feat(stac)!: experimenting with stac auth proxy configure_app #531

botanical · 2025-09-19T23:13:46Z

Issue

What?

Experimenting using https://developmentseed.org/stac-auth-proxy/reference/stac_auth_proxy/#stac_auth_proxy.configure_app and custom middleware that uses cql2 filtering on dashboard:tenant fields.
Tenant property is on dashboard:tenant

Testing?

STAC Browser: https://test.openveda.cloud/
collections: https://test.openveda.cloud/api/stac/collections
Test-Tenant Collections: https://test.openveda.cloud/api/stac/test-tenant/collections
Customized landing page: https://test.openveda.cloud/api/stac/test-tenant/ and https://test.openveda.cloud/api/stac/test-tenant both work
Test-Tenant on Items: https://test.openveda.cloud/api/stac/test-tenant/collections/barc-thomasfire/items
Test-Tenant on SIT: https://sit.openveda.cloud/api/stac/test-tenant/collections

stac_api/runtime/src/app.py

stac_api/runtime/setup.py

Co-authored-by: Anthony Lukach <anthonylukach@gmail.com>

stac_api/runtime/src/app.py

…emove starlette cramjam

…-collections-lookup

Can we remove the `TenantContext` class in favor of simplicity? It doesn't seem to be consumed.

alukach

This is really exciting! Great work everyone 🎉

### What? Cache collection lookups in the items filter factory ### Why? When we fetch a tenant's collection to build an items filter, we should cache that value to reduce pressure on the API ### Testing? - Relevant testing details

anayeaye · 2025-10-08T16:29:39Z

stac_api/runtime/src/config.py

    return _TilesApiSettings()


+TENANT_ITEM_LINK_TEMPLATES = [


I think this is no longer used?

stac_api/runtime/src/config.py

stac_api/runtime/src/tenant_filter_middleware.py

… default for custom_host to None

botanical · 2025-10-20T20:31:46Z

You can view the tenant work on SIT at https://sit.openveda.cloud/api/stac/test-tenant/collections @anayeaye

alukach · 2025-10-21T15:08:51Z

At the risk of complicating this feature, I want to verify: is it confirmed that a collection will never be part of multiple tenants? Based on this PR, that seems to be the decision

botanical · 2025-10-21T16:10:05Z

At the risk of complicating this feature, I want to verify: is it confirmed that a collection will never be part of multiple tenants? Based on this PR, that seems to be the decision

Yes that is correct @alukach

anayeaye · 2025-10-21T18:41:30Z

@botanical @alukach do you have any idea where this extra er is coming from in the tenant item links? I don't see anything that would cause it in the middleware or test data 🤔 I am also unaware of any users that would be impacted so I think we can also just open a bug ticket and continue moving forward if nothing comes to mind about why this could happen.

alukach · 2025-10-21T19:03:43Z

@anayeaye Good catch. Looks like links to the raster endpoints were being rewritten when they shouldn't have. I believe I fixed it in aa0af07.

Would be great if we could get a test for that but I'm a bit strapped for availability at the moment.

Can someone verify the fix with a deployment?

refactor: eliminate need to pass in root_path into middleware (root path is available on request)

…ath is available on request)

anayeaye · 2025-10-21T21:11:22Z

@alukach @botanical the root path changes seem to be rendering the expected titiler links in test.openveda.cloud/api/stac. Also the stac api referential links all seem to still work as expected for requests with and without tenant prefixes in the stac api url.

