override_resource_types=res_types
+        )
+
+        # nested file/dirs always allowed at any level expect under File
+        res_types_allowed = [Layer.resource_type_name, Process.resource_type_name, Workspace.resource_type_name]
+        struct_allowed = {
+            Service.resource_type_name: [Workspace.resource_type_name],
+            Workspace.resource_type_name: [Layer.resource_type_name, Process.resource_type_name],
+            Layer.resource_type_name: [],
+            Process.resource_type_name: [],
+        }
+
+        path = "/services/{}".format(self.test_service_name)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        svc = body["service"]
+        utils.check_val_is_in("resource_child_allowed", svc)
+        utils.check_val_is_in("resource_types_allowed", svc)
+        utils.check_val_is_in("resource_structure_allowed", svc)
+        utils.check_val_equal(svc["resource_child_allowed"], True)
+        utils.check_val_equal(svc["resource_types_allowed"], res_types_allowed)
+        utils.check_val_equal(svc["resource_structure_allowed"], struct_allowed)
+
+        path = "/resources/{}/types".format(svc_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], self.test_service_name)
+        utils.check_val_equal(body["resource_type"], "service")
+        utils.check_val_equal(body["children_resource_types"], struct_allowed[Service.resource_type_name])
+        utils.check_val_equal(body["children_resource_allowed"], True)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], ServiceGeoserver.service_type)
+
+        path = "/resources/{}/types".format(w1_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], w1_name)
+        utils.check_val_equal(body["resource_type"], Workspace.resource_type_name)
+        utils.check_val_equal(body["children_resource_types"], struct_allowed[Workspace.resource_type_name])
+        utils.check_val_equal(body["children_resource_allowed"], True)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], ServiceGeoserver.service_type)
+
+        path = "/resources/{}/types".format(l1_id)
+        resp = utils.test_request(self, "GET", path, headers=self.json_headers, cookies=self.cookies)
+        body = utils.check_response_basic_info(resp)
+        utils.check_val_is_in("resource_name", body)
+        utils.check_val_is_in("resource_type", body)
+        utils.check_val_is_in("children_resource_types", body)
+        utils.check_val_is_in("children_resource_allowed", body)
+        utils.check_val_is_in("root_service_id", body)
+        utils.check_val_is_in("root_service_name", body)
+        utils.check_val_is_in("root_service_type", body)
+        utils.check_val_equal(body["resource_name"], l1_name)
+        utils.check_val_equal(body["resource_type"], Layer.resource_type_name)
+        utils.check_val_equal(body["children_resource_types"], [])
+        utils.check_val_equal(body["children_resource_allowed"], False)
+        utils.check_val_equal(body["root_service_id"], svc_id)
+        utils.check_val_equal(body["root_service_name"], self.test_service_name)
+        utils.check_val_equal(body["root_service_type"], ServiceGeoserver.service_type)
+
 
 @runner.MAGPIE_TEST_UI
 @six.add_metaclass(ABCMeta)

From f81e80de8fbf5cc210bba85634014a6056668563 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Mon, 24 Jan 2022 16:37:30 -0500
Subject: [PATCH 27/34] add support of multiple resources ACL resolution

---
 magpie/api/webhooks.py |   9 +-
 magpie/permissions.py  |  29 ++--
 magpie/services.py     | 299 ++++++++++++++++++++++++++++++-----------
 magpie/typedefs.py     |   3 +-
 4 files changed, 250 insertions(+), 90 deletions(-)

diff --git a/magpie/api/webhooks.py b/magpie/api/webhooks.py
index b9b57ac5b..7c1cdc0b0 100644
--- a/magpie/api/webhooks.py
+++ b/magpie/api/webhooks.py
@@ -3,6 +3,7 @@
 from typing import TYPE_CHECKING
 
 import requests
+import six
 import transaction
 from pyramid.httpexceptions import HTTPInternalServerError
 from six.moves.urllib.parse import urlparse
@@ -215,22 +216,22 @@ def replace_template(params, payload, force_str=False):
                 for key, value in payload.items()}
     if isinstance(payload, list):
         return [replace_template(params, value) for value in payload]
-    if isinstance(payload, str):  # template fields are always string since '{<param>}' must be provided
+    if isinstance(payload, six.string_types):  # template fields are always string since '{<param>}' must be provided
         for template_param in params:
             template_replace = "{{" + template_param + "}}"
             if template_param in WEBHOOK_TEMPLATE_PARAMS and template_replace in payload:
                 template_value = params[template_param]
                 # if result field is not a string and template is defined as is, allow value type replacement
-                if not force_str and not isinstance(template_value, str) and payload == template_replace:
+                if not force_str and not isinstance(template_value, six.string_types) and payload == template_replace:
                     return template_value
                 # otherwise, enforce convert to string to avoid failing string replacement,
                 # but remove any additional quotes that might be defined to enforce non-string to string conversion
                 template_single_string = "'" + template_replace + "'"
                 template_double_string = "\"" + template_replace + "\""
                 for template_str in [template_single_string, template_double_string]:
-                    if payload == template_str and not isinstance(template_value, str):
+                    if payload == template_str and not isinstance(template_value, six.string_types):
                         template_replace = template_str
-                payload = payload.replace(template_replace, str(template_value))
+                payload = payload.replace(template_replace, six.text_type(template_value))
         return payload
     # For any other type, no replacing to do
     return payload
diff --git a/magpie/permissions.py b/magpie/permissions.py
index ed24e0c5d..5346de003 100644
--- a/magpie/permissions.py
+++ b/magpie/permissions.py
@@ -326,18 +326,17 @@ def resolve(cls,
                 permission1,                        # type: ResolvablePermissionType
                 permission2,                        # type: ResolvablePermissionType
                 context=PermissionType.INHERITED,   # type: PermissionType
-                multiple_choice=None,               # type: Optional[ResolvablePermissionType]
+                multiple_choice=None,               # type: Optional[Str]
                 ):                                  # type: (...) -> ResolvablePermissionType
 
         """
         Resolves provided permissions into a single one considering various modifiers and groups for a resource.
 
         Permissions **MUST** have the same :term:`Permission` name.
-
-        By default (using :paramref:`same_resources`), the associated :term:`Resource` on which the two compared
-        permissions are applied on should also be the same (especially during local :term:`Inherited Permissions`
-        resolution). This safeguard must be disabled for :term:`Effective Permissions` that specifically handles
-        multi-level :term:`Resource` resolution.
+        The associated :term:`Resource` on which the two compared permissions are applied on should also be the same
+        This method **SHOULD NOT** be used by itself to obtain for :term:`Effective Permissions` since it does not
+        handle multi-level :term:`Resource` resolution. Resolution is accomplished in this case only for a given level
+        in the tree hierarchy.
 
         The comparison considers both the :class:`Access` and :class:`Scope` of :term:`Inherited Permissions` of the
         :term:`User`, as well as its :term:`Group` memberships sorted by their priority.
@@ -346,6 +345,16 @@ def resolve(cls,
             - :meth:`magpie.services.ServiceInterface.effective_permissions`
             - :func:`magpie.api.management.user.user_utils.combine_user_group_permissions`
             - :meth:`PermissionSet.__lt__`
+
+        :param permission1: Permission to compare.
+        :param permission2: Permission to compare.
+        :param context:
+            Control the resolution context (local/effective) of the permissions (safeguard against invalid definitions).
+        :param multiple_choice:
+            Alternate explanation to default :data:`PERMISSION_REASON_MULTIPLE` applied if multiple :term:`Permission`
+            refer to distinct :term:`Group` of equal priority and equivalent access definitions, meaning they are
+            interchangeable without impacting resolution to access the same target :term:`Resource`.
+        :returns: Permission with highest priority to resolve access a resource without considering scope.
         """
         if not isinstance(permission1, PermissionSet):
             permission1 = PermissionSet(permission1)
@@ -355,8 +364,10 @@ def resolve(cls,
         # they must also have the same permission name to actually resolving the one to preserve
         if permission1.name != permission2.name or not (permission1.perm_tuple and permission2.perm_tuple):
             raise ValueError("Invalid resolution attempt between two incomparable permissions.")
-        # when resolving (local inherited resolution), only one user permission on same resource is possible (by design)
-        # hierarchical/effective resolution of resources can differ
+        # when resolving (local inherited resolution),
+        #   - only one user permission on same resource is possible (by design)
+        #   - multiple group permissions can exist, but still must refer to same resource
+        # when processing hierarchical/effective resolution, resources can differ (parent/child resources)
         if context == PermissionType.INHERITED and (
                 (permission1.perm_tuple.resource is not permission2.perm_tuple.resource) or
                 (permission1.type == PermissionType.DIRECT and permission2.type == PermissionType.DIRECT)):
@@ -378,7 +389,7 @@ def resolve(cls,
         if permission1 == permission2:
             # if the two different groups have the exact same resolution value,
             # indicate that multiple groups resolve into the same access, unless a choice was provided
-            permission1.reason = multiple_choice.reason if multiple_choice else PERMISSION_REASON_MULTIPLE
+            permission1.reason = multiple_choice if multiple_choice else PERMISSION_REASON_MULTIPLE
             return permission1  # preserved group in perm-tuple doesn't matter as they are equivalent
         # otherwise return whichever group permission has higher resolution value
         return permission2 if permission1 < permission2 else permission1
diff --git a/magpie/services.py b/magpie/services.py
index 280d37be0..07eb30bb2 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -27,7 +27,7 @@
     PermissionType,
     Scope
 )
-from magpie.utils import get_logger
+from magpie.utils import fully_qualified_name, get_logger
 
 LOGGER = get_logger(__name__)
 if TYPE_CHECKING:
@@ -38,12 +38,13 @@
 
     from magpie.typedefs import (
         AccessControlListType,
+        MultiResourceRequested,
         PermissionRequested,
-        ResourceRequested,
         ResourceTypePermissions,
         ServiceConfiguration,
         ServiceOrResourceType,
-        Str
+        Str,
+        TargetResourceRequested
     )
 
 
@@ -182,7 +183,7 @@ def permission_requested(self):
 
     @abc.abstractmethod
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> MultiResourceRequested
         """
         Defines how to interpret the incoming request into the targeted :class:`model.Resource` for the given service.
 
@@ -190,13 +191,15 @@ def resource_requested(self):
 
         The expected return value must be either of the following::
 
-            - (target-resource, True)     when the exact resource is found
-            - (parent-resource, False)    when any parent of the resource is found
-            - None                        when invalid request or not found resource
+            - List<(target-resource, target?)>  When multiple resources need validation ('target?' as below for each).
+            - (target-resource, True)           when the exact resource is found according to request parsing.
+            - (parent-resource, False)          when any parent of the resource is found according to request parsing.
+            - None                              when invalid request or not found resource.
 
-        The `parent-resource` indicates the *closest* higher-level resource in the hierarchy that would nest the
-        otherwise desired `target-resource`. The idea behind this is that `Magpie` will be able to resolve the effective
-        recursive permission even if not all corresponding resources were explicitly defined in the database.
+        The ``parent-resource`` should indicate the *closest* higher-level resource in the hierarchy that would nest
+        the otherwise desired ``target-resource``. The idea behind this is that `Magpie` will be able to resolve the
+        effective recursive scoped permission even if not all corresponding resources were explicitly defined in the
+        database.
 
         For example, if the request *would* be interpreted with the following hierarchy after service-specific
         resolution::
@@ -205,15 +208,15 @@ def resource_requested(self):
                 Resource1         <== closest *existing* parent resource
                     [Resource2]   <== target (according to service/request resolution), but not existing in database
 
-        A permission defined as Allow/Recursive on ``Resource1`` should normally allow access to ``Resource2``. If
+        A permission defined as Allow/Recursive on ``Resource1`` should *normally* allow access to ``Resource2``. If
         ``Resource2`` is not present in the database though, it cannot be looked for, and the corresponding ACL cannot
         be generated. Because the (real) protected service using `Magpie` can have a large and dynamic hierarchy, it
-        is not convenient to enforce perpetual sync between it and its resource representation in `Magpie`. Using the
+        is not convenient to enforce perpetual sync between it and its resource representation in `Magpie`. Using
         ``(parent-resource, False)`` will allow resolution of permission from the closest available parent.
 
         .. note::
-            In case of `parent-resource` returned, only `recursive`-scoped permissions will be considered, since the
-            missing `target-resource` is the only one that should be checked for `match`-scoped permissions. For this
+            In case of ``parent-resource`` returned, only `recursive`-scoped permissions will be considered, since the
+            missing ``target-resource`` is the only one that should be checked for `match`-scoped permissions. For this
             reason, the service-specific implementation should preferably return the explicit `target` resource whenever
             possible.
 
@@ -221,7 +224,18 @@ def resource_requested(self):
         to indicate failure to retrieve the expected resource or that corresponding resource does not exist. Otherwise,
         this method implementation should convert any request path, query parameters, etc. into an existing resource.
 
-        :returns: tuple of reference resource (target/parent), and enabled status of match permissions (True/False)
+        If a list of ``(target-resource, target?)`` is returned, all of those resources should individually perform
+        :term:`Effective Resolution` and should **ALL** simultaneously be granted access to let the request through.
+        This can be used to resolve ambiguous or equivalent parameter combinations from parsing the request, or to
+        validate access to parameters that allow multi-resource references using some kind of list value representation.
+
+        .. seealso::
+            - :meth:`_get_acl` for :term:`Effective Resolution` of over multiple :term:`Resource` references.
+            - :meth:`effective_permissions` for :term:`Effective Resolution`  of a single :term:`Resource`.
+
+        :returns:
+            One or many tuple of reference resource (target/parent),
+            and explicit match status of the corresponding resource (True/False)
         """
         raise NotImplementedError
 
@@ -295,28 +309,67 @@ def _get_acl_cached(self, service_name, request_method, request_path, user_id):
         permissions = self.permission_requested()
         if permissions is None:
             return [DENY_ALL]
-        resource = self.resource_requested()
-        if not resource:
+
+        target_resources = self.resource_requested()
+        if not target_resources:
             return [DENY_ALL]
-        if not isinstance(resource, tuple):
-            is_target = False
-        else:
-            resource, is_target = resource
+        if not isinstance(target_resources, list):
+            if not isinstance(target_resources, tuple):
+                resource = target_resources
+                is_target = False
+            else:
+                resource, is_target = target_resources
+            target_resources = [(resource, is_target)]
+        if any(res[0] is None for res in target_resources):
+            return [DENY_ALL]
+
         if not isinstance(permissions, (list, set, tuple)):
             permissions = {permissions}
         user = self.user_requested()
-        return self._get_acl(user, resource, permissions, allow_match=is_target)
 
-    def _get_acl(self, user, resource, permissions, allow_match=True):
-        # type: (models.User, ServiceOrResourceType, Collection[Permission], bool) -> AccessControlListType
+        return self._get_acl(user, target_resources, permissions)
+
+    def _get_acl(self, user, resources, permissions):
+        # type: (models.User, MultiResourceRequested, Collection[Permission]) -> AccessControlListType
         """
-        Resolves the resource-tree and the user/group inherited permissions into a simplified ACL for this resource.
+        Resolves resource-tree and user/group inherited permissions into simplified :term:`ACL` of requested resources.
+
+        Contrary to :meth:`effective_permissions` that can be resolved only for individual :term:`Resource`, :term:`ACL`
+        is involved during actual request access, which could refer to multiple :term:`Resource` references or distinct
+        :term:`Permission` names if the identified parent :term:`Service` supports it.
+
+        When more than one item is specified for validation (any combination of :term:`Resource` or :term:`Permission`),
+        **ALL** of them must be granted access to resolve as :data:`Access.ALLOW`. Any denied access blocks the whole
+        set of requested elements.
 
         .. seealso::
-            - :meth:`effective_permissions`
+            - Core :term:`Permission` resolution rules of a single :term:`Resource` using :meth:`effective_permissions`.
+            - Support of multi-:term:`Resource` references defined by returned values of :meth:`resource_requested`
+              for individual :class:`ServiceInterface` implementations.
         """
-        permissions = self.effective_permissions(user, resource, permissions, allow_match)
-        return [perm.ace(self.request.user) for perm in permissions]
+        # avoid useless effective resolution re-computation if duplicates are found
+        target_resources = list(set(resources))
+        effective_perms = {}  # type: Dict[Permission, PermissionSet]
+        allowed_ace = []
+        for resource, allow_match in target_resources:
+
+            # only 1 entry per 'permission name' possible after effective resolution for that resource
+            res_access_perms = self.effective_permissions(user, resource, permissions, allow_match)
+            for perm in res_access_perms:
+                if perm.name not in effective_perms:
+                    effective_perms[perm.name] = perm
+                else:
+                    other_perm = effective_perms[perm.name]
+                    effect_perm = PermissionSet.resolve(perm, other_perm, context=PermissionType.EFFECTIVE)
+                    effective_perms[perm.name] = effect_perm
+
+                # if any resource or any permission indicates deny, break out to avoid useless computation
+                cur_perm = effective_perms[perm.name]
+                if cur_perm.access == Access.DENY:
+                    return [cur_perm.ace(self.request.user)]
+
+            allowed_ace.extend([perm.ace(self.request.user) for perm in effective_perms.values()])
+        return allowed_ace
 
     def _get_connected_object(self, obj):
         # type: (Union[ServiceOrResourceType, models.User]) -> Optional[ServiceOrResourceType]
@@ -447,7 +500,7 @@ def allowed_permissions(self, resource):
     def effective_permissions(self, user, resource, permissions=None, allow_match=True):
         # type: (models.User, ServiceOrResourceType, Optional[Collection[Permission]], bool) -> List[PermissionSet]
         """
-        Obtains the effective permissions the user has over the specified resource.
+        Obtains the :term:`Effective Resolution` of permissions the user has over the specified resource.
 
         Recursively rewinds the resource tree from the specified resource up to the top-most parent service the resource
         resides under (or directly if the resource is the service) and retrieve permissions along the way that should be
@@ -663,6 +716,7 @@ def service_base(self):
 
     @abc.abstractmethod
     def resource_requested(self):
+        # type: () -> MultiResourceRequested
         raise NotImplementedError
 
     def permission_requested(self):
@@ -857,21 +911,49 @@ class ServiceGeoserverBase(ServiceOWS):
     def resource_scoped(self):
         # type: () -> bool
         """
-        Indicates if the resource is allowed to employ scoped workspace naming.
+        Indicates if the service is allowed to employ scoped :class:`models.Workspace` naming.
 
         When allowed, the :class:`models.Workspace` can be inferred from the request parameter
         defined by :attr:`resource_param` to retrieve scoped name as ``<WORKSPACE>:<RESOURCE>``.
-        When not allowed, the resource name is left untouched can will not attempt to infer
-        any :class:`models.Workspace` from it.
+        When not allowed, the resource name is left untouched `Magpie` will not attempt to infer
+        any :class:`models.Workspace` from it. The :class:`models.Workspace` can only be specified
+        in the request path for isolated :term:`Resource` references.
+        """
+        raise NotImplementedError
+
+    @property
+    @abc.abstractmethod
+    def resource_multi(self):
+        # type: () -> bool
+        """
+        Indicates if the service supports multiple simultaneous :term:`Resource` references.
+
+        When supported, the value retrieved from :attr:`resource_param` can be comma-separated to represent
+        multiple :term:`Resource` of the same nature, which can all be retrieved with the same request.
+        Otherwise, single value only is considered by default.
+
+        .. note::
+            Permission modifier :data:`Access.ALLOW` will have to be resolved for all those :term:`Resource`
+            references for the request to be granted access.
         """
         raise NotImplementedError
 
     @property
     @abc.abstractmethod
     def resource_param(self):
-        # type: () -> Str
+        # type: () -> Union[Str, List[Str]]
         """
-        Name of the request query parameter to access requested leaf children resource.
+        Name of the request query parameter(s) to access requested leaf children resource.
+
+        If a single string is defined, the parameter must be equal to this value (case insensitive).
+        When using a list, any specified name combination will be resolved as the same parameter.
+
+        .. note::
+            The resulting parameter(s) are automatically added to :meth:`params_expected` to ensure they are always
+            retrieved in the :attr:`parser` from the request query parameters.
+
+        .. seealso::
+            :meth:`resource_param_requested` to obtain the resolved parameter considering any applicable combination.
         """
         raise NotImplementedError
 
@@ -887,22 +969,49 @@ def resource_types_permissions(self):
     @property
     def params_expected(self):
         # type: () -> List[Str]
-        return [
+        """
+        Specify typical `Geoserver` request query parameters expected for any sub-service implementation.
+
+        The :attr:`resource_param` is also added to ensure it is always parsed based on the derived implementation.
+        """
+        if isinstance(self.resource_param, six.string_types):
+            impl_params = [self.resource_param]
+        elif isinstance(self.resource_param, list):
+            impl_params = self.resource_param
+        else:
+            name = fully_qualified_name(self)
+            raise NotImplementedError(f"Missing or invalid definition of 'resource_param' in service: {name}")
+        base_params = [
             "request",
             "service",
             "version",
-            self.resource_param,
         ]
+        return base_params + impl_params
 
-    # only workspace directly followed by layers
-    child_structure_allowed = {
-        models.Service: [models.Workspace],
-        models.Workspace: [models.Layer],
-        models.Layer: [],
-    }
+    def resource_param_requested(self):
+        # type: () -> List[Str]
+        """
+        Obtain the resolved value(s) of the resource query parameter from :term:`OWS` parser applied onto the request.
+        """
+        if isinstance(self.resource_param, six.string_types):
+            value = self.parser.params[self.resource_param]
+            if self.resource_multi and isinstance(value, six.string_types):
+                return value.split(",")
+            return [value]
+        if isinstance(self.resource_param, list):
+            values = []
+            for param in self.resource_param:
+                value = self.parser.params[param]
+                if self.resource_multi and isinstance(value, six.string_types):
+                    values.extend(value.split(","))
+                else:
+                    values.append(value)
+            return values
+        name = fully_qualified_name(self)
+        raise NotImplementedError(f"Missing or invalid requested 'resource_param' in service: {name}")
 
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> MultiResourceRequested
         """
         Parse the requested resource down to the applicable :class:`models.Workspace`.
 
