Show user rights and status for a REST resource - web-services

Question

An user can have different rights to a REST resource. Like delete or edit the resource. Also child resources can have different user rights.
Example:
GET /cats -> return all cats
GET /cats/{id} -> return cat {id}
UPDATE /cats/{id} -> update cat {id}
POST /cats/{id}/like -> create a like to the cat {id}
DELETE /cats/{id}/like -> delete your like to the cat {id}
When an user requests a cat resource I want to show him the rights (allowed actions) and the status of the object.
In this example:
Is the user allowed to update the cat?
Is the user allowed to like the cat?
Does the user already like the cat?
Our UI should use this information to show allowed actions for an objects:
Update button
Like button
Dislike button
How can I add this information to my resource response. It should be possible to add the information to one resource, but also to a list of objects.
I thought about Links in the http header for all allowed actions. But this would only be possible for one object. Is their a better solution?

Answer 1

I'm unclear on why you can't include collection-specific links in the header of the response containing the collection. I'll take you at your word that that's not possible, but it seems like it should be an option.
Another option is to use an envelope around your response data. That will let you include metadata, including links, at the collection level.
GET /cats?owner=12
{
"totalRecords": 2,
"links": [ ... ],
"records": [ ... ]
}
EDIT (based on comment)
You should add a links property to the cat representation, either as an envelope or as a direct property. So your cat would look like:
GET /cats/354
{
"name": "Poke",
...,
"links": [
{ "rel": "like", "href": "/cats/12/like" },
....
]
}
Then, each cat in your collection will have the relevant links associated with it. This is a generally accepted alternative to using link headers.
Variations:
Some people like including the verb in the link resource, such as { "rel": "like", "verb": "POST", "href": "/cats/12/like" }
Some people like making the ref the name of the link property, such as "links": { "like": "/cats/12/like", "delete": "/cats/12" }