@@ -921,7 +1030,6 @@ def resource_requested(self):
             path_parts = path_parts[1:]
             parts_lower = parts_lower[1:]
         workspace_name = None
-        res_name = None
         if len(parts_lower) > 1 and parts_lower[1] == self.service_base:
             workspace_name = path_parts[0]
         if permission == Permission.GET_CAPABILITIES:
@@ -934,38 +1042,53 @@ def resource_requested(self):
                 (len(parts_lower) == 1 and parts_lower[0] == self.service_base)
             ):
                 return self.service, True
-        else:
-            # following requests lead to the same resolution, need to check the workspace in the layer
-            #   /geoserver/<WORKSPACE>/<OWS>?<RESOURCE_PARAM>=[<WORKSPACE>:]<LAYER_NAME>&request=<PERMISSION>
-            #   /geoserver/<OWS>?<RESOURCE_PARAM>=<WORKSPACE>:<LAYER_NAME>&request=<PERMISSION>
-            res_name = self.parser.params[self.resource_param] or ""
+            return self.service, False
+
+        # following requests lead to the same resolution, need to check the workspace in the layer
+        #   /geoserver/<WORKSPACE>/<OWS>?<RESOURCE_PARAM>=[<WORKSPACE>:]<LAYER_NAME>&request=<PERMISSION>
+        #   /geoserver/<OWS>?<RESOURCE_PARAM>=<WORKSPACE>:<LAYER_NAME>&request=<PERMISSION>
+        matched_resources = []
+        session = get_connected_session(self.request)
+        for res_name in self.resource_param_requested():
+            workspace_isolated = None  # reset for next layer
+
             # if missing, consider layer name as not scoped under workspace
             if self.resource_scoped and ":" in res_name:
                 workspace_scope, res_name = res_name.rsplit(":", 1)
                 if not workspace_name:
-                    workspace_name = workspace_scope
+                    # workspace only in scoped layer parameter
+                    workspace_isolated = workspace_scope
                 elif workspace_name != workspace_scope:
                     # In case the request was formed with both workspace in path and scoped layer name,
                     # consider the workspace as not resolved since we cannot know which one to target.
                     # This avoids erroneously granting access to restricted layer from another workspace by
                     # forging a request that would include some workspace for which the user does have access.
-                    workspace_name = None
-        if not workspace_name:
-            return self.service, False
-        session = get_connected_session(self.request)
-        workspace = models.find_children_by_name(child_name=workspace_name,
-                                                 parent_id=self.service.resource_id,
-                                                 db_session=session)
-        if workspace:
-            if not res_name:
-                return workspace, False
-            resource = models.find_children_by_name(child_name=res_name,
-                                                    parent_id=workspace.resource_id,
-                                                    db_session=session)
-            if resource:
-                return resource, True
-            return workspace, False
-        return self.service, False
+                    workspace_isolated = None
+                else:
+                    # workspace only in path, layer not scoped
+                    workspace_isolated = workspace_name
+
+            if not workspace_isolated:
+                matched_resources.append((self.service, False))
+                continue
+            workspace = models.find_children_by_name(child_name=workspace_isolated,
+                                                     parent_id=self.service.resource_id,
+                                                     db_session=session)
+            if workspace:
+                if not res_name:
+                    matched_resources.append((workspace, False))
+                    continue
+                resource = models.find_children_by_name(child_name=res_name,
+                                                        parent_id=workspace.resource_id,
+                                                        db_session=session)
+                if resource:
+                    matched_resources.append((resource, True))
+                else:
+                    matched_resources.append((workspace, False))
+                continue
+            matched_resources.append((self.service, False))
+
+        return matched_resources
 
 
 class ServiceGeoserverWMS(ServiceBaseWMS, ServiceGeoserverBase):
@@ -979,6 +1102,7 @@ class ServiceGeoserverWMS(ServiceBaseWMS, ServiceGeoserverBase):
     service_type = "geoserverwms"
 
     resource_scoped = True
+    resource_multi = True  # can stack layers on map
     resource_param = "layers"
 
     permissions = [
@@ -992,13 +1116,20 @@ class ServiceGeoserverWMS(ServiceBaseWMS, ServiceGeoserverBase):
         # Permission.EXCEPTIONS,
     ]
 
+    # only workspace directly followed by layers
+    child_structure_allowed = {
+        models.Service: [models.Workspace],
+        models.Workspace: [models.Layer],
+        models.Layer: [],
+    }
+
     resource_types_permissions = {
         models.Workspace: permissions,
         models.Layer: permissions,
     }
 
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> MultiResourceRequested
         return ServiceGeoserverBase.resource_requested(self)
 
 
@@ -1010,7 +1141,7 @@ class ServiceAccess(ServiceInterface):
     resource_types_permissions = {}
 
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> TargetResourceRequested
         return self.service, True
 
     def permission_requested(self):
@@ -1036,7 +1167,7 @@ class ServiceAPI(ServiceInterface):
     }
 
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> TargetResourceRequested
         route_parts = self._get_request_path_parts()
         if not route_parts:
             return self.service, True
@@ -1100,7 +1231,7 @@ class ServiceWFS(ServiceOWS):
     }
 
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> TargetResourceRequested
         if not self.parser.params["typenames"]:
             return self.service, False
         names = self.parser.params["typenames"]  # can be comma-separated or single layer
@@ -1132,7 +1263,8 @@ class ServiceGeoserverWFS(ServiceWFS, ServiceGeoserverBase):
     service_type = "geoserverwfs"
 
     resource_scoped = True
-    resource_param = "typenames"
+    resource_multi = True
+    resource_param = ["typenames", "typename"]  # replacement between WPS 1.x/2.x often handled as synonyms
 
     permissions = ServiceWFS.permissions + [
         # v1.1.0 only
@@ -1146,8 +1278,15 @@ class ServiceGeoserverWFS(ServiceWFS, ServiceGeoserverBase):
         models.Layer: permissions,
     }
 
+    # only workspace directly followed by layers
+    child_structure_allowed = {
+        models.Service: [models.Workspace],
+        models.Workspace: [models.Layer],
+        models.Layer: [],
+    }
+
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> MultiResourceRequested
         return ServiceGeoserverBase.resource_requested(self)
 
 
@@ -1216,7 +1355,7 @@ def is_match(value, pattern):
             return None
 
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> TargetResourceRequested
         path_parts = self.get_path_parts()
 
         # handle optional prefix as targeting the service directly
@@ -1277,6 +1416,7 @@ class ServiceGeoserverWPS(ServiceWPS, ServiceGeoserverBase):
     service_type = "geoserverwps"
 
     resource_scoped = False  # name in 'identifier' must not be split and does not match WORKSPACE
+    resource_multi = True  # possible to describe multiple processes at the same time
     resource_param = "identifier"
 
     resource_types_permissions = {
@@ -1284,8 +1424,15 @@ class ServiceGeoserverWPS(ServiceWPS, ServiceGeoserverBase):
         models.Process: models.Process.permissions,
     }
 
+    # only workspace directly followed by layers
+    child_structure_allowed = {
+        models.Service: [models.Workspace],
+        models.Workspace: [models.Process],
+        models.Layer: [],
+    }
+
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> MultiResourceRequested
         return ServiceGeoserverBase.resource_requested(self)
 
 
@@ -1412,7 +1559,7 @@ def service_requested(self):
         return type(self).service_map[svc]
 
     def resource_requested(self):
-        # type: () -> ResourceRequested
+        # type: () -> MultiResourceRequested
         svc = self.service_requested()
         if not svc:
             return None
diff --git a/magpie/typedefs.py b/magpie/typedefs.py
index 2a8b67ceb..2257ffe53 100644
--- a/magpie/typedefs.py
+++ b/magpie/typedefs.py
@@ -87,7 +87,8 @@
     AccessControlEntryType = Union[Tuple[Str, Str, Str], Str]
     AccessControlListType = List[AccessControlEntryType]
 
-    ResourceRequested = Optional[Tuple[ServiceOrResourceType, bool]]
+    TargetResourceRequested = Tuple[ServiceOrResourceType, bool]
+    MultiResourceRequested = Union[None, TargetResourceRequested, List[TargetResourceRequested]]
     PermissionRequested = Optional[Union[Permission, Collection[Permission]]]
     ResourceTypePermissions = Dict[Type[models.Resource], List[Permission]]
 

From d21003654926928ff059fc82b287b4bf4581e67a Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Mon, 24 Jan 2022 23:50:51 -0500
Subject: [PATCH 28/34] update docs

---
 CHANGES.rst                                   |  4 +
 docs/_static/custom.css                       | 14 +++
 docs/authentication.rst                       | 61 ++++++------
 docs/glossary.rst                             | 17 +++-
 docs/permissions.rst                          | 98 ++++++++++++-------
 docs/services.rst                             |  6 +-
 .../management/resource/resource_formats.py   |  5 +-
 .../api/management/service/service_formats.py |  6 +-
 magpie/api/management/user/user_utils.py      | 29 +++---
 magpie/permissions.py                         |  6 +-
 magpie/services.py                            |  5 +-
 magpie/ui/management/views.py                 |  2 +-
 tests/interfaces.py                           |  3 +-
 tests/test_services.py                        | 14 +--
 14 files changed, 167 insertions(+), 103 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 1cb369b51..0893e0c62 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -38,6 +38,10 @@ Features / Changes
 * Add ``child_structure_allowed`` to ``ServiceAPI`` and ``ServiceTHREDDS`` to be more explicit about allowed structure
   hierarchies in API responses. Their original behaviour remains unchanged, but is further enforced during validation
   of their children resource type creation against explicit structure.
+* Add multiple ``Resource`` ACL resolution within the same request to support ``Service`` implementations that can refer
+  to multiple items simultaneously. An example of this is the comma-separated list of ``Layer`` defined by ``typeNames``
+  of new ``ServiceGeoserverWMS`` implementation. Access is granted if the ``User`` has access to **ALL** ``Resource``
+  resolved from parsing the request.
 
 Bug Fixes
 ~~~~~~~~~~~~~~~~~~~~~
diff --git a/docs/_static/custom.css b/docs/_static/custom.css
index c55de2d0b..c9ace4109 100644
--- a/docs/_static/custom.css
+++ b/docs/_static/custom.css
@@ -52,3 +52,17 @@ div.bordered-content {
     border: 1px solid #C6C9CB;
     padding: 0 1em 1em 0;
 }
+
+/* apply the parent list number prefixed to the current list numbers
+    https://stackoverflow.com/a/13841818
+*/
+div.parent-list-numbers > ol {
+    counter-reset: item;
+}
+div.parent-list-numbers > li {
+    display: block;
+}
+div.parent-list-numbers > li:before {
+    content: counters(item, ".") " ";
+    counter-increment: item
+}
diff --git a/docs/authentication.rst b/docs/authentication.rst
index 316a15875..da434e25c 100644
--- a/docs/authentication.rst
+++ b/docs/authentication.rst
@@ -62,9 +62,10 @@ Query Parameters
 
 This method employs the query string parameters in the URL to provide the credentials. The format is as follows.
 
-.. code-block::
+.. code-block:: http
 
-    GET {MAGPIE_URL}/signin?user_name=<usr>&password=<pwd>
+    GET /signin?user_name=<usr>&password=<pwd> HTTP/1.1
+    Host: {MAGPIE_URL}
 
 
 The response will contain :ref:`Authentication Headers` detail needed for user identification.
@@ -89,37 +90,39 @@ Body content requests allow multiple variants, based on the specified ``Content-
 All variants employ a similar structure, but indicate the format of the body to be parsed.
 By default, ``application/json`` is employed if none was specified.
 
-.. code-block::
+.. code-block:: http
 
-    POST {MAGPIE_URL}/signin
-    Headers
-        Content-Type: multipart/form-data; boundary=<boundary-string>
-    Body
-        user_name: "<usr>"
-        password: "<pwd>"
-        provider_name: "<provider>"     # optional
+    POST /signin HTTP/1.1
+    Host: {MAGPIE_URL}
+    Content-Type: multipart/form-data; boundary=<boundary-string>
 
+    --<boundary-string>
+    user_name: "<usr>"
+    password: "<pwd>"
+    provider_name: "<provider>"     # optional
+    --<boundary-string>--
 
-.. code-block::
 
-    POST {MAGPIE_URL}/signin
-    Headers
-        Content-Type: application/x-www-form-urlencoded
-    Body
-        user_name=<usr>&password=<pwd>&provider_name=<provider>
+.. code-block:: http
 
+    POST /signin HTTP/1.1
+    Host: {MAGPIE_URL}
+    Content-Type: application/x-www-form-urlencoded
 
-.. code-block::
+    user_name=<usr>&password=<pwd>&provider_name=<provider>
 
-    POST {MAGPIE_URL}/signin
-    Headers
-        Content-Type: application/json
-    Body
-        {
-            "user_name": "<usr>",
-            "password": "<pwd>",
-            "provider_name": "<provider>"
-        }
+
+.. code-block::  http
+
+    POST /signin HTTP/1.1
+    Host: {MAGPIE_URL}
+    Content-Type: application/json
+
+    {
+        "user_name": "<usr>",
+        "password": "<pwd>",
+        "provider_name": "<provider>"
+    }
 
 
 The response will contain :ref:`Authentication Headers` detail needed for user identification.
@@ -196,7 +199,7 @@ Authentication Headers
 After execution of an :term:`Authentication` request, a ``Set-Cookie`` header with `Magpie` user identification token
 named according to :ref:`config_security` should be set in the response as follows.
 
-.. code-block::
+.. code-block:: http
 
     Set-Cookie: {MAGPIE_COOKIE_NAME}=<auth-token>!userid_type:int;
                 [Domain=<domain>; Path=<path>; HttpOnly; SameSite=Lax; Max-Age=<seconds>; expires=<datetime>]
@@ -239,7 +242,7 @@ Authorization Headers
 Following any successful :term:`Authentication` request as presented in the previous section, the obtained ``Cookie``
 defines which :term:`Logged User` attempts to accomplish an operation against a given protected URI. `Magpie` employs
 the same ``Cookie`` both for operations provided by its API and for accessing the real :term:`Resource` protected
-behind the :term:`Proxy` according to resolution of :term:`Effective Permissions` based on :term:`Applied Permissions`
+behind the :term:`Proxy` according to resolution of :term:`Effective Permissions` based on :term:`Applied Permission`
 definitions.
 
 Access to Magpie Operations
@@ -276,7 +279,7 @@ employed instead to process :term:`Authentication` only once.
 
 The format of the ``Authorization`` header is has follows.
 
-.. code-block::
+.. code-block:: http
 
     Authorization: Bearer <access_token>
 
diff --git a/docs/glossary.rst b/docs/glossary.rst
index bf255f99d..28dc4613e 100644
--- a/docs/glossary.rst
+++ b/docs/glossary.rst
@@ -27,13 +27,13 @@ Glossary
         grants or denies :term:`Permission` access to the applicable :term:`User` for the targeted :term:`Resource`.
         Formed of multiple :term:`ACE`.
 
-    Allowed Permissions
+    Allowed Permission
         Set of applicable :term:`Permission` values onto an element.
 
         .. seealso::
             :ref:`Allowed Permissions <allowed-permissions>` section for details.
 
-    Applied Permissions
+    Applied Permission
         An active :term:`Permission` for a given :term:`User` or :term:`Group` depending on context.
 
         .. seealso::
@@ -75,13 +75,20 @@ Glossary
         :term:`Group` that has property ``discoverable=True``, making it publicly viewable to any-level user.
         Otherwise, groups can be listed or accessed only by administrators.
 
-    Effective Permissions
+    Effective Permission
         A :term:`Permission` that has been completely resolved according to all applicable contexts, that indicates
         the final granted or denied result.
 
         .. seealso::
             :ref:`Effective Permissions <effective_permissions>` section for details.
 
+    Effective Resolution
+        Process of resolving :term:`Effective Permission` over a :term:`Resource` considering any applicable
+        :ref:`permission_modifiers`.
+
+        .. seealso::
+            :ref:`perm_resolution` section for details.
+
     External Providers
         Set of all known user-identity :term:`Provider` defined externally to `Magpie`. Each of these :term:`Provider`
         require specific connection methodologies, as configured in :mod:`magpie.security`.
@@ -97,14 +104,14 @@ Glossary
         request to ask for confirmation. The terms and conditions can only be defined upon the :term:`Group` creation
         and can never be modified afterwards.
 
-    Immediate Permissions
+    Immediate Permission
         Describes a :term:`Permission` that originates directly and only from a :term:`Service`.
         This is referenced in only a few use-cases, notably for :ref:`Finding User Permissions`.
 
         .. seealso::
             :ref:`Immediate Permissions <immediate_permissions>` section for details.
 
-    Inherited Permissions
+    Inherited Permission
         Describes a :term:`Permission` that includes both :term:`User` and :term:`Group` contexts simultaneously.
 
         .. seealso::
diff --git a/docs/permissions.rst b/docs/permissions.rst
index ab81c4e3c..7d973b69c 100644
--- a/docs/permissions.rst
+++ b/docs/permissions.rst
@@ -325,7 +325,7 @@ when resolving the :term:`Resource` tree hierarchy. This helps solving special u
 conditions must be applied at different hierarchy levels. By default, if no |perm_access|_ indication is provided when
 creating a new :term:`Permission`, :attr:`Access.ALLOW` is employed since `Magpie` resolves all |perm_access|_ to a
 :term:`Resource` as :attr:`Access.DENY` unless explicitly granted. In other words, `Magpie` assumes that administrators
-adding new :term:`Permission` entries intent to grant :term:`Service` or :term:`Resource` access for the targeted
+adding new :term:`Permission` entries intend to grant :term:`Service` or :term:`Resource` access for the targeted
 :term:`User` or :term:`Group`. Any :term:`Permission` specifically created using :attr:`Access.DENY` should be involved
 only to revert a previously resolved :attr:`Access.ALLOW`, as they are otherwise redundant to default
 |effective_permissions|_ resolution.
@@ -334,11 +334,12 @@ only to revert a previously resolved :attr:`Access.ALLOW`, as they are otherwise
 .. |perm_scope| replace:: ``scope``
 
 The |perm_scope|_ concept is defined by :class:`magpie.permissions.Scope` enum. This tells `Magpie` whether the
-:term:`Applied Permission` should impact only the immediate :term:`Resource` (i.e.: when ``match``) or should instead
-be applied recursively for it and all its children. By applying a recursive :term:`Permission` on a higher-level
-:term:`Resource`, this modifier avoids having to manually set the same :term:`Permission` on every sub-:term:`Resource`
-when access as to be provided over a large hierarchy. Also, when combined with the |perm_access|_ component, the
-|perm_scope|_ modifier can provide advanced control over granted or denied access.
+:term:`Applied Permissions <Applied Permission>` should impact only the immediate :term:`Resource`
+(i.e.: when ``match``) or should instead be applied recursively for it and all its children. By applying a recursive
+:term:`Permission` on a higher-level :term:`Resource`, this modifier avoids having to manually set the same
+:term:`Permission` on every sub-:term:`Resource` when access as to be provided over a large hierarchy.
+Also, when combined with the |perm_access|_ component, the |perm_scope|_ modifier can provide advanced control over
+granted or denied access.
 
 As a general rule of thumb, all :term:`Permission` are resolved such that more restrictive access applied *closer* to
 the actual :term:`Resource` for the targeted :term:`User` will have priority, both in terms of inheritance by tree
@@ -348,6 +349,16 @@ hierarchy and by :term:`Group` memberships.
     - |perm_example_modifiers|_
     - |perm_example_resolve|_
 
+.. warning::
+    Whenever possible, it is preferable and strongly advised to define new :term:`Permission` definitions using
+    :attr:`Access.ALLOW` *as close as possible* to the target child :term:`Resource` for which to allow access,
+    and leave the parent :term:`Resource` without any :term:`Permission` to let it be resolved by default to
+    :attr:`Access.DENY` as well as any other :term:`Resource` under it except the explicitly allowed one.
+    This is safer than the error prone alternative to :attr:`Access.ALLOW` everything at the root and revoke access
+    at lower levels using :attr:`Access.DENY` to add "allowed exceptions" to the :term:`Resource` hierarchy. In case
+    of incorrect request parsing, this second approach could potentially erroneously grant access to :term:`Resource`
+    intended to be blocked. Using the first approach (only explicitly :attr:`Access.ALLOW` granted items) would still
+    block by default all incorrectly parsed requests, ensuring children :term:`Resource` would still be protected.
 
 .. _permission_representations:
 
@@ -499,7 +510,8 @@ Below are the resolution steps which are applied for every distinct :term:`Permi
 
     |inherited_permissions|_ resolution
 
-.. container:: bordered-content
+.. container class generates '#.#' numbering with parent list reference automatically for proper alignment of text
+.. container:: bordered-content parent-list-numbers
     :name: steps_resolve_inherited_block
 
     1. Any |direct_permissions|_ applied explicitly for the evaluated :term:`User` and :term:`Resource` combination
@@ -508,15 +520,15 @@ Below are the resolution steps which are applied for every distinct :term:`Permi
 
     2. Following is the resolution of |inherited_permissions|_. In this case, there are three possibilities:
 
-        2.1 There is only one :term:`Group` for which a :term:`Permission` is defined. The :term:`User` inherits that
-            specification, whether it is :attr:`Access.ALLOW` or :attr:`Access.DENY`.
-
-        2.2 Many :term:`Group` membership exist and share of same highest priority. In this case, if any :term:`Group`
-            has :attr:`Access.DENY`, the resolved access is marked as denied. If every equally prioritized :term:`Group`
-            indicate :attr:`Access.ALLOW`, then access is granted to the :term:`User`.
-
-        2.3 Otherwise, the highest priority :term:`Group` dictates the :class:`Access` resolution. This can
-            potentially *revert* a previous :term:`Group` decision.
+       1. There is only one :term:`Group` for which a :term:`Permission` is defined. The :term:`User` inherits that
+          specification, whether it is :attr:`Access.ALLOW` or :attr:`Access.DENY`.
+          |
+       2. Many :term:`Group` membership exist and share of same highest priority. In this case, if any :term:`Group`
+          has :attr:`Access.DENY`, the resolved access is marked as denied. If every equally prioritized :term:`Group`
+          indicate :attr:`Access.ALLOW`, then access is granted to the :term:`User`.
+          |
+       3. Otherwise, the highest priority :term:`Group` dictates the :class:`Access` resolution. This can
+          potentially *revert* a previous :term:`Group` decision.
 
 
 The specific use case of step (2.3) is intended to give higher resolution precedence to any *generic* :term:`Group`
@@ -556,33 +568,32 @@ scoped inheritance over the :term:`Resource` tree. The following resolution prio
 .. container:: bordered-content
     :name: steps_resolve_effective_block
 
-    1. Resolve administrative access (i.e.: full access).
-       [only during |effective_permissions|_]
-    2. Resolution of |direct_permissions|_.
-       [same as step (1) of |steps_resolve_inherited|_]
-    3. Resolution of |inherited_permissions|_ from :term:`Group` memberships.
-       [same as step (2) of |steps_resolve_inherited|_]
-    4. Rewinding of the :term:`Resource` tree to consider scoped inheritance.
-       [only during |effective_permissions|_]
-
+    1. | Resolve administrative access (i.e.: full access).
+       | [only during |effective_permissions|_]
+    2. | Resolution of |direct_permissions|_.
+       | [same as step (1) of |steps_resolve_inherited|_]
+    3. | Resolution of |inherited_permissions|_ from :term:`Group` memberships.
+       | [same as step (2) of |steps_resolve_inherited|_]
+    4. | Rewinding of the :term:`Resource` tree to consider scoped inheritance.
+       | [only during |effective_permissions|_]
 
-In this case, step (1) that verifies if the :term:`User` is a member for :envvar:`MAGPIE_ADMIN_GROUP`.
+In this case, step (1) verifies if the :term:`User` is a member for :envvar:`MAGPIE_ADMIN_GROUP`.
 In such case, :attr:`Access.ALLOW` is immediately returned for every possible |allowed_permissions|_ for the
 targeted :term:`Resource` without further resolution involved.
 The reason why this check is accomplished only during |effective_permissions|_ resolution is to avoid over
 populating the database with :envvar:`MAGPIE_ADMIN_GROUP` :term:`Permission` for every possible :term:`Resource`.
-It can be noted that effectively, ``"administrator"`` reason will never be returned when requesting any other type of
-:term:`Permission` than when specifying ``effective=true`` query, as there is no need to explicitly define
-:envvar:`MAGPIE_ADMIN_GROUP` |applied_permissions|_.
+It can be noted that effectively, ``"administrator"`` as :term:`Permission` ``reason`` will never be returned when
+requesting any other type of :term:`Permission` than when specifying ``effective=true`` query, as there is no need
+to explicitly define :envvar:`MAGPIE_ADMIN_GROUP` |applied_permissions|_.
 Furthermore, doing this pre-check step ensures that :envvar:`MAGPIE_ADMIN_GROUP` members are always granted full access
 regardless of any explicit :term:`Applied Permission` that could exist for that *special* :term:`Group`.
 
-When the :term:`User` is not a member of :envvar:`MAGPIE_ADMIN_GROUP`, |effective_permissions|_ would then pursue
-with the traditional |steps_resolve_inherited|_ listed earlier. The resolution process continues by rewinding the parent
-:term:`Resource` hierarchy until the first :term:`Permission` is found, or until reaching the top-most :term:`Service`.
-Only on the first iteration (when the targeted :term:`Resource` is the same as the one looked for potential
-|inherited_permissions|_) does :attr:`Scope.MATCH` take effect. Only :attr:`Scope.RECURSIVE` are considered
-afterwards.
+When the :term:`User` is not a member of :envvar:`MAGPIE_ADMIN_GROUP`, |effective_permissions|_ would then pursue to
+steps (2) and (3) with the traditional |steps_resolve_inherited|_ listed earlier. The resolution process continues with
+step (4) by rewinding the parent :term:`Resource` hierarchy until the first :term:`Permission` is found, or until the
+root :term:`Service` is reached. Only on the first iteration (when the targeted :term:`Resource` is the same as the one
+looked for potential |inherited_permissions|_) does :attr:`Scope.MATCH` take effect. Only :attr:`Scope.RECURSIVE` are
+considered afterwards.
 
 When the first :term:`Permission` is found, the procedure *remembers* the :class:`Access` of the
 |resolved_permissions|_ for the current scope. If the found :term:`Permission` is linked directly to the
@@ -632,6 +643,23 @@ for |perm_reason|_ field. Following pseudo-code presents the overall procedure.
 .. seealso::
     - |perm_example_resolve|_
 
+In some cases, :term:`Service` implementations will support simultaneous references to multiple :term:`Resources`
+with a single request. One such example is when a request parameter allows a comma-separated list of values referring to
+distinct :term:`Resource` items, for which :term:`Effective Resolution` must be computed for each element of the list.
+When a :term:`Service` supports this type of references, the above |algo_resolve_effective|_ is applied
+iteratively for every :term:`Resource` until all have been validated for :attr:`Access.ALLOW`, or until the first
+:attr:`Access.DENY` is found. For this kind of |effective_permissions|_ to be granted access, **ALL** requested
+:term:`Permission` on every :term:`Resources` in the set must be :attr:`Access.ALLOW` indiscriminately. Denied access
+to any element takes precedence over the whole set.
+
+This procedure over multiple :term:`Resource` only applies during :term:`ACL` computation of an actual request to access
+the remote :term:`Service` provider or one of its children :term:`Resource`. When managing |applied_permissions|_ on
+:term:`Resource` definitions in `Magpie`, operations are always applied on elements individually.
+
+.. versionadded:: 3.21
+    Resolution over multiple simultaneous :term:`Resource` referred by a common request.
+
+
 Examples
 -------------------
 
diff --git a/docs/services.rst b/docs/services.rst
index 543b6032f..12b9c7ff1 100644
--- a/docs/services.rst
+++ b/docs/services.rst
@@ -174,7 +174,7 @@ attempting access of a specific :term:`Resource` of type :class:`magpie.models.F
     Permission :attr:`Permission.READ` does not offer *metadata* content listing of :class:`magpie.models.Directory`
     anymore. For this, :attr:`Permission.BROWSE` should be used instead. Setting :attr:`Permission.READ` on a
     directory will only be logical when combined with :attr:`Scope.RECURSIVE`, in which case `Magpie` will interpret
-    the :term:`Effective Permissions` to allow read access to all :class:`magpie.models.File` under that directory, at
+    the :term:`Effective Permission` to allow read access to all :class:`magpie.models.File` under that directory, at
     any depth level, unless denied by a lower-level specification.
 
 Finally, :attr:`Permission.WRITE` can also be applied on all of the resources, but are not explicitly employed during
@@ -186,7 +186,7 @@ parsing of incoming requests.
     only returns either :attr:`Permission.BROWSE` or :attr:`Permission.READ`. A :term:`User` or :term:`Group` can still
     have this :term:`Applied Permission` to allow a third party service to interrogate `Magpie API` about the presence
     of :attr:`Permission.WRITE` permission and perform the appropriate action with the result. The
-    :term:`Effective Permissions` API routes will provide the resolved ``access``. It is only `Twitcher`_ proxy that
+    :term:`Effective Permission` API routes will provide the resolved ``access``. It is only `Twitcher`_ proxy that
     will not be able to make use of it during incoming requests as it depends on
     :class:`magpie.adapter.magpieowssecurity.MagpieOWSSecurity`, which in turn employs the result from the :term:`ACL`.
 
@@ -312,7 +312,7 @@ To summarize, if ``file_patterns`` produces a match, that matched portion will b
 name is used directly (as is from the specified request path). The plain name is also used if ``file_patterns`` is
 explicitly specified as an empty list or ``null``. Not explicitly overriding the field will result into using the
 above *default* ``file_patterns``. The ``file_patterns`` allow for example to consider ``file.nc``, ``file.ncml`` and
-``file.nc.html`` as the same :term:`Resource` internally, which avoids duplicating :term:`Applied Permissions` across
+``file.nc.html`` as the same :term:`Resource` internally, which avoids duplicating :term:`Applied Permission` across
 multiple :term:`Resource` for their corresponding *metadata* or *data* representations.
 
 
diff --git a/magpie/api/management/resource/resource_formats.py b/magpie/api/management/resource/resource_formats.py
index 5338a7f97..e0df1e540 100644
--- a/magpie/api/management/resource/resource_formats.py
+++ b/magpie/api/management/resource/resource_formats.py
@@ -78,8 +78,9 @@ def format_resource_tree(children, db_session, resources_perms_dict=None, permis
     :param children: service or resource for which to generate the formatted resource tree
     :param db_session: connection to db
     :param resources_perms_dict:
-        Any pre-established :term:`Applied Permissions` to set to corresponding resources by ID.
-        When provided, these will define the :term:`User`, :term:`Group` or both (i.e.: :term:`Inherited Permissions`)
+        Any pre-established :term:`Applied Permission` to set to corresponding resources by ID.
+        When provided, these will define the :term:`User`, :term:`Group` or both
+        (i.e.: :term:`Inherited Permissions <inherited permission>`)
         actual permissions, or even the :term:`Effective Permissions`, according to parent caller function's context.
         Otherwise (``None``), defaults to extracting :term:`Allowed Permissions` for the given :term:`Resource` scoped
         under the corresponding root :term:`Service`.
diff --git a/magpie/api/management/service/service_formats.py b/magpie/api/management/service/service_formats.py
index a39c0e5e2..d458c2149 100644
--- a/magpie/api/management/service/service_formats.py
+++ b/magpie/api/management/service/service_formats.py
@@ -117,12 +117,12 @@ def format_service_resources(service,                       # type: Service
     :param service: service for which to display details with sub-resources
     :param db_session: database session
     :param service_perms:
-        If provided, sets :term:`Applied Permissions` to display on the formatted :paramref:`service`.
+        If provided, sets all :term:`Applied Permission` to display on the formatted :paramref:`service`.
         Otherwise, sets the :term:`Allowed Permissions` specific to the :paramref:`service`'s type.
     :param resources_perms_dict:
-        If provided (not ``None``), set the :term:`Applied Permissions` on each specified resource matched by ID.
+        If provided (not ``None``), set the :term:`Applied Permission` on each specified resource matched by ID.
         If ``None``, retrieve and set :term:`Allowed Permissions` for the corresponding resources under the service.
-        To set empty :term:`Applied Permissions` (e.g.: :term:`User` doesn't have permissions on that resource), provide
+        To set empty :term:`Applied Permission` (e.g.: :term:`User` doesn't have permissions on that resource), provide
         an explicit empty dictionary instead.
     :param permission_type: Provide permission type being rendered.
     :param show_all_children:
diff --git a/magpie/api/management/user/user_utils.py b/magpie/api/management/user/user_utils.py
index 9435ffe7e..fbc51d1d6 100644
--- a/magpie/api/management/user/user_utils.py
+++ b/magpie/api/management/user/user_utils.py
@@ -568,19 +568,20 @@ def get_user_services(user, request, cascade_resources=False, format_as_list=Fal
         top-level resources corresponding to a :term:`Service`.
         Otherwise, return every service that has at least one sub-resource with permissions (children at any-level).
         In both cases, the *permissions* looked for consider either only :term:`Direct Permissions` or any
-        :term:`Inherited Permissions` according to the value of :paramref:`inherit_groups_permissions`.
+        :term:`Inherited Permission` according to the value of :paramref:`inherit_groups_permissions`.
     :param inherit_groups_permissions:
         If ``False``, return only user-specific service/sub-resources :term:`Direct Permissions`.
-        Otherwise, resolve :term:`Inherited Permissions` using all groups the user is member of.
+        Otherwise, resolve :term:`Inherited Permissions <inherited permission>` using all groups the user is member of.
     :param resolve_groups_permissions:
-        Whether to combine :term:`Direct Permissions` and :term:`Inherited Permissions` for respective resources or not.
+        Whether to combine :term:`Direct Permissions <direct permission>` and
+        :term:`Inherited Permissions <inherited permission` for respective resources or not.
     :param format_as_list:
         Returns as list of service dict information (not grouped by type and by name)
     :param service_types:
         Filter list of service types for which to return details. All service types are used if omitted.
     :return:
         Only services which the user as :term:`Direct Permissions` or considering all tree hierarchy,
-        and for each case, either considering only user permissions or every :term:`Inherited Permissions`,
+        and for each case, either considering only user permissions or every :term:`Inherited Permission`,
         according to provided options.
     :rtype:
         Mapping of services by type to corresponding services by name containing each sub-mapping of their information,
@@ -675,13 +676,14 @@ def is_user_perm(perm):
 def resolve_user_group_permissions(resource_permission_list):
     # type: (List[ResolvablePermissionType]) -> Iterable[PermissionSet]
     """
-    Reduces overlapping user :term:`Inherited Permissions` for corresponding resources/services amongst the given list.
+    Reduces overlapping user :term:`Inherited Permission` for corresponding resources/services amongst the given list.
 
     User :term:`Direct Permissions` have the top-most priority and are therefore selected first if permissions are
     found for corresponding resource. In such case, only one entry is possible (it is invalid to have more than one
     combination of ``(User, Resource, Permission)``, including modifiers, as per validation during their creation).
 
-    Otherwise, for corresponding :term:`Inherited Permissions`, resolve the prioritized permission across every group.
+    Otherwise, for corresponding :term:`Inherited Permissions <inherited permission>`, resolve the prioritized
+    :term:`Permission` across every group.
     Similarly to users, :func:`magpie.groups.group_utils.get_similar_group_resource_permission` validate that only one
     combination of ``(Group, Resource, Permission)`` can exist including permission modifiers. Only, cross-group
     memberships for a given resource must then be computed.
@@ -730,16 +732,18 @@ def regroup_permissions_by_resource(resource_permissions, resolve=False):
     """
     Regroups multiple uncategorized permissions into a dictionary of corresponding resource IDs.
 
-    While regrouping the various permissions (both :term:`Direct Permissions` and any amount of groups
-    :term:`Inherited Permissions`) under their respective resource by ID, optionally resolve overlapping or conflicting
-    permissions by name such that only one permission persists for that resource and name.
+    While regrouping the various permissions (both :term:`Direct Permissions <direct permission>` and any amount of
+    groups :term:`Inherited Permissions <inherited permission>`) under their respective resource by ID, optionally
+    resolve overlapping or conflicting permissions by name such that only one permission persists for that resource
+    and name.
 
     .. seealso::
         :func:`resolve_user_group_permissions`
 
     :param resource_permissions:
         List of resource permissions to process.
-        Can include both user :term:`Direct Permissions` and its groups :term:`Inherited Permissions`.
+        Can include both user :term:`Direct Permissions <direct permission>` and its groups
+        :term:`Inherited Permissions <inherited permission>`.
     :param resolve:
         When ``False``, only mapping by resource ID is accomplished. Full listing of permissions is returned.
         Otherwise, resolves the corresponding resource permissions (by same ID) considering various priority rules to
@@ -783,7 +787,8 @@ def get_user_resources_permissions_dict(user, request, resource_types=None, reso
         Otherwise, resolve inherited permissions using all groups the user is member of.
     :param resolve_groups_permissions: whether to combine corresponding user/group permissions into one or not.
     :return:
-        Only resources which the user has permissions on, or including all :term:`Inherited Permissions`, according to
+        Only resources which the user has permissions on, or including all
+        :term:`Inherited Permissions <inherited permission>`, according to
         :paramref:`inherit_groups_permissions` argument.
     """
     ax.verify_param(user, not_none=True, http_error=HTTPNotFound,
@@ -804,7 +809,7 @@ def get_user_service_resources_permissions_dict(user, service, request,
     Retrieves all permissions the user has for every :term:`Resource` nested under the :term:`Service`.
 
     The retrieved permissions can either include only :term:`Direct Permissions` or a combination of user and group
-    :term:`Inherited Permissions` accordingly to provided options.
+    :term:`Inherited Permissions <inherited permission>` accordingly to provided options.
 
     .. seealso::
         :func:`get_user_resources_permissions_dict`
diff --git a/magpie/permissions.py b/magpie/permissions.py
index 5346de003..046e5d8e0 100644
--- a/magpie/permissions.py
+++ b/magpie/permissions.py
@@ -338,8 +338,8 @@ def resolve(cls,
         handle multi-level :term:`Resource` resolution. Resolution is accomplished in this case only for a given level
         in the tree hierarchy.
 
-        The comparison considers both the :class:`Access` and :class:`Scope` of :term:`Inherited Permissions` of the
-        :term:`User`, as well as its :term:`Group` memberships sorted by their priority.
+        The comparison considers both the :class:`Access` and :class:`Scope` of every  :term:`Inherited Permission` of
+        the :term:`User`, as well as its :term:`Group` memberships sorted by their priority.
 
         .. seealso::
             - :meth:`magpie.services.ServiceInterface.effective_permissions`
@@ -601,7 +601,7 @@ def format_permissions(permissions,             # type: Optional[Collection[AnyP
     definition of allowed permissions under :class:`magpie.services.Services` and their children :term:`Resource` by
     only defining :class:`Permission` names without manually listing all variations of :class:`PermissionSet`.
 
-    For other :paramref:`permission_type` values, which represent :term:`Applied Permissions` only explicitly
+    For other :paramref:`permission_type` values, which represent :term:`Applied Permission` only explicitly
     provided :paramref:`permissions` are returned, to effectively return the collection of *active* permissions.
 
     :param permissions: multiple permissions of any implementation and type, to be rendered both as names and JSON.
diff --git a/magpie/services.py b/magpie/services.py
index 07eb30bb2..0c03dc9b1 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -508,8 +508,9 @@ def effective_permissions(self, user, resource, permissions=None, allow_match=Tr
         permissions can be immediately resolved such as when more restrictive conditions enforce denied access.
 
         Both user and group permission inheritance is resolved simultaneously to tree hierarchy with corresponding
-        allow and deny conditions. User :term:`Direct Permissions` have priority over all its groups
-        :term:`Inherited Permissions`, and denied permissions have priority over allowed access ones.
+        allow and deny conditions. User :term:`Direct Permissions <direct permission>` have priority over all its groups
+        :term:`Inherited Permissions <inherited permission>`, and denied permissions have priority over allowed access
+        ones.
 
         All applicable permissions on the resource (as defined by :meth:`allowed_permissions`) will have their
         resolution (Allow/Deny) provided as output, unless a specific subset of permissions is requested using
diff --git a/magpie/ui/management/views.py b/magpie/ui/management/views.py
index 17be9683c..566f1d16f 100644
--- a/magpie/ui/management/views.py
+++ b/magpie/ui/management/views.py
@@ -500,7 +500,7 @@ def get_user_or_group_resources_permissions_dict(self, user_or_group_name, servi
         Result is a :class:`tuple` of:
             - combined :term:`Allowed Permissions` (*names only*) for services and their children resources.
             - dictionary of key-service-name, each with recursive map value of children resource details including
-              the :term:`Applied Permissions` or :term:`Inherited Resources` for the corresponding :term:`User`
+              the :term:`Applied Permissions <Applied Permission>` or :term:`Inherited Resources` for the corresponding :term:`User`
               or :term:`Group` accordingly to specified arguments.
         """
         if is_user:
diff --git a/tests/interfaces.py b/tests/interfaces.py
index fef998518..fdcb03527 100644
--- a/tests/interfaces.py
+++ b/tests/interfaces.py
@@ -2555,7 +2555,8 @@ def test_GetUserResourcePermissions_PermissionsHierarchyResolution(self):
                     child-resource      <-- 2nd permission applied
 
         For each combination, there is always only one :term:`Applied Permission` for a user or group per resource in
-        the hierarchy. This makes :term:`Inherited Permissions` and :term:`Resolved Permissions` field ``reasons`` much
+        the hierarchy. This makes :term:`Inherited Permissions <inherited permission>` and
+        :term:`Resolved Permissions <inherited permission>` field ``reasons`` much
         easier to validate as there are no intra-resource (same) permission resolution, only inter-resource (distinct)
         permission inheritance according to local-level priorities, making ``reason`` always single-entry.
         These are highlighted by the corresponding arrow comments in the code.
diff --git a/tests/test_services.py b/tests/test_services.py
index a9f97a9f8..9eebacf58 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -197,10 +197,10 @@ def test_ServiceAPI_effective_permissions(self):
 
         .. versionchanged:: 3.5
             User and Group permissions for ``Resource1`` and ``Resource2`` have been swapped since new priorities make
-            :term:`Direct Permissions` more important than :term:`Inherited Permissions`. The :attr:`Access.DENY` was
-            not being reverted with original definitions that assumed them to be of equal importance, and therefore
-            plain ``DENY > ALLOW`` was working. Permission on ``Resource4`` was moved from Group to User for the same
-            reason.
+            :term:`Direct Permissions <direct permission>` more important than
+            :term:`Inherited Permissions <inherited permission>`. The :attr:`Access.DENY` was not being reverted with
+            original definitions that assumed them to be of equal importance, and therefore plain ``DENY > ALLOW`` was
+            working. Permission on ``Resource4`` was moved from Group to User for the same reason.
         """
         svc_name = "unittest-service-api"
         svc_type = ServiceAPI.service_type
@@ -342,9 +342,9 @@ def test_ServiceTHREDDS_effective_permissions(self):
 
         .. versionchanged:: 3.5
             User and Group permissions for ``Directory1`` and ``Directory2`` have been swapped since new priorities make
-            :term:`Direct Permissions` more important than :term:`Inherited Permissions`. The :attr:`Access.DENY` was
-            not being reverted with original definitions that assumed them to be of equal importance, and therefore
-            plain ``DENY > ALLOW`` was working.
+            :term:`Direct Permissions` more important than :term:`Inherited Permissions <inherited permission>`.
+            The :attr:`Access.DENY` was not being reverted with original definitions that assumed them to be of equal
+            importance, and therefore plain ``DENY > ALLOW`` was working.
         """
         svc_type = ServiceTHREDDS.service_type
         svc1_name = "unittest-service-thredds-1"

From 65a1231b246c249ade23bf23182ef0fa4ff09c6b Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 25 Jan 2022 01:47:36 -0500
Subject: [PATCH 29/34] document new services and attributes

---
 docs/_static/custom.css |  20 ++++-
 docs/glossary.rst       |  22 ++++-
 docs/permissions.rst    |   4 +-
 docs/services.rst       | 193 +++++++++++++++++++++++++++++++++++++---
 magpie/services.py      |   4 +-
 5 files changed, 218 insertions(+), 25 deletions(-)

diff --git a/docs/_static/custom.css b/docs/_static/custom.css
index c9ace4109..382bf2e52 100644
--- a/docs/_static/custom.css
+++ b/docs/_static/custom.css
@@ -56,13 +56,25 @@ div.bordered-content {
 /* apply the parent list number prefixed to the current list numbers
     https://stackoverflow.com/a/13841818
 */
-div.parent-list-numbers > ol {
+div.parent-list-numbers ol {
     counter-reset: item;
 }
-div.parent-list-numbers > li {
-    display: block;
+div.parent-list-numbers ol li {
+    counter-increment: item;
 }
-div.parent-list-numbers > li:before {
+/*div.parent-list-numbers > li:before {
     content: counters(item, ".") " ";
     counter-increment: item
+}*/
+div.parent-list-numbers ol ol > li::before {
+    content: counters(item, ".")")";
+    margin-left: -3em;
+}
+div.parent-list-numbers ol li {
+    counter-increment: item;
+}
+div.parent-list-numbers > ol > li > ol > li {
+    list-style: None;
+    display: inline-flex;
+    display: -webkit-box;
 }
diff --git a/docs/glossary.rst b/docs/glossary.rst
index 28dc4613e..2710823d1 100644
--- a/docs/glossary.rst
+++ b/docs/glossary.rst
@@ -137,9 +137,9 @@ Glossary
         geospatial data and service methodologies in order to improve access to geospatial and location information.
 
     OWS
-        Acronym that regroups all :term:`OGC` Web Services. This includes `Web Feature Service` (WFS),
-        `Web Map Service` (WMS) and `Web Processing Service` (WPS) for which `Magpie` offers some specific
-        :term:`Service` request parser implementations.
+        Acronym that regroups all :term:`OGC` Web Services. This includes :term:`Web Feature Service <WFS>` (WFS),
+        :term:`Web Map Service <WMS>` (WMS) and :term:`Web Processing Service <WMS>` (WPS), amongst others, for which
+        `Magpie` offers some specific :term:`Service` request parser implementations.
 
     Pending User
         Account that is pending for validation or approval following self-registration when the application is
@@ -226,3 +226,19 @@ Glossary
 
         .. seealso::
             :ref:`config_webhook` and :ref:`config_file` sections for details.
+
+    Web Feature Service
+    WFS
+
+        One of the :term:`OWS` implementation which `Magpie` offers an implementation
+        for controlling access to layers and their features.
+
+    Web Map Service
+    WMS
+        One of the :term:`OWS` implementation which `Magpie` offers an implementation
+        for controlling access to layers and generated maps from them.
+
+    Web Processing Service
+    WPS
+        One of the :term:`OWS` implementation which `Magpie` offers an implementation
+        for controlling access to description and execution of processes.
diff --git a/docs/permissions.rst b/docs/permissions.rst
index 7d973b69c..ba1d1c9ed 100644
--- a/docs/permissions.rst
+++ b/docs/permissions.rst
@@ -522,11 +522,11 @@ Below are the resolution steps which are applied for every distinct :term:`Permi
 
        1. There is only one :term:`Group` for which a :term:`Permission` is defined. The :term:`User` inherits that
           specification, whether it is :attr:`Access.ALLOW` or :attr:`Access.DENY`.
-          |
+
        2. Many :term:`Group` membership exist and share of same highest priority. In this case, if any :term:`Group`
           has :attr:`Access.DENY`, the resolved access is marked as denied. If every equally prioritized :term:`Group`
           indicate :attr:`Access.ALLOW`, then access is granted to the :term:`User`.
-          |
+
        3. Otherwise, the highest priority :term:`Group` dictates the :class:`Access` resolution. This can
           potentially *revert* a previous :term:`Group` decision.
 
diff --git a/docs/services.rst b/docs/services.rst
index 12b9c7ff1..e20a1761d 100644
--- a/docs/services.rst
+++ b/docs/services.rst
@@ -21,7 +21,7 @@ Therefore, they can be listed and searched for either using ``/services`` API ro
 On top of any :term:`Resource`'s metadata, a :term:`Service` provides specific information about its location, its
 remote synchronization method (if any), and its exposed endpoint. Another important detail about the :term:`Service`
 is its ``type``. This will not only dictate its purpose, but also define the whole schema of allowed :term:`Resource`
-under it (if any), as well as every one of their :term:`Allowed Permissions`.
+under it (if any), as well as every one of their :term:`Allowed Permissions <Allowed Permission>`.
 
 The final distinction between a :term:`Service` and generic :term:`Resource` is their position in the hierarchy. Only
 :term:`Service`-specialized :term:`Resource` (literally ``resource_type = "service"``) are allowed to be placed at the
@@ -69,17 +69,70 @@ On top of the above methods, the following attributes must be defined.
       - Defines the mapping of registered :term:`Service` to the appropriate implementation type. Each implementation
         must have an unique value.
     * - :attr:`ServiceInterface.permissions` |br| (``List[Permission]``)
-      - Defines the :term:`Allowed Permissions` that can be applied onto the :term:`Service` reference itself.
+      - Defines the :term:`Allowed Permissions <Allowed Permission>` that can be applied onto the :term:`Service`
+        reference itself.
     * - :attr:`ServiceInterface.resource_types_permissions` |br| (``Dict[Resource, List[Permission]]``)
       - Map of the allowed children :term:`Resource` under the :term:`Service` and their corresponding
-        :term:`Allowed Permissions` for each case. Leaving this map empty will disallow the creation of any children
-        :term:`Resource`, making the :term:`Service` the unique applicable element of the hierarchy. Note that each
-        :term:`Resource` implemented by a derived class of :class:`magpie.models.Resource` also provides details about
-        :Term:`Allowed Permissions`, their type and further nested children :term:`Resource`.
-    * - :attr:`ServiceInterface.params_expected` |br| (``List[str]``)
+        :term:`Allowed Permissions <Allowed Permission>` for each case. Leaving this map empty will disallow the
+        creation of any children :term:`Resource`, making the :term:`Service` the unique applicable element of the
+        hierarchy. Note that each :term:`Resource` implemented by a derived class of :class:`magpie.models.Resource`
+        also provides details about :Term:`Allowed Permissions <Allowed Permission>`, their type and further nested
+        children :term:`Resource`.
+    * - :attr:`child_structure_allowed` |br| (``Dict[Type[ServiceOrResourceType], List[Type[models.Resource]]]``)
+      - Map of allowed :term:`Resource`type nesting hierarchy for the :term:`Service`.
+        This controls whether some children :term:`Resource` can be placed under another to limit creation only to
+        cases that are relevant for the implemented :term:`Service`.
+    * - :attr:`configurable` |br| (``bool``)
+      - Parameter that controls whether the :term:`Service` supports custom configuration, providing means to
+        slightly alter, enable or disable certain behaviours of the parsing methodology of request into :term:`Resource`
+        and :term:`Permission` components for the given :term:`Service`.
+
+.. seealso::
+    :ref:`ServiceTHREDDS` and :ref:`ServiceGeoserver` for examples of :term:`Service` implementations that
+    support custom configuration.
+
+On top of the above definitions, any service that derives from :class:`magpie.services.ServiceOWS` should also provide
+follow parameters for parsing :term:`OWS` requests.
+
+.. list-table::
+    :header-rows: 1
+
+    * - :attr:`ServiceOWS.params_expected` |br| (``List[str]``)
       - Represents specific parameter names that can be preprocessed during HTTP request parsing to ease following
-        resolution of :term:`ACL` use cases. Employed only by :term:`Service` implementations derived from
-        :class:`magpie.services.ServiceOWS`. Can be omitted otherwise.
+        resolution of :term:`ACL` use cases.
+    * - :attr:`ServiceOWS.service_base`  |br| (``str``)
+      - Provide the reference :term:`OWS` type for handling requests with proper parsers and resolvers.
+
+Furthermore, some :term:`Services <Service>` specifically implement extended :term:`OWS` utilities offered by
+`GeoServer`_. They derive from :class:`ServiceGeoserverBase` and should provide the following additional parameters.
+
+.. list-table::
+    :header-rows: 1
+
+    * - :attr:`ServiceGeoserverBase.resource_scoped` |br| (``bool``)
+      - Indicates if the :term:`Service` is allowed to employ scoped :class:`models.Workspace` naming, meaning that
+        a :term:`Resource` of that type can be extracted either from the request path or the specific request parameter
+        using notation format ``<WORKSPACE>:<RESOURCE_PARAM>``.
+    * - :attr:`ServiceGeoserverBase.resource_multi` |br| (``bool``)
+      - Indicates if the :term:`Service` supports multiple simultaneous :term:`Resource` references within a single
+        request (see :ref:`perm_resolution` for more details`), which must all be considered
+        for :term:`Effective Resolution`.
+    * - :attr:`ServiceGeoserverBase.resource_param` |br| (``Union[Str, List[Str]]``)
+      - Name of one or many request query parameter(s) from which to extract multiple equivalent :term:`Resource`
+        references when the :term:`Service` supports multiple representations or notation conventions.
+
+
+.. versionchanged:: 3.21
+    - Attribute :attr:`ServiceOWS.params_expected` has been moved from :class:`ServiceInterface` to instead be directly
+      under :class:`ServiceOWS` since it applies only to derived classes from that base.
+
+.. versionadded:: 3.21
+    - Attribute :attr:`ServiceInterface.child_structure_allowed`
+    - Attribute :attr:`ServiceInterface.configurable`
+    - Attribute :attr:`ServiceOWS.service_base`
+    - Attribute :attr:`ServiceGeoserverBase.resource_scoped`
+    - Attribute :attr:`ServiceGeoserverBase.resource_multi`
+    - Attribute :attr:`ServiceGeoserverBase.resource_param`
 
 
 .. _services_available:
@@ -266,12 +319,16 @@ by the below configuration.
 
 Assuming a proxy intended to receive incoming requests configured with :class:`magpie.adapter.MagpieAdapter` such that
 ``{PROXY_URL}`` is the base path, the following path would point toward the registered service with the above YAML
-configuration::
+configuration.
+
+.. code-block:: http
 
     {PROXY_URL}/LocalThredds
 
 
-An incoming request will be parsed according to configured values against the following format::
+An incoming request will be parsed according to configured values against the following format.
+
+.. code-block:: http
 
     {PROXY_URL}/LocalThredds[/skip/prefix]/<prefix_type>/.../<file>
 
@@ -315,6 +372,32 @@ above *default* ``file_patterns``. The ``file_patterns`` allow for example to co
 ``file.nc.html`` as the same :term:`Resource` internally, which avoids duplicating :term:`Applied Permission` across
 multiple :term:`Resource` for their corresponding *metadata* or *data* representations.
 
+ServiceWFS
+~~~~~~~~~~~
+
+.. seealso::
+    - `ServiceGeoserverWFS`_ for a `GeoServer`_ flavoured implementation with only :term:`WFS` support.
+    - Consider using `ServiceGeoserver`_ for multi-:term:`OWS` implementation support under a common
+      endpoint representing a `GeoServer`_ instance.
+    - https://www.ogc.org/standards/wfs (OpenGIS WFS 2.0.0 implementation)
+
+This implementation is defined by :class:`magpie.services.ServiceWFS`.
+It implements the original standard :term:`WFS` definition. There is **NO** concept of :class:`magpie.models.Workspace`
+for this :term:`Service` implementation. Features are accessed directly using :class:`magpie.models.Layer` typed
+:term:`Resources <Resource>`.
+
+ServiceGeoserverWFS
+~~~~~~~~~~~~~~~~~~~~~
+
+.. seealso::
+
+    - https://docs.geoserver.org/latest/en/user/services/wfs/reference.html
+    - Consider using `ServiceGeoserver`_ for multi-:term:`OWS` implementation support under a common
+      endpoint representing a `GeoServer`_ instance.
+
+This implementation is defined by :class:`magpie.services.ServiceGeoserverWFS`.
+It implements some extensions to base :term:`WFS` by providing more :term:`Permission` and scoping of
+:class:`magpie.models.Layer` under :class:`magpie.models.Workspace` in a file-system-like fashion.
 
 ServiceBaseWMS
 ~~~~~~~~~~~~~~~~~~~~~
@@ -330,7 +413,7 @@ This is a *partial base* class employed to represent :term:`OWS` `Web Map Servic
 It cannot be employed directly as :term:`Service` instance. The derived classes provide different parsing methodologies
 and children :term:`Resource` representation according to their respective functionalities.
 
-It provides support for the following permissions, each corresponding to the appropriate functionality of `WMS`:
+It provides support for the following permissions, each corresponding to the appropriate functionality of :term:`WMS`:
 
 - :attr:`Permission.GET_CAPABILITIES`
 - :attr:`Permission.GET_MAP`
@@ -347,7 +430,10 @@ ServiceGeoserverWMS
 
 .. seealso::
 
-    Base class: `ServiceBaseWMS`_
+    - Base class: `ServiceBaseWMS`_
+    - https://docs.geoserver.org/latest/en/user/services/wms/reference.html
+    - Consider using `ServiceGeoserver`_ for multi-:term:`OWS` implementation support under a common
+      endpoint representing a `GeoServer`_ instance.
 
 This implementation is defined by :class:`magpie.services.ServiceGeoserverWMS`. It extends the base class by using
 children :term:`Resource` defined by :class:`magpie.models.Workspace`, which supports the same set of :term:`Permission`
@@ -365,7 +451,8 @@ ServiceNCWMS2
 
 .. seealso::
 
-    Base class: `ServiceBaseWMS`_
+    - Base class: `ServiceBaseWMS`_
+    - https://reading-escience-centre.gitbooks.io/ncwms-user-guide/content/04-usage.html
 
 This implementation is defined by :class:`magpie.services.ServiceNCWMS2`. It extends the base class by using
 children :term:`Resource` defined as :class:`magpie.models.Directory` and :class:`magpie.models.File` instances but,
@@ -388,6 +475,10 @@ relative file path from the ``THREDDS` root. The applicable query parameter depe
 ServiceWPS
 ~~~~~~~~~~~~~~~~~~~~~
 
+.. seealso::
+    Consider using `ServiceGeoserver`_ for multi-:term:`OWS` implementation support under a common
+    endpoint representing a `GeoServer`_ instance.
+
 The implementation of this :term:`Service` is handled by class :class:`magpie.services.ServiceWPS`. It is intended to
 control access to the operations provided by an :term:`OWS` `Web Processing Service`. This :term:`Service` allows
 one (1) type of child :term:`Resource`, namely the :class:`magpie.models.Process` which represent the execution units
@@ -424,6 +515,80 @@ it against an existing :term:`Resource`. The resolution of :term:`Effective Perm
 .. todo: Add dynamic services if implemented (https://github.com/Ouranosinc/Magpie/issues/149)
 
 
+ServiceGeoserverWPS
+~~~~~~~~~~~~~~~~~~~~~~~
+
+.. seealso::
+    Consider using `ServiceGeoserver`_ for multi-:term:`OWS` implementation support under a common
+    endpoint representing a `GeoServer`_ instance.
+
+The implementation of this :term:`Service` is handled by class :class:`magpie.services.ServiceGeoserverWPS`.
+It offers similar operations and request handling to :ref:`ServiceWPS`, but adds scoped :class:`magpie.models.Workspace`
+definition of :class:`magpie.models.Process` as for other `GeoServer`_ base :term:`Services <Service>`, in order to
+properly parse request paths that include such references. Other than the :term:`Resource` hierarchy being nested by
+:class:`magpie.models.Workspace`, the rest of the parsing and handling methodology is equivalent to :ref:`ServiceWPS`.
+
+
+ServiceGeoserver
+~~~~~~~~~~~~~~~~
+
+.. versionadded:: 3.21
+
+.. seealso::
+    - :ref:`ServiceGeoserverWFS`
+    - :ref:`ServiceGeoserverWMS`
+    - :ref:`ServiceGeoserverWPS`
+
+This :term:`Service` is combined :term:`OWS` implementation for `GeoServer`_ that allows simultaneous representation of
+:term:`WFS`, :term:`WMS` and :term:`WPS` :term:`Resources <Resource> all nested under a single reference hosted under
+common remote URL. Using this implementation, :class:`magpie.models.Workspace` are first required as immediate children
+under the root :term:`Service`, and can be followed by both :term:`Resources <Resource>` of type
+:class:`magpie.models.Layer` and :class:`magpie.models.Process`.
+There are two main advantages of using this combined implementation over their specific :term:`OWS` counterparts.
+
+First, using the same :term:`Resources <Resource>` to represent corresponding elements in the `GeoServer`_ across
+:term:`OWS` endpoints reduces the chances of inconsistent access to otherwise equivalent :term:`Resources <Resource>`.
+For example, a :class:`magpie.models.Layer` that is granted :term:`Permission` to retrieve features (:term:`WFS`) or
+to render their map raster (:term:`WMS`) will be managed using the same reference. Using distinct
+:ref:`ServiceGeoserverWFS` and :ref:`ServiceGeoserverWMS` :term:`Service` in `Magpie` would require from to
+administrator to always maintain their :term:`Permissions <Permission>` in sync. This is prone to many errors and
+confusion when managing multiple large hierarchies of layers.
+
+Second, this :ref:`ServiceGeoserver` implementation is *configurable*. In other words, if the :term:`Service`
+administrator intends to only make use (for the moment) of :term:`WFS` functionality, they can customize this
+:term:`Service` using the following definition.
+
+.. code-block:: YAML
+
+    providers:
+      RemoteGeoServer:
+        # minimal configuration requirements (where the real `GeoSever` service resides)
+        # other optional parameters from `providers.cfg` can also be provided
+        url: http://localhost:1234
+        type: geoserver
+
+        # customizable configuration (enable desired OWS request handlers)
+        # all OWS are enabled by default if no configuration is provided
+        configuration:
+          wfs: true
+          wms: false
+          wps: false
+
+This would make sure that request parsing and access to :term:`WMS` and :term:`WPS` endpoints is disabled, but leaves
+the :term:`Resource` definitions available for use at a later time if the administrator decides to eventually make use
+of them. For example, the administrator could decide to start using :term:`WMS` as well without any further change
+needed other than updating this :term:`Service` custom configuration and applying :term:`Permissions <Permission>`
+specific only to :term:`WMS`.
+All other :term:`Applied Permissions <Applied Permission>` to existing :term:`User`, :term:`Group` and :term:`Resource`
+for that :term:`Service`, as well as their full :term:`Resource` tree hierarchy, would be automatically ported from
+the :term:`WFS` to :term:`WMS` request handlers.
+
+.. note::
+    Custom configuration can be provided With either the `providers.cfg`_ (as presented above), in
+    a :ref:`config_file` as described in greater lengths within the :ref:`configuration` chapter,
+    or by providing the ``configuration`` field directly within the API request body during :term:`Service` creation.
+
+
 Service Synchronization
 ------------------------
 
diff --git a/magpie/services.py b/magpie/services.py
index 0c03dc9b1..bbf77f429 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -912,7 +912,7 @@ class ServiceGeoserverBase(ServiceOWS):
     def resource_scoped(self):
         # type: () -> bool
         """
-        Indicates if the service is allowed to employ scoped :class:`models.Workspace` naming.
+        Indicates if the :term:`Service` is allowed to employ scoped :class:`models.Workspace` naming.
 
         When allowed, the :class:`models.Workspace` can be inferred from the request parameter
         defined by :attr:`resource_param` to retrieve scoped name as ``<WORKSPACE>:<RESOURCE>``.
@@ -927,7 +927,7 @@ def resource_scoped(self):
     def resource_multi(self):
         # type: () -> bool
         """
-        Indicates if the service supports multiple simultaneous :term:`Resource` references.
+        Indicates if the :term:`Service` supports multiple simultaneous :term:`Resource` references.
 
         When supported, the value retrieved from :attr:`resource_param` can be comma-separated to represent
         multiple :term:`Resource` of the same nature, which can all be retrieved with the same request.

From b0ec6ae5bbb27dd4fb7f32519a8a5dae4e5828c8 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 25 Jan 2022 02:31:05 -0500
Subject: [PATCH 30/34] more fixes to docs references

---
 docs/authentication.rst                       | 10 ++---
 docs/conf.py                                  |  8 +++-
 docs/configuration.rst                        |  4 +-
 docs/performance.rst                          |  8 ++--
 docs/permissions.rst                          |  9 ++--
 docs/services.rst                             | 42 +++++++++----------
 magpie/adapter/magpieowssecurity.py           |  2 +-
 .../management/resource/resource_formats.py   |  9 ++--
 .../api/management/service/service_formats.py |  5 ++-
 magpie/api/management/user/user_utils.py      | 27 ++++++------
 magpie/permissions.py                         |  6 +--
 magpie/services.py                            |  4 +-
 magpie/ui/management/views.py                 |  7 ++--
 requirements-doc.txt                          |  1 +
 tests/interfaces.py                           | 14 +++----
 tests/test_services.py                        |  6 +--
 16 files changed, 87 insertions(+), 75 deletions(-)

diff --git a/docs/authentication.rst b/docs/authentication.rst
index da434e25c..bc7313fbe 100644
--- a/docs/authentication.rst
+++ b/docs/authentication.rst
@@ -242,8 +242,8 @@ Authorization Headers
 Following any successful :term:`Authentication` request as presented in the previous section, the obtained ``Cookie``
 defines which :term:`Logged User` attempts to accomplish an operation against a given protected URI. `Magpie` employs
 the same ``Cookie`` both for operations provided by its API and for accessing the real :term:`Resource` protected
-behind the :term:`Proxy` according to resolution of :term:`Effective Permissions` based on :term:`Applied Permission`
-definitions.
+behind the :term:`Proxy` according to resolution of :term:`Effective Permissions <Effective Permission>` based on
+:term:`Applied Permission` definitions.
 
 Access to Magpie Operations
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -259,14 +259,14 @@ Access to Protected Resources
 
 When sending requests to the :term:`Policy Enforcement Point` (PEP) (e.g.: `Twitcher`_ :term:`Proxy`),
 appropriate ``Cookie`` headers must be defined for it to identify the :term:`Logged User` and resolve its
-:term:`Effective Permissions` accordingly. Not providing those tokens will default to using
+:term:`Effective Permissions <Effective Permission>` accordingly. Not providing those tokens will default to using
 :envvar:`MAGPIE_ANONYMOUS_USER`, which will result into either one of HTTP ``Unauthorized [401]`` or
 ``Forbidden [403]``, depending on how the PEP interprets and returns the response indicated by `Magpie`, unless the
 corresponding :term:`Resource` was allowed for :ref:`perm_public_access`.
 
 When appropriately authenticated, access to the targeted :term:`Resource` will be granted or denied depending on the
-:term:`Effective Permissions` that :term:`Logged User` has for it. This decision is extensively explained in section
-:ref:`perm_resolution`.
+:term:`Effective Permissions <Effective Permission>` that :term:`Logged User` has for it. This decision is extensively
+explained in section :ref:`perm_resolution`.
 
 Another alternative to obtain :term:`Authorization` (only when using the :ref:`utilities_adapter<Magpie Adapter>`) is
 by providing the ``Authorization`` header in the request with appropriate credentials. In this situation, the adapter
diff --git a/docs/conf.py b/docs/conf.py
index 9061c643b..2aa2d52ae 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -54,6 +54,8 @@
     "doc_redirect",
     "sphinxcontrib.redoc",
     "sphinx.ext.autodoc",
+    "sphinx.ext.autosectionlabel",  # help make cross-references to title/sections
+    "cloud_sptheme.ext.autodoc_sections",  # allow sections in docstrings code
     "sphinx.ext.todo",
     "sphinx.ext.viewcode",
     "sphinx.ext.intersphinx",
@@ -174,7 +176,11 @@ def doc_redirect_include(file_path):
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
-exclude_patterns = []
+exclude_patterns = [
+    # ignore multiple over-verbose warnings caused
+    # by file not yet generated when TOC is processed
+    "api.rst",
+]
 
 # The reST default role (used for this markup: `text`) to use for all
 # documents.
diff --git a/docs/configuration.rst b/docs/configuration.rst
index 14bbdab8c..253dbd9c2 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -686,7 +686,7 @@ remain available as described at the start of the :ref:`Configuration` section.
     (Value: ``"admin"``)
 
     Name of the :term:`Permission` used to represent highest administration privilege in the application. It is one of
-    the special :term:`Access Permissions` known by the application (see also :ref:`Route Access` section).
+    the special :term:`Access Permission` known by the application (see also :ref:`Route Access` section).
 
 .. envvar:: MAGPIE_LOGGED_PERMISSION
 
@@ -695,7 +695,7 @@ remain available as described at the start of the :ref:`Configuration` section.
 
     .. versionadded:: 2.0
 
-    Defines a special condition of :term:`Access Permissions` related to the :term:`Logged User` session and the
+    Defines a special condition of :term:`Access Permission` related to the :term:`Logged User` session and the
     targeted :term:`User` by the request. See details in :ref:`Route Access` for when it applies.
 
 .. envvar:: MAGPIE_LOGGED_USER
diff --git a/docs/performance.rst b/docs/performance.rst
index c2b80d9c6..41e5d567d 100644
--- a/docs/performance.rst
+++ b/docs/performance.rst
@@ -10,10 +10,10 @@ requests are execute in rapid succession. `PostgreSQL`_ and `SQLAlchemy`_ are us
 when more than a couple requests per second are needed, some solutions are possible to
 improve the performance of these requests by avoiding unnecessary reload of static data.
 
-We can take advantage of the fact that individual :temr:`Permission` and :term:`Service` definitions are not
+We can take advantage of the fact that individual :term:`Permission` and :term:`Service` definitions are not
 susceptible to change often and cache the results of these queries.
 
-While not activated by default, it's possible to cache the :term:`Access Control Lists` (ACLs) and :term:`Service`
+While not activated by default, it's possible to cache the :term:`Access Control List` (ACL) and :term:`Service`
 retrieval operations for all services, and give it an expiration timeout.
 
 .. code-block:: ini
@@ -26,8 +26,8 @@ retrieval operations for all services, and give it an expiration timeout.
 .. warning::
     Take into consideration that settings must be applied to `Twitcher`_ INI file such that incoming proxy requests
     will be effective in its web application, in turn using the :class:`magpie.adapter.MagpieAdapter`. Caching settings
-    defined in `Magpie` INI file will be employed only when requesting :term:`Effective Permissions` resolution using
-    `Magpie`'s API endpoints.
+    defined in `Magpie` INI file will be employed only when requesting
+    :term:`Effective Permissions <Effective Permission>` resolution using `Magpie`'s API endpoints.
 
 
 In the above example, for a particular request that queries a :term:`Logged User`'s ACL for a specific :term:`Service`,
diff --git a/docs/permissions.rst b/docs/permissions.rst
index ba1d1c9ed..af25d27b8 100644
--- a/docs/permissions.rst
+++ b/docs/permissions.rst
@@ -643,14 +643,15 @@ for |perm_reason|_ field. Following pseudo-code presents the overall procedure.
 .. seealso::
     - |perm_example_resolve|_
 
-In some cases, :term:`Service` implementations will support simultaneous references to multiple :term:`Resources`
-with a single request. One such example is when a request parameter allows a comma-separated list of values referring to
+In some cases, :term:`Service` implementations will support simultaneous references to
+multiple :term:`Resources <Resource>` with a single request.
+One such example is when a request parameter allows a comma-separated list of values referring to
 distinct :term:`Resource` items, for which :term:`Effective Resolution` must be computed for each element of the list.
 When a :term:`Service` supports this type of references, the above |algo_resolve_effective|_ is applied
 iteratively for every :term:`Resource` until all have been validated for :attr:`Access.ALLOW`, or until the first
 :attr:`Access.DENY` is found. For this kind of |effective_permissions|_ to be granted access, **ALL** requested
-:term:`Permission` on every :term:`Resources` in the set must be :attr:`Access.ALLOW` indiscriminately. Denied access
-to any element takes precedence over the whole set.
+:term:`Permission` on every :term:`Resources <Resource>` in the set must be :attr:`Access.ALLOW` indiscriminately.
+Denied access to any element takes precedence over the whole set.
 
 This procedure over multiple :term:`Resource` only applies during :term:`ACL` computation of an actual request to access
 the remote :term:`Service` provider or one of its children :term:`Resource`. When managing |applied_permissions|_ on
diff --git a/docs/services.rst b/docs/services.rst
index e20a1761d..2b1d200df 100644
--- a/docs/services.rst
+++ b/docs/services.rst
@@ -32,14 +32,15 @@ Every :term:`Service` type provided by `Magpie` must derive from :class:`magpie.
 specific implementation (see :ref:`services_available`) serves to convert a given incoming HTTP request components
 (method, path, query parameters, body, etc.) into the appropriate :term:`Service`, :term:`Resource` and
 :term:`Permission` elements. This ultimately provides the required elements to resolve :term:`ACL` access of a
-:term:`Request User` toward the targeted :term:`Resource` according to its :term:`Effective Permissions`.
+:term:`Request User` toward the targeted :term:`Resource` according to its
+:term:`Effective Permissions <Effective Permission>`.
 
 In order to implement a new :term:`Service` type, two (2) methods and a few attributes are required. The first method is
 :meth:`magpie.services.ServiceInterface.permission_requested` which basically indicates how the HTTP request should be
 interpreted into a given :class:`Permission`. The second is :meth:`magpie.services.ServiceInterface.resource_requested`
 which similarly tells the interpretation method to convert the request into a :class:`magpie.models.Resource` reference.
 
-Whenever :term:`Effective Permissions` or :term:`ACL` needs to be resolved in order to determine if a
+Whenever :term:`Effective Permission` or :term:`ACL` needs to be resolved in order to determine if a
 :term:`Request User` can have access or not to a :term:`Resource`, `Magpie` will employ the appropriate :term:`Service`
 implementation and call the methods to process the result.
 
@@ -79,7 +80,7 @@ On top of the above methods, the following attributes must be defined.
         also provides details about :Term:`Allowed Permissions <Allowed Permission>`, their type and further nested
         children :term:`Resource`.
     * - :attr:`child_structure_allowed` |br| (``Dict[Type[ServiceOrResourceType], List[Type[models.Resource]]]``)
-      - Map of allowed :term:`Resource`type nesting hierarchy for the :term:`Service`.
+      - Map of allowed :term:`Resource` type nesting hierarchy for the :term:`Service`.
         This controls whether some children :term:`Resource` can be placed under another to limit creation only to
         cases that are relevant for the implemented :term:`Service`.
     * - :attr:`configurable` |br| (``bool``)
@@ -176,9 +177,9 @@ ServiceAPI
 The implementation of this :term:`Service` is handled by class :class:`magpie.services.ServiceAPI`. It refers to a
 remote URL endpoint that should have a :term:`Resource` tree formed out of the path segments. The :term:`Service` only
 has one (1) type of :term:`Resource`, namely :class:`magpie.models.Route`, that can have an unlimited amount of nested
-children of the same type. The :term:`Allowed Permissions` for this :term:`Service` are :attr:`Permission.READ` and
-:attr:`Permission.WRITE`. All requests using ``GET`` or ``HEAD`` are mapped to :attr:`Permission.READ` access while all
-other HTTP methods represent a :attr:`Permission.WRITE` access.
+children of the same type. The :term:`Allowed Permissions <Allowed Permission>` for this :term:`Service`
+are :attr:`Permission.READ` and :attr:`Permission.WRITE`. All requests using ``GET`` or ``HEAD`` are mapped
+to :attr:`Permission.READ` access while all other HTTP methods represent a :attr:`Permission.WRITE` access.
 
 Request path segments follow the natural hierarchy of the nested :class:`magpie.models.Route` under the :term:`Service`.
 For example, a proxy employing :class:`magpie.adapter.MagpieAdapter` such that ``{PROXY_URL}`` is the base of the
@@ -211,9 +212,9 @@ The implementation of this :term:`Service` is handled by class :class:`magpie.se
 remote data server named `Thematic Real-time Environmental Distributed Data Services` (`THREDDS`_). The :term:`Service`
 employs two (2) types of :term:`Resource`, namely :class:`magpie.models.Directory` and :class:`magpie.models.File`.
 All the directory resources can be nested any number of times, and files can only reside as leaves of the hierarchy,
-similarly to a traditional file system. The :term:`Allowed Permissions` on both the :term:`Service` itself or any of
-its children :term:`Resource` are :attr:`Permission.BROWSE`, :attr:`Permission.READ`, and :attr:`Permission.WRITE`
-(see note below regarding this last permission).
+similarly to a traditional file system. The :term:`Allowed Permissions <Allowed Permission>` on both the :term:`Service`
+itself or any of its children :term:`Resource` are :attr:`Permission.BROWSE`, :attr:`Permission.READ`, and
+:attr:`Permission.WRITE` (see note below regarding this last permission).
 
 .. versionadded:: 3.1
     The :attr:`Permission.BROWSE` permission is used to provide listing access of contents when targeting a
@@ -405,9 +406,8 @@ ServiceBaseWMS
 .. seealso::
 
     Derived implementations:
-
-    - `ServiceGeoserverWMS`_
-    - `ServiceNCWMS2`_
+    - :ref:`ServiceGeoserverWMS`
+    - :ref:`ServiceNCWMS2`
 
 This is a *partial base* class employed to represent :term:`OWS` `Web Map Service` extended via other complete classes.
 It cannot be employed directly as :term:`Service` instance. The derived classes provide different parsing methodologies
@@ -483,9 +483,9 @@ The implementation of this :term:`Service` is handled by class :class:`magpie.se
 control access to the operations provided by an :term:`OWS` `Web Processing Service`. This :term:`Service` allows
 one (1) type of child :term:`Resource`, namely the :class:`magpie.models.Process` which represent the execution units
 that are registered under a remote `WPS`. Every :class:`magpie.models.Process` cannot itself have a child
-:term:`Resource`, making `ServiceWPS`_ maximally a 2-tier level hierarchy.
+:term:`Resource`, making :ref:`ServiceWPS` maximally a 2-tier level hierarchy.
 
-There are three (3) types of :term:`Allowed Permissions` which each represent an operation that can be requested from it
+There are three (3) types of :term:`Allowed Permission` which each represent an operation that can be requested from it
 (via ``request`` query parameter value of the HTTP request), specifically the :attr:`Permission.GET_CAPABILITIES`,
 :attr:`Permission.DESCRIBE_PROCESS`, and :attr:`Permission.EXECUTE`. The :attr:`Permission.GET_CAPABILITIES`
 corresponds to the retrieval of available list of *Processes* on the `WPS` instance, and therefore, can only be applied
@@ -494,9 +494,9 @@ on individual :class:`magpie.models.Process` :term:`Resource` definitions. When
 :attr:`Scope.RECURSIVE` modifier, the corresponding :term:`Permission` becomes effective to all underlying *Processes*.
 Otherwise, the :term:`Permission` applied on specific :class:`magpie.models.Process` entries control the specific
 :term:`ACL` only for it. When a specific :term:`Permission` is involved on a :class:`magpie.models.Process` during
-:term:`Effective Permissions` resolution, the value of the query parameter ``identifier`` is employ to attempt mapping
-it against an existing :term:`Resource`. The resolution of :term:`Effective Permissions` in even of multi-level tree
-:term:`Resource` is computed in the usual manner described in the :ref:`Permissions` chapter.
+:term:`Effective Permission` resolution, the value of the query parameter ``identifier`` is employ to attempt mapping
+it against an existing :term:`Resource`. The resolution of :term:`Effective Permissions <Effective Permission>` in the
+event of multi-level tree :term:`Resource` is computed in the usual manner described in the :ref:`Permissions` chapter.
 
 
 .. warning::
@@ -540,7 +540,7 @@ ServiceGeoserver
     - :ref:`ServiceGeoserverWPS`
 
 This :term:`Service` is combined :term:`OWS` implementation for `GeoServer`_ that allows simultaneous representation of
-:term:`WFS`, :term:`WMS` and :term:`WPS` :term:`Resources <Resource> all nested under a single reference hosted under
+:term:`WFS`, :term:`WMS` and :term:`WPS` :term:`Resources <Resource>` all nested under a single reference hosted under
 common remote URL. Using this implementation, :class:`magpie.models.Workspace` are first required as immediate children
 under the root :term:`Service`, and can be followed by both :term:`Resources <Resource>` of type
 :class:`magpie.models.Layer` and :class:`magpie.models.Process`.
@@ -614,9 +614,9 @@ element.
 .. note::
     If only :attr:`Scope.RECURSIVE` :term:`Permission` are being applied on the :term:`Service` or their children
     :term:`Resource`, it is better to enter *fewer* children element in the tree to reduce computation time of
-    :term:`Effective Permissions`. The complete hierarchy should be employed only when the depth of the tree is
-    relatively shallow or that :attr:`Scope.MATCH` must be applied specifically for some :term:`Resource` to obtain
-    desired access behaviour.
+    :term:`Effective Permissions <Effective Permission>`. The complete hierarchy should be employed only when the depth
+    of the tree is relatively shallow or that :attr:`Scope.MATCH` must be applied specifically for some :term:`Resource`
+    to obtain desired access behaviour.
 
 When using the `Magpie` Docker image, the default command run the `magpie-cron`_ utility in parallel to the API. This
 cron job will periodically execute the :term:`Resource` auto-synchronization feature for a given :term:`Service` that
diff --git a/magpie/adapter/magpieowssecurity.py b/magpie/adapter/magpieowssecurity.py
index b68279219..aea9f00dc 100644
--- a/magpie/adapter/magpieowssecurity.py
+++ b/magpie/adapter/magpieowssecurity.py
@@ -175,7 +175,7 @@ def check_request(self, request):
         Otherwise, ignore request access validation.
 
         In the case `Twitcher` proxy path is matched, the :term:`Logged User` **MUST** be allowed access following
-        :term:`Effective Permissions` resolution via :term:`ACL`.
+        :term:`Effective Permissions <Effective Permission>` resolution via :term:`ACL`.
         Otherwise, :exception:`OWSAccessForbidden` is raised.
 
         Failing to parse the request or any underlying component that raises an exception will be left up to the
diff --git a/magpie/api/management/resource/resource_formats.py b/magpie/api/management/resource/resource_formats.py
index e0df1e540..c9b9d1a42 100644
--- a/magpie/api/management/resource/resource_formats.py
+++ b/magpie/api/management/resource/resource_formats.py
@@ -80,10 +80,11 @@ def format_resource_tree(children, db_session, resources_perms_dict=None, permis
     :param resources_perms_dict:
         Any pre-established :term:`Applied Permission` to set to corresponding resources by ID.
         When provided, these will define the :term:`User`, :term:`Group` or both
-        (i.e.: :term:`Inherited Permissions <inherited permission>`)
-        actual permissions, or even the :term:`Effective Permissions`, according to parent caller function's context.
-        Otherwise (``None``), defaults to extracting :term:`Allowed Permissions` for the given :term:`Resource` scoped
-        under the corresponding root :term:`Service`.
+        (i.e.: :term:`Inherited Permissions <Inherited Permission>`)
+        actual permissions, or even the :term:`Effective Permissions <Effective Permission>`, according to parent
+        caller function's context.
+        Otherwise (``None``), defaults to extracting :term:`Allowed Permissions <Allowed Permission>` for the given
+        :term:`Resource` scoped under the corresponding root :term:`Service`.
     :return: formatted resource tree
     """
     # optimization to avoid re-lookup of 'allowed permissions' when already fetched
diff --git a/magpie/api/management/service/service_formats.py b/magpie/api/management/service/service_formats.py
index d458c2149..b4ddfbf52 100644
--- a/magpie/api/management/service/service_formats.py
+++ b/magpie/api/management/service/service_formats.py
@@ -118,10 +118,11 @@ def format_service_resources(service,                       # type: Service
     :param db_session: database session
     :param service_perms:
         If provided, sets all :term:`Applied Permission` to display on the formatted :paramref:`service`.
-        Otherwise, sets the :term:`Allowed Permissions` specific to the :paramref:`service`'s type.
+        Otherwise, sets :term:`Allowed Permissions <Allowed Permission>` specific to the :paramref:`service`'s type.
     :param resources_perms_dict:
         If provided (not ``None``), set the :term:`Applied Permission` on each specified resource matched by ID.
-        If ``None``, retrieve and set :term:`Allowed Permissions` for the corresponding resources under the service.
+        If ``None``, retrieve and set :term:`Allowed Permissions <Allowed Permission>` for the corresponding
+        :term:`Resources <Resource>` under the :term:`Service`.
         To set empty :term:`Applied Permission` (e.g.: :term:`User` doesn't have permissions on that resource), provide
         an explicit empty dictionary instead.
     :param permission_type: Provide permission type being rendered.
diff --git a/magpie/api/management/user/user_utils.py b/magpie/api/management/user/user_utils.py
index fbc51d1d6..c3ca56e2e 100644
--- a/magpie/api/management/user/user_utils.py
+++ b/magpie/api/management/user/user_utils.py
@@ -571,10 +571,10 @@ def get_user_services(user, request, cascade_resources=False, format_as_list=Fal
         :term:`Inherited Permission` according to the value of :paramref:`inherit_groups_permissions`.
     :param inherit_groups_permissions:
         If ``False``, return only user-specific service/sub-resources :term:`Direct Permissions`.
-        Otherwise, resolve :term:`Inherited Permissions <inherited permission>` using all groups the user is member of.
+        Otherwise, resolve :term:`Inherited Permissions <Inherited Permission>` using all groups the user is member of.
     :param resolve_groups_permissions:
-        Whether to combine :term:`Direct Permissions <direct permission>` and
-        :term:`Inherited Permissions <inherited permission` for respective resources or not.
+        Whether to combine :term:`Direct Permissions <Direct Permission>` and
+        :term:`Inherited Permissions <Inherited Permission>` for respective resources or not.
     :param format_as_list:
         Returns as list of service dict information (not grouped by type and by name)
     :param service_types:
@@ -646,7 +646,7 @@ def get_user_service_permissions(user, service, request,
     Retrieve the permissions the user has directly on a service or inherited permissions by its group memberships.
 
     .. warning::
-        - Does not consider :term:`Effective Permissions` ownership.
+        - Does not consider :term:`Effective Permissions <Effective Permission>` ownership.
         - Considers direct :term:`Service` ownership, but not implemented everywhere (not operational).
 
     .. seealso::
@@ -682,7 +682,7 @@ def resolve_user_group_permissions(resource_permission_list):
     found for corresponding resource. In such case, only one entry is possible (it is invalid to have more than one
     combination of ``(User, Resource, Permission)``, including modifiers, as per validation during their creation).
 
-    Otherwise, for corresponding :term:`Inherited Permissions <inherited permission>`, resolve the prioritized
+    Otherwise, for corresponding :term:`Inherited Permissions <Inherited Permission>`, resolve the prioritized
     :term:`Permission` across every group.
     Similarly to users, :func:`magpie.groups.group_utils.get_similar_group_resource_permission` validate that only one
     combination of ``(Group, Resource, Permission)`` can exist including permission modifiers. Only, cross-group
@@ -693,10 +693,11 @@ def resolve_user_group_permissions(resource_permission_list):
            other more explicit group membership, regardless of permission modifiers applied on it.
         2. Permissions of same group priority with :attr:`Access.DENY` are prioritized over :attr:`Access.ALLOW`.
         3. Permissions of same group priority with :attr:`Scope.RECURSIVE` are prioritized over :attr:`Access.MATCH` as
-           they affect a larger range of resources when :term:`Effective Permissions` are eventually requested.
+           they affect a larger range of resources when :term:`Effective Permissions <Effective Permission>` are
+           eventually requested.
 
     .. note::
-        Resource tree inherited resolution is not considered here (no recursive :term:`Effective Permissions` computed).
+        Resource tree inherited resolution is not considered here (no recursive :term:`Effective Permission` computed).
         Only same-level scope of every given resource is processed independently. The intended behaviour here is
         therefore to help illustrate in responses *how deep* is a given permission going to have an impact onto
         lower-level resources, making :attr:`Scope.RECURSIVE` more important than specific instance :attr:`Scope.MATCH`.
@@ -732,8 +733,8 @@ def regroup_permissions_by_resource(resource_permissions, resolve=False):
     """
     Regroups multiple uncategorized permissions into a dictionary of corresponding resource IDs.
 
-    While regrouping the various permissions (both :term:`Direct Permissions <direct permission>` and any amount of
-    groups :term:`Inherited Permissions <inherited permission>`) under their respective resource by ID, optionally
+    While regrouping the various permissions (both :term:`Direct Permissions <Direct Permission>` and any amount of
+    groups :term:`Inherited Permissions <Inherited Permission>`) under their respective resource by ID, optionally
     resolve overlapping or conflicting permissions by name such that only one permission persists for that resource
     and name.
 
@@ -742,8 +743,8 @@ def regroup_permissions_by_resource(resource_permissions, resolve=False):
 
     :param resource_permissions:
         List of resource permissions to process.
-        Can include both user :term:`Direct Permissions <direct permission>` and its groups
-        :term:`Inherited Permissions <inherited permission>`.
+        Can include both user :term:`Direct Permissions <Direct Permission>` and its groups
+        :term:`Inherited Permissions <Inherited Permission>`.
     :param resolve:
         When ``False``, only mapping by resource ID is accomplished. Full listing of permissions is returned.
         Otherwise, resolves the corresponding resource permissions (by same ID) considering various priority rules to
@@ -788,7 +789,7 @@ def get_user_resources_permissions_dict(user, request, resource_types=None, reso
     :param resolve_groups_permissions: whether to combine corresponding user/group permissions into one or not.
     :return:
         Only resources which the user has permissions on, or including all
-        :term:`Inherited Permissions <inherited permission>`, according to
+        :term:`Inherited Permissions <Inherited Permission>`, according to
         :paramref:`inherit_groups_permissions` argument.
     """
     ax.verify_param(user, not_none=True, http_error=HTTPNotFound,
@@ -809,7 +810,7 @@ def get_user_service_resources_permissions_dict(user, service, request,
     Retrieves all permissions the user has for every :term:`Resource` nested under the :term:`Service`.
 
     The retrieved permissions can either include only :term:`Direct Permissions` or a combination of user and group
-    :term:`Inherited Permissions <inherited permission>` accordingly to provided options.
+    :term:`Inherited Permissions <Inherited Permission>` accordingly to provided options.
 
     .. seealso::
         :func:`get_user_resources_permissions_dict`
diff --git a/magpie/permissions.py b/magpie/permissions.py
index 046e5d8e0..497a48a27 100644
--- a/magpie/permissions.py
+++ b/magpie/permissions.py
@@ -96,13 +96,13 @@ class PermissionSet(object):
 
     The :class:`Permission` is the *name* of the applicable permission on the :class:`magpie.models.Resource`.
     The :class:`Scope` defines how the :class:`Permission` should impact the resolution of the perceived
-    :term:`Effective Permissions` over a :class:`magpie.models.Resource` tree hierarchy.
+    :term:`Effective Permissions <Effective Permission>` over a :class:`magpie.models.Resource` tree hierarchy.
     The :class:`Access` defines how the :class:`Permission` access should be interpreted (granted or denied).
 
     Optionally, a :class:`PermissionType` can be provided to specifically indicate which kind of permission this set
     represents. This type is only for informative purposes, and is not saved to database nor displayed by the explicit
     string representation. It is returned within JSON representation and can be employed by
-    :term:`Effective Permissions` resolution to be more verbose about returned results.
+    :term:`Effective Permissions <Effective Permission>` resolution to be more verbose about returned results.
 
     On missing :class:`Access` or :class:`Scope` specifications, they default to :attr:`Access.ALLOW` and
     :attr:`Scope.RECURSIVE` to handle backward compatible naming convention of plain ``permission_name``.
@@ -334,7 +334,7 @@ def resolve(cls,
 
         Permissions **MUST** have the same :term:`Permission` name.
         The associated :term:`Resource` on which the two compared permissions are applied on should also be the same
-        This method **SHOULD NOT** be used by itself to obtain for :term:`Effective Permissions` since it does not
+        This method **SHOULD NOT** be used by itself to obtain for :term:`Effective Permission` since it does not
         handle multi-level :term:`Resource` resolution. Resolution is accomplished in this case only for a given level
         in the tree hierarchy.
 
diff --git a/magpie/services.py b/magpie/services.py
index bbf77f429..76d8d3a0d 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -508,8 +508,8 @@ def effective_permissions(self, user, resource, permissions=None, allow_match=Tr
         permissions can be immediately resolved such as when more restrictive conditions enforce denied access.
 
         Both user and group permission inheritance is resolved simultaneously to tree hierarchy with corresponding
-        allow and deny conditions. User :term:`Direct Permissions <direct permission>` have priority over all its groups
-        :term:`Inherited Permissions <inherited permission>`, and denied permissions have priority over allowed access
+        allow and deny conditions. User :term:`Direct Permissions <Direct Permission>` have priority over all its groups
+        :term:`Inherited Permissions <Inherited Permission>`, and denied permissions have priority over allowed access
         ones.
 
         All applicable permissions on the resource (as defined by :meth:`allowed_permissions`) will have their
diff --git a/magpie/ui/management/views.py b/magpie/ui/management/views.py
index 566f1d16f..bd203a4d0 100644
--- a/magpie/ui/management/views.py
+++ b/magpie/ui/management/views.py
@@ -498,10 +498,11 @@ def get_user_or_group_resources_permissions_dict(self, user_or_group_name, servi
         Get the user or group applied permissions as well as applicable permissions for corresponding services.
 
         Result is a :class:`tuple` of:
-            - combined :term:`Allowed Permissions` (*names only*) for services and their children resources.
+            - combined :term:`Allowed Permissions <Applied Permission>` (*names only*) for services and their children
+              :term:`Resources <Resource>`.
             - dictionary of key-service-name, each with recursive map value of children resource details including
-              the :term:`Applied Permissions <Applied Permission>` or :term:`Inherited Resources` for the corresponding :term:`User`
-              or :term:`Group` accordingly to specified arguments.
+              the :term:`Applied Permissions <Applied Permission>` or :term:`Inherited Resources` for the corresponding
+              :term:`User` or :term:`Group` accordingly to specified arguments.
         """
         if is_user:
             # because page can only show a single permission (per name/resource) at a time, apply resolution
diff --git a/requirements-doc.txt b/requirements-doc.txt
index bf096043a..8e4465b3a 100644
--- a/requirements-doc.txt
+++ b/requirements-doc.txt
@@ -1,6 +1,7 @@
 # these are doc-only requirements
 # we actually need to install all requirements during docs build because of OpenAPI generation
 # (see 'docs/conf.py')
+cloud_sptheme
 pycodestyle==2.6.0; python_version >= "3.6"
 # sphinx-autoapi dropped 3.5 support at 1.3.0
 # latest to fullfil requirements, but that is not the main doc builder version
diff --git a/tests/interfaces.py b/tests/interfaces.py
index fdcb03527..837fe07d3 100644
--- a/tests/interfaces.py
+++ b/tests/interfaces.py
@@ -2555,8 +2555,8 @@ def test_GetUserResourcePermissions_PermissionsHierarchyResolution(self):
                     child-resource      <-- 2nd permission applied
 
         For each combination, there is always only one :term:`Applied Permission` for a user or group per resource in
-        the hierarchy. This makes :term:`Inherited Permissions <inherited permission>` and
-        :term:`Resolved Permissions <inherited permission>` field ``reasons`` much
+        the hierarchy. This makes :term:`Inherited Permissions <Inherited Permission>` and
+        :term:`Resolved Permissions <Inherited Permission>` field ``reasons`` much
         easier to validate as there are no intra-resource (same) permission resolution, only inter-resource (distinct)
         permission inheritance according to local-level priorities, making ``reason`` always single-entry.
         These are highlighted by the corresponding arrow comments in the code.
@@ -2721,7 +2721,7 @@ def test_GetUserResourcePermissions_PermissionsHierarchyResolution(self):
     @runner.MAGPIE_TEST_FUNCTIONAL
     def test_GetUserResourcePermissions_EffectivePermissions_ScopedHierarchyResolution(self):
         """
-        Validates that :term:`Effective Permissions` resolution works when scoped subsets of :term:`Resource` have
+        Validates that :term:`Effective Permission` resolution works when scoped subsets of :term:`Resource` have
         alternating :term:`Applied Permissions` with opposite :class:`Access` modifiers.
 
         The resolution of permissions should consider the *closest* scope to the targeted :term:`Resource`, but still
@@ -3738,8 +3738,8 @@ def test_GetUserServices_Inherited(self):
 
         .. warning::
             Group inheritance query parameter existed before ``2.0.0``, but was not producing the correct result
-            for children resources permissions (all :term:`Allowed Permissions` were returned instead of
-            user/group-specific :term:`Applied Permissions`).
+            for children resources permissions (every :term:`Allowed Permission` was returned instead of
+            user/group-specific :term:`Applied Permissions <Applied Permission>`).
         """
         utils.warn_version(self, "user service inheritance", "2.0.0", skip=True)
         resp = utils.test_request(self, "GET", "/services", headers=self.json_headers, cookies=self.cookies)
@@ -3788,8 +3788,8 @@ def test_GetUserServices_CascadeAndInherited(self):
 
         .. warning::
             Group inheritance query parameter existed before ``2.0.0``, but was not producing the correct result
-            for children resources permissions (all :term:`Allowed Permissions` were returned instead of
-            user/group-specific :term:`Applied Permissions`).
+            for children resources permissions (every :term:`Allowed Permission` was returned instead of
+            user/group-specific :term:`Applied Permissions <Applied Permission>`).
         """
         utils.warn_version(self, "user service inheritance", "2.0.0", skip=True)
         resp = utils.test_request(self, "GET", "/services", headers=self.json_headers, cookies=self.cookies)
diff --git a/tests/test_services.py b/tests/test_services.py
index 9eebacf58..2211fbc96 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -197,8 +197,8 @@ def test_ServiceAPI_effective_permissions(self):
 
         .. versionchanged:: 3.5
             User and Group permissions for ``Resource1`` and ``Resource2`` have been swapped since new priorities make
-            :term:`Direct Permissions <direct permission>` more important than
-            :term:`Inherited Permissions <inherited permission>`. The :attr:`Access.DENY` was not being reverted with
+            :term:`Direct Permissions <Direct Permission>` more important than
+            :term:`Inherited Permissions <Inherited Permission>`. The :attr:`Access.DENY` was not being reverted with
             original definitions that assumed them to be of equal importance, and therefore plain ``DENY > ALLOW`` was
             working. Permission on ``Resource4`` was moved from Group to User for the same reason.
         """
@@ -342,7 +342,7 @@ def test_ServiceTHREDDS_effective_permissions(self):
 
         .. versionchanged:: 3.5
             User and Group permissions for ``Directory1`` and ``Directory2`` have been swapped since new priorities make
-            :term:`Direct Permissions` more important than :term:`Inherited Permissions <inherited permission>`.
+            :term:`Direct Permissions` more important than :term:`Inherited Permissions <Inherited Permission>`.
             The :attr:`Access.DENY` was not being reverted with original definitions that assumed them to be of equal
             importance, and therefore plain ``DENY > ALLOW`` was working.
         """

From 40dab93258cc3d4484ee94a3c4fcba16b3c1ab59 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 25 Jan 2022 16:15:11 -0500
Subject: [PATCH 31/34] fixes and test geoserver multi-layer (comma-separated)
 ACL resolution

---
 CHANGES.rst            |   2 +-
 magpie/services.py     | 269 ++++++++++++++++++++++++-----------------
 magpie/utils.py        |  14 +++
 tests/test_services.py |  59 ++++++++-
 tests/utils.py         |   6 +-
 5 files changed, 232 insertions(+), 118 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 0893e0c62..002dc36f1 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -38,7 +38,7 @@ Features / Changes
 * Add ``child_structure_allowed`` to ``ServiceAPI`` and ``ServiceTHREDDS`` to be more explicit about allowed structure
   hierarchies in API responses. Their original behaviour remains unchanged, but is further enforced during validation
   of their children resource type creation against explicit structure.
-* Add multiple ``Resource`` ACL resolution within the same request to support ``Service`` implementations that can refer
+* Add multi-``Resource`` ACL resolution within the same request to support ``Service`` implementations that can refer
   to multiple items simultaneously. An example of this is the comma-separated list of ``Layer`` defined by ``typeNames``
   of new ``ServiceGeoserverWMS`` implementation. Access is granted if the ``User`` has access to **ALL** ``Resource``
   resolved from parsing the request.
diff --git a/magpie/services.py b/magpie/services.py
index 76d8d3a0d..f8c3ce635 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -27,7 +27,7 @@
     PermissionType,
     Scope
 )
-from magpie.utils import fully_qualified_name, get_logger
+from magpie.utils import classproperty, fully_qualified_name, get_logger
 
 LOGGER = get_logger(__name__)
 if TYPE_CHECKING:
@@ -348,27 +348,23 @@ def _get_acl(self, user, resources, permissions):
               for individual :class:`ServiceInterface` implementations.
         """
         # avoid useless effective resolution re-computation if duplicates are found
-        target_resources = list(set(resources))
-        effective_perms = {}  # type: Dict[Permission, PermissionSet]
+        target_resources = list(dict.fromkeys(resources))  # set(), but preserving order
         allowed_ace = []
-        for resource, allow_match in target_resources:
+        for resource, is_target in target_resources:
 
-            # only 1 entry per 'permission name' possible after effective resolution for that resource
-            res_access_perms = self.effective_permissions(user, resource, permissions, allow_match)
+            # only 1 entry per (permission-name, resource) possible after effective resolution for each resource
+            # since distinct resources are being processed, user/group precedence and group priority doesn't matter
+            # resulting Allow/Deny for each case is the "highest priority" for each applicable resource individually
+            res_access_perms = self.effective_permissions(user, resource, permissions, is_target)
             for perm in res_access_perms:
-                if perm.name not in effective_perms:
-                    effective_perms[perm.name] = perm
-                else:
-                    other_perm = effective_perms[perm.name]
-                    effect_perm = PermissionSet.resolve(perm, other_perm, context=PermissionType.EFFECTIVE)
-                    effective_perms[perm.name] = effect_perm
-
-                # if any resource or any permission indicates deny, break out to avoid useless computation
-                cur_perm = effective_perms[perm.name]
-                if cur_perm.access == Access.DENY:
-                    return [cur_perm.ace(self.request.user)]
+                # if any resource or any permission indicates deny,
+                # break out to avoid useless computation (block all)
+                if perm.access == Access.DENY:
+                    return [perm.ace(self.request.user)]
+                allowed_ace.append(perm.ace(self.request.user))
 
-            allowed_ace.extend([perm.ace(self.request.user) for perm in effective_perms.values()])
+        if not allowed_ace:
+            return [DENY_ALL]
         return allowed_ace
 
     def _get_connected_object(self, obj):
@@ -497,8 +493,12 @@ def allowed_permissions(self, resource):
             return self.permissions
         return self.get_resource_permissions(resource.resource_type)
 
-    def effective_permissions(self, user, resource, permissions=None, allow_match=True):
-        # type: (models.User, ServiceOrResourceType, Optional[Collection[Permission]], bool) -> List[PermissionSet]
+    def effective_permissions(self,
+                              user,                     # type: models.User
+                              resource,                 # type: ServiceOrResourceType
+                              permissions=None,         # type: Optional[Collection[Permission]]
+                              allow_match=True,         # type: bool
+                              ):                        # type: (...) -> List[PermissionSet]
         """
         Obtains the :term:`Effective Resolution` of permissions the user has over the specified resource.
 
@@ -523,6 +523,12 @@ def effective_permissions(self, user, resource, permissions=None, allow_match=Tr
 
         .. seealso::
             - :meth:`ServiceInterface.resource_requested`
+
+        :param user: :term:`User` for which to perform :term:`Effective Resolution`.
+        :param resource: :term:`Resource` onto which access must be resolved.
+        :param permissions: List of :term:`Permission` for which to perform the resolution.
+        :param allow_match: Indicate if the specific :term:`Resource` was matched to allow :data:`Scope.MATCH` handling.
+        :returns: Resolved set :term:`Effective Permission` for specified parameter combinations.
         """
         if not permissions:
             permissions = self.allowed_permissions(resource)
@@ -907,24 +913,31 @@ class ServiceGeoserverBase(ServiceOWS):
     Provides basic configuration parameters and functionalities shared by `Geoserver` implementations.
     """
 
-    @property
+    @classmethod
+    @classproperty
     @abc.abstractmethod
-    def resource_scoped(self):
+    def resource_scoped(cls):
         # type: () -> bool
         """
         Indicates if the :term:`Service` is allowed to employ scoped :class:`models.Workspace` naming.
 
         When allowed, the :class:`models.Workspace` can be inferred from the request parameter
         defined by :attr:`resource_param` to retrieve scoped name as ``<WORKSPACE>:<RESOURCE>``.
-        When not allowed, the resource name is left untouched `Magpie` will not attempt to infer
-        any :class:`models.Workspace` from it. The :class:`models.Workspace` can only be specified
+        When not allowed, the resource name is left untouched and `Magpie` will not attempt to infer
+        any :class:`models.Workspace` from it. In that case, :class:`models.Workspace` can only be specified
         in the request path for isolated :term:`Resource` references.
+
+        .. note::
+            When this parameter is ``False`` for a given :term:`Service` implementation, children
+            :term:`Resources <Resource>` can still be named in a similar ``<namespace>:<element>`` fashion.
+            The only distinction is that the **full** :term:`Resource` should include this complete definition
+            instead of nesting ``<namespace>`` and ``<element>`` into two distinct :term:`Resources <Resource>`.
         """
         raise NotImplementedError
 
-    @property
+    @classproperty
     @abc.abstractmethod
-    def resource_multi(self):
+    def resource_multi(cls):  # noqa
         # type: () -> bool
         """
         Indicates if the :term:`Service` supports multiple simultaneous :term:`Resource` references.
@@ -939,9 +952,9 @@ def resource_multi(self):
         """
         raise NotImplementedError
 
-    @property
+    @classproperty
     @abc.abstractmethod
-    def resource_param(self):
+    def resource_param(cls):  # noqa
         # type: () -> Union[Str, List[Str]]
         """
         Name of the request query parameter(s) to access requested leaf children resource.
@@ -958,29 +971,29 @@ def resource_param(self):
         """
         raise NotImplementedError
 
-    @property
+    @classproperty
     @abc.abstractmethod
-    def resource_types_permissions(self):
+    def resource_types_permissions(cls):  # noqa
         # type: () -> ResourceTypePermissions
         """
         Explicit permissions provided for resources for a given :term:`OWS` implementation.
         """
         raise NotImplementedError
 
-    @property
-    def params_expected(self):
+    @classproperty
+    def params_expected(cls):  # noqa
         # type: () -> List[Str]
         """
         Specify typical `Geoserver` request query parameters expected for any sub-service implementation.
 
         The :attr:`resource_param` is also added to ensure it is always parsed based on the derived implementation.
         """
-        if isinstance(self.resource_param, six.string_types):
-            impl_params = [self.resource_param]
-        elif isinstance(self.resource_param, list):
-            impl_params = self.resource_param
+        if isinstance(cls.resource_param, six.string_types):
+            impl_params = [cls.resource_param]
+        elif isinstance(cls.resource_param, list):
+            impl_params = cls.resource_param
         else:
-            name = fully_qualified_name(self)
+            name = fully_qualified_name(cls)
             raise NotImplementedError(f"Missing or invalid definition of 'resource_param' in service: {name}")
         base_params = [
             "request",
@@ -1051,6 +1064,8 @@ def resource_requested(self):
         matched_resources = []
         session = get_connected_session(self.request)
         for res_name in self.resource_param_requested():
+            if not res_name:
+                continue
             workspace_isolated = None  # reset for next layer
 
             # if missing, consider layer name as not scoped under workspace
@@ -1060,17 +1075,22 @@ def resource_requested(self):
                     # workspace only in scoped layer parameter
                     workspace_isolated = workspace_scope
                 elif workspace_name != workspace_scope:
-                    # In case the request was formed with both workspace in path and scoped layer name,
+                    # In case the request was formed with both workspace in path and scoped resource name,
                     # consider the workspace as not resolved since we cannot know which one to target.
                     # This avoids erroneously granting access to restricted layer from another workspace by
                     # forging a request that would include some workspace for which the user does have access.
-                    workspace_isolated = None
+                    return [(self.service, False)]
                 else:
                     # workspace only in path, layer not scoped
                     workspace_isolated = workspace_name
 
+            # never split if service doesn't support resource scoping
+            # therefore, workspace can only be provided by path
+            # do the same if scoping is supported but no scope was specified (directly the resource in param)
+            elif not self.resource_scoped or ":" not in res_name:
+                workspace_isolated = workspace_name
+
             if not workspace_isolated:
-                matched_resources.append((self.service, False))
                 continue
             workspace = models.find_children_by_name(child_name=workspace_isolated,
                                                      parent_id=self.service.resource_id,
@@ -1089,10 +1109,21 @@ def resource_requested(self):
                 continue
             matched_resources.append((self.service, False))
 
+        # if no children resource where matched, check if the Workspace was provided in the path
+        # in such case, a match would provide a closer resource scope, but assume its not a match
+        # since other operation than already handled 'GetCapabilities' all involve resources under Workspace
+        if not matched_resources and workspace_name:
+            workspace = models.find_children_by_name(child_name=workspace_name,
+                                                     parent_id=self.service.resource_id,
+                                                     db_session=session)
+            if workspace:
+                return [(workspace, False)]
+        if not matched_resources:
+            return [(self.service, False)]
         return matched_resources
 
 
-class ServiceGeoserverWMS(ServiceBaseWMS, ServiceGeoserverBase):
+class ServiceGeoserverWMS(ServiceGeoserverBase, ServiceBaseWMS):  # order important to call overridden class properties
     """
     Service that represents a ``Web Map Service`` endpoint with functionalities specific to ``GeoServer``.
 
@@ -1129,10 +1160,6 @@ class ServiceGeoserverWMS(ServiceBaseWMS, ServiceGeoserverBase):
         models.Layer: permissions,
     }
 
-    def resource_requested(self):
-        # type: () -> MultiResourceRequested
-        return ServiceGeoserverBase.resource_requested(self)
-
 
 class ServiceAccess(ServiceInterface):
     service_type = "access"
@@ -1253,7 +1280,7 @@ def resource_requested(self):
         return self.service, True   # no children resource, so can only be the service
 
 
-class ServiceGeoserverWFS(ServiceWFS, ServiceGeoserverBase):
+class ServiceGeoserverWFS(ServiceGeoserverBase, ServiceWFS):  # order important to call overridden class properties
     """
     Service that represents a ``Web Feature Service`` endpoint with functionalities specific to ``GeoServer``.
 
@@ -1286,10 +1313,6 @@ class ServiceGeoserverWFS(ServiceWFS, ServiceGeoserverBase):
         models.Layer: [],
     }
 
-    def resource_requested(self):
-        # type: () -> MultiResourceRequested
-        return ServiceGeoserverBase.resource_requested(self)
-
 
 class ServiceTHREDDS(ServiceInterface):
     """
@@ -1410,7 +1433,7 @@ def permission_requested(self):
         return None  # automatically deny
 
 
-class ServiceGeoserverWPS(ServiceWPS, ServiceGeoserverBase):
+class ServiceGeoserverWPS(ServiceGeoserverBase, ServiceWPS):  # order important to call overridden class properties
     """
     Service that represents a ``Web Processing Service`` under a `Geoserver` instance.
     """
@@ -1432,73 +1455,29 @@ class ServiceGeoserverWPS(ServiceWPS, ServiceGeoserverBase):
         models.Layer: [],
     }
 
-    def resource_requested(self):
-        # type: () -> MultiResourceRequested
-        return ServiceGeoserverBase.resource_requested(self)
-
-
-class ServiceGeoserverMeta(ServiceMeta):
-    """
-    Mapping and grouping of property definitions for `GeoServer` services from distinct :term:`OWS` implementations.
-    """
-    service_map = {
-        "wfs": ServiceGeoserverWFS,
-        "wms": ServiceGeoserverWMS,
-        "wps": ServiceGeoserverWPS,
-    }
-
-    @property
-    def params_expected(cls):
-        # type: () -> List[Str]
-        params = set()
-        for svc in cls.supported_ows:  # pylint: disable=E1133,not-an-iterable
-            if issubclass(svc, ServiceOWS) and hasattr(svc, "params_expected"):
-                params.update(svc.params_expected)
-        return list(params)
-
-    @property
-    def permissions(cls):
-        # type: () -> List[Permission]
-        perms = set()
-        for svc in cls.supported_ows:  # pylint: disable=E1133,not-an-iterable
-            if issubclass(svc, ServiceOWS) and hasattr(svc, "permissions"):
-                perms.update(svc.permissions)
-        return list(perms)
-
-    @property
-    def resource_types_permissions(cls):
-        # type: () -> ResourceTypePermissions
-        perms = {}  # type: ResourceTypePermissions
-        for svc in cls.supported_ows:  # pylint: disable=E1133,not-an-iterable
-            if issubclass(svc, ServiceOWS) and hasattr(svc, "resource_types_permissions"):
-                svc_res_perms = svc.resource_types_permissions
-                for res_type, res_perms in svc_res_perms.items():
-                    if res_type in perms:
-                        perms[res_type] = list(set(perms[res_type]) | set(res_perms))
-                    else:
-                        perms[res_type] = list(res_perms)
-        return perms
-
-    @property
-    def supported_ows(cls):
-        # type: () -> Set[Type[ServiceOWS]]
-        return set(cls.service_map.values())
-
 
-@six.add_metaclass(ServiceGeoserverMeta)
-class ServiceGeoserver(ServiceOWS):
+class ServiceGeoserver(ServiceGeoserverBase):
     """
     Service that encapsulates the multiple :term:`OWS` endpoints from `GeoServer` services.
 
     .. seealso::
         https://docs.geoserver.org/stable/en/user/services/index.html
     """
-    service_base = None  # use ServiceGeoserverMeta.service_map
+    service_base = None  # use 'service_map' and 'service_ows'
     service_type = "geoserver"
+    service_map = {
+        ServiceGeoserverWFS.service_base: ServiceGeoserverWFS,
+        ServiceGeoserverWMS.service_base: ServiceGeoserverWMS,
+        ServiceGeoserverWPS.service_base: ServiceGeoserverWPS,
+    }
+
+    @classproperty
+    def service_ows_supported(cls):  # noqa
+        # type: () -> Set[Type[ServiceOWS]]
+        return set(cls.service_map.values())
 
     # only allow workspace directly under service
     # then, only layer or process under that workspace
-
     child_structure_allowed = {
         models.Service: [models.Workspace],
         models.Workspace: [models.Layer, models.Process],
@@ -1537,11 +1516,60 @@ def get_config(self):
         self._config = {key: self._config[key] for key in sorted(self._config)}
         return self._config
 
+    @classproperty
+    def params_expected(cls):  # noqa
+        # type: () -> List[Str]
+        params = set()
+        for svc in cls.service_ows_supported:
+            if issubclass(svc, ServiceOWS):
+                param_names = getattr(svc, "params_expected", None)
+                if param_names:
+                    params.update(param_names)
+        return list(params)
+
+    @classproperty
+    def permissions(cls):  # noqa
+        # type: () -> List[Permission]
+        perms = set()
+        for svc in cls.service_ows_supported:
+            if issubclass(svc, ServiceOWS):
+                svc_perms = getattr(svc, "permissions", None)
+                if svc_perms:
+                    perms.update(svc.permissions)
+        return list(perms)
+
+    @classproperty
+    def resource_types_permissions(cls):  # noqa
+        # type: () -> ResourceTypePermissions
+        perms = {}  # type: ResourceTypePermissions
+        for svc in cls.service_ows_supported:
+            if issubclass(svc, ServiceOWS):
+                svc_res_perms = getattr(svc, "resource_types_permissions", None)
+                if svc_res_perms:
+                    for res_type, res_perms in svc_res_perms.items():
+                        if res_type in perms:
+                            perms[res_type] = list(set(perms[res_type]) | set(res_perms))
+                        else:
+                            perms[res_type] = list(res_perms)
+        return perms
+
+    def __init__(self, service, request):
+        # type: (models.Service, Optional[Request]) -> None
+        self._service_requested = None  # cache computed requested service to avoid loop for each property
+        super(ServiceGeoserver, self).__init__(service, request)
+
+    def _set_request(self, request):
+        # type: (Request) -> None
+        self._service_requested = None  # reset to make sure any path change finds the new applicable service
+        super(ServiceGeoserver, self)._set_request(request)
+
     def service_requested(self):
-        # type: () -> Optional[Type[ServiceOWS]]
+        # type: () -> Optional[Type[ServiceGeoserverBase]]
         """
         Obtain the applicable :term:`OWS` implementation according to parsed request parameters.
         """
+        if self._service_requested:
+            return self._service_requested
         # guaranteed to exist and lowercase string if provided, otherwise None
         svc = self.parser.params["service"]
         req = self.parser.params["request"]
@@ -1550,14 +1578,34 @@ def service_requested(self):
             # since all OWS services are accessed using '/geoserver/<SERVICE>?request=...'
             # attempt to match using applicable path fragment
             svc_path = self.request.path.rsplit("/", 1)[-1].lower()
-            for svc_ows in type(self).supported_ows:
+            for svc_ows in type(self).service_ows_supported:
                 if svc_path == svc_ows.service_base:
                     svc = svc_ows.service_base
                     break
         config = self.get_config()
         if svc not in config or not config[svc]:
+            self._service_requested = None
             return None
-        return type(self).service_map[svc]
+        self._service_requested = type(self).service_map[svc]
+        return self._service_requested
+
+    @classproperty
+    def resource_scoped(cls):  # noqa
+        # type: () -> bool
+        svc = cls.service_requested()
+        return svc.resource_scoped if svc else False
+
+    @classproperty
+    def resource_multi(cls):  # noqa
+        # type: () -> bool
+        svc = cls.service_requested()
+        return svc.resource_multi if svc else False
+
+    @classproperty
+    def resource_param(cls):  # noqa
+        # type: () -> Union[Str, List[Str]]
+        svc = cls.service_requested()
+        return cls.resource_param if svc else []
 
     def resource_requested(self):
         # type: () -> MultiResourceRequested
@@ -1580,6 +1628,7 @@ def permission_requested(self):
     ServiceGeoserver,
     ServiceGeoserverWFS,
     ServiceGeoserverWMS,
+    ServiceGeoserverWPS,
     ServiceNCWMS2,
     ServiceTHREDDS,
     ServiceWFS,
diff --git a/magpie/utils.py b/magpie/utils.py
index 6cc22f1e3..5f946f645 100644
--- a/magpie/utils.py
+++ b/magpie/utils.py
@@ -997,3 +997,17 @@ def __call__(cls, *args, **kwargs):
         if cls not in cls._instances:
             cls._instances[cls] = super(SingletonMeta, cls).__call__(*args, **kwargs)
         return cls._instances[cls]
+
+
+class classproperty(property):
+    """
+    Mimics :class:`property` decorator, but applied onto ``classmethod`` in backward compatible way.
+
+    .. note::
+        This decorator purposely only supports getter attribute to define unmodifiable class properties.
+
+    .. seealso::
+        https://stackoverflow.com/a/5191224
+    """
+    def __get__(self, cls, owner):  # noqa
+        return classmethod(self.fget).__get__(None, owner)()
diff --git a/tests/test_services.py b/tests/test_services.py
index 2211fbc96..c25454773 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -1169,13 +1169,18 @@ def _test(_path, _params, allow):
 
         # Layer1, mismatched OWS path/param
         #   - When <WORKSPACE> is not directly in the path, because query parameters to extract <WORKSPACE>:<LAYER>
-        #     mismatch the expected OWS service from the path, resolved requested resource is the service itself.
+        #     mismatch the expected OWS service from the path (not 'layers' for WFS, not 'typeNames' for WMS),
+        #     the closest resolved requested resource is the service itself.
         #     That service does not have the requested permissions (directly on it), so access is forbidden.
-        #   - When <WORKSPACE> is directly in the path, the requested resource can be resolved more precisely as the
-        #     Workspace instead of the top-level service. Because GetFeature is applied recursively on Workspace,
-        #     access is granted even if request is erroneous to retrieve its appropriate Layer resource. The OWS
-        #     would still normally respond with bad request since the wrong request parameter is provided for that
-        #     OWS. The request remains invalid even if accessible, but Magpie/Twitcher job is over at that point.
+        #   - When <WORKSPACE> is directly in the path for WFS, the requested resource can be resolved more precisely
+        #     as the Workspace instead of the top-level service.
+        #   - For allowed WFS test cases with <WORKSPACE> in path, because 'GetFeature' is applied recursively on
+        #     Workspace, access is granted even if the request parameter is erroneous to retrieve its appropriate Layer
+        #     resource. Since wrong parameter is used, Magpie does validate the path parameter against the scoped
+        #     Workspace name. The actual OWS should still normally respond with bad request since the wrong request
+        #     parameter (bad 'layers' instead of WFS 'typeNames') is provided for that OWS. The request remains invalid
+        #     even if
+        #     accessible, but Magpie/Twitcher job is over at that point.
         #   - When OWS is WMS, GetFeature does not apply. Therefore, access refused.
         _test(svc_wms_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1}, allow=False)
         _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=False)
@@ -1291,6 +1296,48 @@ def _test(_path, _params, allow):
         _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l4}, allow=False)
         _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l4_name}, allow=False)
 
+        # using either the 'typename' or 'typenames' parameter lets WFS retrieve layers indistinguishably
+        alt_name = "typeName"
+        def_name = "typeNames"
+
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, alt_name: w1_l1}, allow=True)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, alt_name: w1_l2}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, alt_name: w1_name}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, alt_name: w1_l2}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, alt_name: w1_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, alt_name: wx_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, alt_name: w1_l2}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, alt_name: w1_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, alt_name: wx_l1}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, alt_name: w1_l2}, allow=False)
+
+        def _add_both(value):
+            return {alt_name: value, def_name: value}
+
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, **_add_both(w1_l1)}, allow=True)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, **_add_both(w1_l2)}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, **_add_both(w1_name)}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, **_add_both(w1_l2)}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, **_add_both(w1_l1)}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, **_add_both(wx_l1)}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, **_add_both(w1_l2)}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, **_add_both(w1_l1)}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, **_add_both(wx_l1)}, allow=False)
+        _test(w1_wfs_path, {"request": Permission.GET_FEATURE_INFO.title, **_add_both(w1_l2)}, allow=False)
+
+        # using multiple layers at the same time should validate all of them (all or nothing access)
+        # order should not matter
+        w1_l1_w1_l1 = ",".join([w1_l1, w1_l1])  # resolved as duplicate, only processed once, allowed
+        w1_l1_w1_l2 = ",".join([w1_l1, w1_l2])  # W1-L1 is allowed, but not W1-L2, so both denied
+        w1_l1_w1_l3 = ",".join([w1_l1, w1_l3])  # both are allowed, so full request allowed as well
+        w1_l2_w1_l1 = ",".join([w1_l2, w1_l1])
+        w1_l3_w1_l1 = ",".join([w1_l3, w1_l1])
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1_w1_l1}, allow=True)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1_w1_l2}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1_w1_l3}, allow=True)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l2_w1_l1}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l3_w1_l1}, allow=True)
+
 
 @runner.MAGPIE_TEST_LOCAL
 @runner.MAGPIE_TEST_SERVICES
diff --git a/tests/utils.py b/tests/utils.py
index ea47694f1..e459621c7 100644
--- a/tests/utils.py
+++ b/tests/utils.py
@@ -966,22 +966,26 @@ def test_request(test_item,             # type: AnyMagpieTestItemType
             kwargs["expect_errors"] = True
         err_code = None
         err_msg = None
+        err_exc = None
         try:
             resp = app_or_url._gen_request(method, path, **kwargs)  # pylint: disable=W0212  # noqa: W0212
         except AppError as exc:
             err_code = exc
             err_msg = str(exc)
+            err_exc = exc
         except HTTPException as exc:
             err_code = exc.status_code
             err_msg = str(exc) + str(getattr(exc, "exception", ""))
+            err_exc = exc
         except Exception as exc:
             err_code = 500
             err_msg = "Unknown: {!s}".format(exc)
+            err_exc = exc
         finally:
             if err_code:
                 info = json_msg({"path": path, "method": method, "body": _body, "headers": kwargs["headers"]})
                 result = "Request raised unexpected error: {!s}\nError: {}\nRequest:\n{}"
-                raise AssertionError(result.format(err_code, err_msg, info))
+                six.raise_from(AssertionError(result.format(err_code, err_msg, info)), err_exc)
 
         # automatically follow the redirect if any and evaluate its response
         max_redirect = kwargs.get("max_redirects", 5)

From 6304983711bd6e360b5f6661664e5da1ec95a30e Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 25 Jan 2022 17:52:26 -0500
Subject: [PATCH 32/34] add large matrix of geoserver workspace/layer test
 combinations

---
 tests/test_services.py | 194 ++++++++++++++++++++++++++++-------------
 1 file changed, 134 insertions(+), 60 deletions(-)

diff --git a/tests/test_services.py b/tests/test_services.py
index c25454773..91abdf010 100644
--- a/tests/test_services.py
+++ b/tests/test_services.py
@@ -1019,14 +1019,18 @@ def test_ServiceGeoserver_effective_permissions(self):
                                         user        group       effective (detail)
             Service1                    (gc-A-R)    (gm-D-R)    gc-A, gf-D, gi-D, gm-D
                 Workspace1              (dp-A-R)    (gf-A-R)    dp-A, gf-A, gi-D, gm-D (no match on Workspace itself)
-                    Layer1                          (gi-A-R)    dp-D, gf-A, gi-A, gm-D
-                    Layer2              (gf-D-M)    (gm-A-M)    dp-D, gf-D, gi-A, gm-A (match > recursive)
-                    Layer3              (gm-A-R)                dp-D, gf-A, gi-A, gm-A (effective user > group)
+                    Layer11                         (gi-A-R)    dp-D, gf-A, gi-A, gm-D
+                    Layer12             (gf-D-M)    (gm-A-M)    dp-D, gf-D, gi-A, gm-A (match > recursive)
+                    Layer13             (gm-A-R)                dp-D, gf-A, gi-A, gm-A (effective user > group)
                     [Layer4]                                    dp-D, gf-A, gi-D (doesn't exist, only R apply)
-                    Process1                                    dp-A, gf-D, gi-D (gf/gi don't apply on Process)
-                    Process2            (dp-D-M)                dp-D, gf-D, gi-D
-                    Process3                        (dp-D-M)    dp-A, gf-D, gi-D (effective workspace user > group)
+                    Process11                                   dp-A, gf-D, gi-D (gf/gi don't apply on Process)
+                    Process12           (dp-D-M)                dp-D, gf-D, gi-D
+                    Process13                       (dp-D-M)    dp-A, gf-D, gi-D (effective workspace user > group)
                     [Process4]                                  dp-A, gf-D, gi-D
+                Workspace2                          (gf-A-R)    dp-D, gf-A, gi-D
+                    Layer21             (gf-D-M)                dp-D, gf-D, gi-D (revoke access, user > group)
+                    Layer22                         (gf-D-M)    dp-D, gf-D, gi-D (revoke access, both groups)
+                    Layer23             (gf-A-M)    (gf-D-M)    dp-D, gf-A, gi-D (allowed access, user > group)
 
         .. note::
             Permissions that do not applied to a given sub-:term:`OWS` implementation are automatically denied.
@@ -1035,15 +1039,19 @@ def test_ServiceGeoserver_effective_permissions(self):
         svc_type = ServiceGeoserver.service_type
         svc1_name = "unittest-service-geoserver-1"
         w1_name = "workspace1"
+        w2_name = "workspace2"
         wx_name = "fake-workspace"
-        l1_name = "layer1"
-        l2_name = "layer2"
-        l3_name = "layer3"
-        l4_name = "layer4"
-        p1_name = "process1"
-        p2_name = "process2"
-        p3_name = "process3"
-        p4_name = "process4"
+        l11_name = "layer11"
+        l12_name = "layer12"
+        l13_name = "layer13"
+        l14_name = "layer14"
+        l21_name = "layer21"
+        l22_name = "layer22"
+        l23_name = "layer23"
+        p11_name = "process11"
+        p12_name = "process12"
+        p13_name = "process13"
+        p14_name = "process14"
 
         utils.TestSetup.delete_TestService(self, svc1_name)
         svc1_id, w1_id = utils.TestSetup.create_TestServiceResourceTree(
@@ -1054,42 +1062,71 @@ def test_ServiceGeoserver_effective_permissions(self):
         info = utils.TestSetup.create_TestResource(
             self,
             parent_resource_id=w1_id,
-            override_resource_name=l1_name,
+            override_resource_name=l11_name,
             override_resource_type=models.Layer.resource_type_name
         )
-        l1_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        l11_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
         info = utils.TestSetup.create_TestResource(
             self,
             parent_resource_id=w1_id,
-            override_resource_name=l2_name,
+            override_resource_name=l12_name,
             override_resource_type=models.Layer.resource_type_name
         )
-        l2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        l12_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
         info = utils.TestSetup.create_TestResource(
             self,
             parent_resource_id=w1_id,
-            override_resource_name=l3_name,
+            override_resource_name=l13_name,
             override_resource_type=models.Layer.resource_type_name
         )
-        l3_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        l13_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
         info = utils.TestSetup.create_TestResource(
             self,
             parent_resource_id=w1_id,
-            override_resource_name=p2_name,
+            override_resource_name=p12_name,
             override_resource_type=models.Process.resource_type_name
         )
-        p2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        p12_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
         info = utils.TestSetup.create_TestResource(
             self,
             parent_resource_id=w1_id,
-            override_resource_name=p3_name,
+            override_resource_name=p13_name,
             override_resource_type=models.Process.resource_type_name
         )
-        p3_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        p13_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=svc1_id,
+            override_resource_name=w2_name,
+            override_resource_type=models.Workspace.resource_type_name
+        )
+        w2_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w2_id,
+            override_resource_name=l21_name,
+            override_resource_type=models.Layer.resource_type_name
+        )
+        l21_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w2_id,
+            override_resource_name=l22_name,
+            override_resource_type=models.Layer.resource_type_name
+        )
+        l22_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
+        info = utils.TestSetup.create_TestResource(
+            self,
+            parent_resource_id=w2_id,
+            override_resource_name=l23_name,
+            override_resource_type=models.Layer.resource_type_name
+        )
+        l23_id = utils.TestSetup.get_ResourceInfo(self, info)["resource_id"]
 
         # create permissions
         gcAR = PermissionSet(Permission.GET_CAPABILITIES, Access.ALLOW, Scope.RECURSIVE)    # noqa
         gfAR = PermissionSet(Permission.GET_FEATURE, Access.ALLOW, Scope.RECURSIVE)         # noqa
+        gfAM = PermissionSet(Permission.GET_FEATURE, Access.ALLOW, Scope.MATCH)             # noqa
         gfDM = PermissionSet(Permission.GET_FEATURE, Access.DENY, Scope.MATCH)              # noqa
         giAR = PermissionSet(Permission.GET_FEATURE_INFO, Access.ALLOW, Scope.RECURSIVE)    # noqa
         gmAM = PermissionSet(Permission.GET_MAP, Access.ALLOW, Scope.MATCH)                 # noqa
@@ -1101,12 +1138,17 @@ def test_ServiceGeoserver_effective_permissions(self):
         utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=svc1_id, override_permission=gmDR)
         utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=w1_id, override_permission=gfAR)
         utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=w1_id, override_permission=dpAR)
-        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l1_id, override_permission=giAR)
-        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l2_id, override_permission=gfDM)
-        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l2_id, override_permission=gmAM)
-        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l3_id, override_permission=gmAR)
-        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=p2_id, override_permission=dpDM)
-        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=p3_id, override_permission=dpDM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l11_id, override_permission=giAR)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l12_id, override_permission=gfDM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l12_id, override_permission=gmAM)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l13_id, override_permission=gmAR)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=p12_id, override_permission=dpDM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=p13_id, override_permission=dpDM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=w2_id, override_permission=gfAR)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l21_id, override_permission=gfDM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l22_id, override_permission=gfDM)
+        utils.TestSetup.create_TestUserResourcePermission(self, override_resource_id=l23_id, override_permission=gfAM)
+        utils.TestSetup.create_TestGroupResourcePermission(self, override_resource_id=l23_id, override_permission=gfDM)
 
         # login test user for which the permissions were set
         self.login_test_user()
@@ -1144,20 +1186,24 @@ def _test(_path, _params, allow):
         w1_wfs_path = "{}/{}/wfs".format(svc_path, w1_name)
         w1_wms_path = "{}/{}/wms".format(svc_path, w1_name)
         w1_wps_path = "{}/{}/wps".format(svc_path, w1_name)
+        w2_wfs_path = "{}/{}/wfs".format(svc_path, w2_name)
         wx_wfs_path = "{}/{}/wfs".format(svc_path, wx_name)
         wx_wms_path = "{}/{}/wms".format(svc_path, wx_name)
         svc_wfs_path = "{}/wfs".format(svc_path)
         svc_wms_path = "{}/wms".format(svc_path)
         svc_wps_path = "{}/wps".format(svc_path)
-        wx_l1 = _scope(wx_name, l1_name)
-        w1_l1 = _scope(w1_name, l1_name)
-        w1_l2 = _scope(w1_name, l2_name)
-        w1_l3 = _scope(w1_name, l3_name)
-        w1_l4 = _scope(w1_name, l4_name)
-        w1_p1 = _scope(w1_name, p1_name)
-        w1_p2 = _scope(w1_name, p2_name)
-        w1_p3 = _scope(w1_name, p3_name)
-        w1_p4 = _scope(w1_name, p4_name)
+        wx_l1 = _scope(wx_name, l11_name)
+        w1_l1 = _scope(w1_name, l11_name)
+        w1_l2 = _scope(w1_name, l12_name)
+        w1_l3 = _scope(w1_name, l13_name)
+        w1_l4 = _scope(w1_name, l14_name)
+        w1_p1 = _scope(w1_name, p11_name)
+        w1_p2 = _scope(w1_name, p12_name)
+        w1_p3 = _scope(w1_name, p13_name)
+        w1_p4 = _scope(w1_name, p14_name)
+        w2_l1 = _scope(w2_name, l21_name)
+        w2_l2 = _scope(w2_name, l22_name)
+        w2_l3 = _scope(w2_name, l23_name)
 
         # Layer1, mismatching permission for WMS
         _test(svc_wms_path, {"request": Permission.GET_FEATURE.title, "layers": w1_l1}, allow=False)
@@ -1268,14 +1314,14 @@ def _test(_path, _params, allow):
         # valid WPS requests
         #   - Workspace only expected to work when in path because 'identifier' is not linked to workspace
         #   - Process2 is explicitly denied, so access still blocked even when resource is properly resolved.
-        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}, allow=True)
-        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p2_name}, allow=False)
-        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p3_name}, allow=True)
-        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p4_name}, allow=True)
+        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p11_name}, allow=True)
+        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p12_name}, allow=False)
+        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p13_name}, allow=True)
+        _test(w1_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p14_name}, allow=True)
         # other cases all invalid since workspace cannot be resolved
-        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p1_name}, allow=False)
-        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p2_name}, allow=False)
-        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p3_name}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p11_name}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p12_name}, allow=False)
+        _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": p13_name}, allow=False)
         _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_p1}, allow=False)
         _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_p2}, allow=False)
         _test(svc_wps_path, {"request": Permission.DESCRIBE_PROCESS.title, "identifier": w1_p3}, allow=False)
@@ -1285,16 +1331,16 @@ def _test(_path, _params, allow):
         # validate that effective resolution considering user/group priority and recursive/match scope priority work
         _test(svc_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l1}, allow=False)
         _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l1}, allow=False)
-        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l1_name}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l11_name}, allow=False)
         _test(svc_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l2}, allow=True)
         _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l2}, allow=True)
-        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l2_name}, allow=True)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l12_name}, allow=True)
         _test(svc_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l3}, allow=True)
         _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l3}, allow=True)
-        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l3_name}, allow=True)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l13_name}, allow=True)
         _test(svc_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l4}, allow=False)
         _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": w1_l4}, allow=False)
-        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l4_name}, allow=False)
+        _test(w1_wms_path, {"request": Permission.GET_MAP.title, "layers": l14_name}, allow=False)
 
         # using either the 'typename' or 'typenames' parameter lets WFS retrieve layers indistinguishably
         alt_name = "typeName"
@@ -1327,16 +1373,44 @@ def _add_both(value):
 
         # using multiple layers at the same time should validate all of them (all or nothing access)
         # order should not matter
-        w1_l1_w1_l1 = ",".join([w1_l1, w1_l1])  # resolved as duplicate, only processed once, allowed
-        w1_l1_w1_l2 = ",".join([w1_l1, w1_l2])  # W1-L1 is allowed, but not W1-L2, so both denied
-        w1_l1_w1_l3 = ",".join([w1_l1, w1_l3])  # both are allowed, so full request allowed as well
-        w1_l2_w1_l1 = ",".join([w1_l2, w1_l1])
-        w1_l3_w1_l1 = ",".join([w1_l3, w1_l1])
-        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1_w1_l1}, allow=True)
-        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1_w1_l2}, allow=False)
-        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l1_w1_l3}, allow=True)
-        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l2_w1_l1}, allow=False)
-        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w1_l3_w1_l1}, allow=True)
+        l11_l11 = ",".join([w1_l1, w1_l1])  # resolved as duplicate, only processed once, allowed
+        l11_l12 = ",".join([w1_l1, w1_l2])  # W1-L1 is allowed, but not W1-L2, so both denied
+        l11_l13 = ",".join([w1_l1, w1_l3])  # both are allowed, so full request allowed as well
+        l12_l11 = ",".join([w1_l2, w1_l1])
+        l13_l11 = ",".join([w1_l3, w1_l1])
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": l11_l11}, allow=True)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": l11_l12}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": l11_l13}, allow=True)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": l12_l11}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": l13_l11}, allow=True)
+
+        # validate revoking access when explicit denies are placed under previously allowed-recursive resources
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w2_l1}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w2_l2}, allow=False)
+        _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w2_l3}, allow=True)
+        _test(w2_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w2_l1}, allow=False)
+        _test(w2_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w2_l2}, allow=False)
+        _test(w2_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": w2_l3}, allow=True)
+
+        # mixing workspaces still work if only in scoped resource reference,
+        # but fail for isolated path workspace due to mismatch workspace reference in at least one case
+        #   Summary (GetFeature):
+        #       L11: A  L21: D      -> only allowed combinations are exclusively with:  [L11, L13, L23]
+        #       L12: D  L22: D      -> deny any combination when following are present: [L12, L21, L22]
+        #       L13: A  L23: A
+        for quantity in [2, 3, 4, 5]:
+            layer_permutes = itertools.permutations([w1_l1, w1_l2, w1_l3, w2_l1, w2_l2, w2_l3], quantity)
+            for layer_combo in layer_permutes:
+                query = ",".join(layer_combo)
+                allow = not any(layer_deny in layer_combo for layer_deny in [w1_l2, w2_l1, w2_l2])
+                _test(svc_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": query}, allow=allow)
+
+                # multiple layers nested under same workspace will work for request with Workspace isolated path
+                # otherwise, automatic deny regardless if they were allowed during request without workspace in path
+                allow_w1 = allow and all(layer.startswith(w1_name) for layer in layer_combo)
+                allow_w2 = allow and all(layer.startswith(w2_name) for layer in layer_combo)
+                _test(w1_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": query}, allow=allow_w1)
+                _test(w2_wfs_path, {"request": Permission.GET_FEATURE.title, "typeNames": query}, allow=allow_w2)
 
 
 @runner.MAGPIE_TEST_LOCAL

From 00b4d0ee16c2be741fdf492b8527d24f8748dd5b Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Tue, 25 Jan 2022 23:02:53 -0500
Subject: [PATCH 33/34] fix linting

---
 .dockerignore           |  1 +
 .gitignore              |  1 +
 docs/_static/custom.css | 14 +++++---------
 magpie/services.py      | 24 ++++++++++++------------
 magpie/utils.py         |  2 +-
 5 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index c3a745027..aa4fc3281 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -13,6 +13,7 @@ venv
 
 # Node
 node_modules
+package.json
 package-lock.json
 
 # Makefile
diff --git a/.gitignore b/.gitignore
index 1b1ce7e64..4d189a647 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,7 @@ share
 
 # Node
 node_modules
+package.json
 package-lock.json
 
 # Makefile
diff --git a/docs/_static/custom.css b/docs/_static/custom.css
index 382bf2e52..48f152333 100644
--- a/docs/_static/custom.css
+++ b/docs/_static/custom.css
@@ -59,22 +59,18 @@ div.bordered-content {
 div.parent-list-numbers ol {
     counter-reset: item;
 }
+
 div.parent-list-numbers ol li {
     counter-increment: item;
 }
-/*div.parent-list-numbers > li:before {
-    content: counters(item, ".") " ";
-    counter-increment: item
-}*/
+
 div.parent-list-numbers ol ol > li::before {
-    content: counters(item, ".")")";
+    content: counters(item, ".") ")";
     margin-left: -3em;
 }
-div.parent-list-numbers ol li {
-    counter-increment: item;
-}
+
 div.parent-list-numbers > ol > li > ol > li {
-    list-style: None;
+    list-style: none;
     display: inline-flex;
     display: -webkit-box;
 }
diff --git a/magpie/services.py b/magpie/services.py
index f8c3ce635..35338a5af 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -937,7 +937,7 @@ def resource_scoped(cls):
 
     @classproperty
     @abc.abstractmethod
-    def resource_multi(cls):  # noqa
+    def resource_multi(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> bool
         """
         Indicates if the :term:`Service` supports multiple simultaneous :term:`Resource` references.
@@ -954,7 +954,7 @@ def resource_multi(cls):  # noqa
 
     @classproperty
     @abc.abstractmethod
-    def resource_param(cls):  # noqa
+    def resource_param(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> Union[Str, List[Str]]
         """
         Name of the request query parameter(s) to access requested leaf children resource.
@@ -973,7 +973,7 @@ def resource_param(cls):  # noqa
 
     @classproperty
     @abc.abstractmethod
-    def resource_types_permissions(cls):  # noqa
+    def resource_types_permissions(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> ResourceTypePermissions
         """
         Explicit permissions provided for resources for a given :term:`OWS` implementation.
@@ -981,7 +981,7 @@ def resource_types_permissions(cls):  # noqa
         raise NotImplementedError
 
     @classproperty
-    def params_expected(cls):  # noqa
+    def params_expected(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> List[Str]
         """
         Specify typical `Geoserver` request query parameters expected for any sub-service implementation.
@@ -1472,7 +1472,7 @@ class ServiceGeoserver(ServiceGeoserverBase):
     }
 
     @classproperty
-    def service_ows_supported(cls):  # noqa
+    def service_ows_supported(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> Set[Type[ServiceOWS]]
         return set(cls.service_map.values())
 
@@ -1517,7 +1517,7 @@ def get_config(self):
         return self._config
 
     @classproperty
-    def params_expected(cls):  # noqa
+    def params_expected(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> List[Str]
         params = set()
         for svc in cls.service_ows_supported:
@@ -1528,7 +1528,7 @@ def params_expected(cls):  # noqa
         return list(params)
 
     @classproperty
-    def permissions(cls):  # noqa
+    def permissions(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> List[Permission]
         perms = set()
         for svc in cls.service_ows_supported:
@@ -1539,7 +1539,7 @@ def permissions(cls):  # noqa
         return list(perms)
 
     @classproperty
-    def resource_types_permissions(cls):  # noqa
+    def resource_types_permissions(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> ResourceTypePermissions
         perms = {}  # type: ResourceTypePermissions
         for svc in cls.service_ows_supported:
@@ -1578,7 +1578,7 @@ def service_requested(self):
             # since all OWS services are accessed using '/geoserver/<SERVICE>?request=...'
             # attempt to match using applicable path fragment
             svc_path = self.request.path.rsplit("/", 1)[-1].lower()
-            for svc_ows in type(self).service_ows_supported:
+            for svc_ows in type(self).service_ows_supported:  # pylint: disable=E1133,not-an-iterable
                 if svc_path == svc_ows.service_base:
                     svc = svc_ows.service_base
                     break
@@ -1590,19 +1590,19 @@ def service_requested(self):
         return self._service_requested
 
     @classproperty
-    def resource_scoped(cls):  # noqa
+    def resource_scoped(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> bool
         svc = cls.service_requested()
         return svc.resource_scoped if svc else False
 
     @classproperty
-    def resource_multi(cls):  # noqa
+    def resource_multi(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> bool
         svc = cls.service_requested()
         return svc.resource_multi if svc else False
 
     @classproperty
-    def resource_param(cls):  # noqa
+    def resource_param(cls):  # noqa  # pylint: disable=E0213,no-self-argument
         # type: () -> Union[Str, List[Str]]
         svc = cls.service_requested()
         return cls.resource_param if svc else []
diff --git a/magpie/utils.py b/magpie/utils.py
index 5f946f645..7dc9e8c76 100644
--- a/magpie/utils.py
+++ b/magpie/utils.py
@@ -999,7 +999,7 @@ def __call__(cls, *args, **kwargs):
         return cls._instances[cls]
 
 
-class classproperty(property):
+class classproperty(property):  # pylint: disable=C0103,invalid-name
     """
     Mimics :class:`property` decorator, but applied onto ``classmethod`` in backward compatible way.
 

From 947f8ab6ae6c074bebbd6d7734c9d917448c86a5 Mon Sep 17 00:00:00 2001
From: fmigneault <francis.charette.migneault@gmail.com>
Date: Fri, 28 Jan 2022 10:22:35 -0500
Subject: [PATCH 34/34] fix format string backward compatible

---
 magpie/services.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/magpie/services.py b/magpie/services.py
index 35338a5af..4b98d9f4d 100644
--- a/magpie/services.py
+++ b/magpie/services.py
@@ -994,7 +994,7 @@ def params_expected(cls):  # noqa  # pylint: disable=E0213,no-self-argument
             impl_params = cls.resource_param
         else:
             name = fully_qualified_name(cls)
-            raise NotImplementedError(f"Missing or invalid definition of 'resource_param' in service: {name}")
+            raise NotImplementedError("Missing or invalid definition of 'resource_param' in service: {}".format(name))
         base_params = [
             "request",
             "service",