fix: experimenting with stac auth proxy configure_app

c12b441

botanical added the work in progress label Sep 19, 2025

fix: lint issues

b5aed61

botanical marked this pull request as ready for review September 19, 2025 23:17

botanical changed the title ~~fix: experimenting with stac auth proxy configure_app~~ feat: experimenting with stac auth proxy configure_app Sep 19, 2025

alukach reviewed Sep 20, 2025

View reviewed changes

stac_api/runtime/src/app.py Outdated Show resolved Hide resolved

alukach reviewed Sep 20, 2025

View reviewed changes

stac_api/runtime/src/app.py Outdated Show resolved Hide resolved

alukach reviewed Sep 20, 2025

View reviewed changes

stac_api/runtime/setup.py Outdated Show resolved Hide resolved

alukach reviewed Sep 20, 2025

View reviewed changes

stac_api/runtime/setup.py Show resolved Hide resolved

botanical and others added 7 commits September 22, 2025 08:48

Update stac_api/runtime/src/app.py

324ad7f

Co-authored-by: Anthony Lukach <anthonylukach@gmail.com>

Update stac_api/runtime/src/app.py

b6016c1

Co-authored-by: Anthony Lukach <anthonylukach@gmail.com>

fix: update app configuration

c09aaed

fix: enable auth, remove unused imports

5683d2b

fix: disable auth on stac api

af680e1

fix: disable root path on configure app

61047af

fix: add back mysterious fix for KeyError paths aka root_path setting

0c4b130

botanical commented Sep 22, 2025

View reviewed changes

stac_api/runtime/src/app.py Outdated Show resolved Hide resolved

botanical added 13 commits September 22, 2025 15:20

Update stac_api/runtime/src/app.py

1e9d041

fix: add root path to upstream url and try to enable logging

986d72c

fix: merge conflicts

e9b7ef0

fix: formatting

828f509

fix: try enabling debug logging at root level

46bf970

fix: increment httpx version to be compatible with stac auth proxy, r…

af0c7db

…emove starlette cramjam

fix: clean up app.py

c8a0304

fix: remove env_file specification in docker-compose.yml

8417e06

fix: revert httpx version change for test

ebf5c17

fix: attempt to fix tests

7211ebe

fix: rewrite tenant filter middleware and account for trailing slashes

416a26d

fix: route rewriting logic and comments

b2dadc9

fix: formatting

4932a5d

alukach added 2 commits October 14, 2025 15:24

Merge branch 'jt/tenant-filtering-stac-auth-proxy' into alukach/cache…

dfdebba

…-collections-lookup

refactor: Remove TenantContext (#541)

c5b61c9

Can we remove the `TenantContext` class in favor of simplicity? It doesn't seem to be consumed.

alukach approved these changes Oct 14, 2025

View reviewed changes

feat: cache collections lookup (#540)

52619e4

### What? Cache collection lookups in the items filter factory ### Why? When we fetch a tenant's collection to build an items filter, we should cache that value to reduce pressure on the API ### Testing? - Relevant testing details

botanical removed the work in progress label Oct 15, 2025

anayeaye approved these changes Oct 15, 2025

View reviewed changes

botanical added 6 commits October 15, 2025 11:32

fix: remove unused TENANT_ITEM_LINK_TEMPLATES, update config variable…

7268d45

… default for custom_host to None

fix: add back custom host default setting

c068969

fix: update ItemFilter to use async cache

71377bd

fix: lint errors

a7aff1d

fix: set custom host in stac lambda

85c0fb1

fix: add protocol to custom host if missing

e68a80a

botanical changed the title ~~feat: experimenting with stac auth proxy configure_app~~ feat(stac)!: experimenting with stac auth proxy configure_app Oct 16, 2025

fix: use async-lru

4825ea7

botanical requested review from alukach and anayeaye October 16, 2025 18:39

alukach approved these changes Oct 20, 2025

View reviewed changes

anayeaye approved these changes Oct 21, 2025

View reviewed changes

alukach added 3 commits October 21, 2025 12:17

fix: consider root_path when determining if link should be transformed

aa0af07

refactor: eliminate need to pass in root_path into middleware (root path is available on request)

refactor: eliminate need to pass in root_path into middleware (root p…

fb57094

…ath is available on request)

fix: lint error

6a5556a

alukach force-pushed the jt/tenant-filtering-stac-auth-proxy branch from 99ab31d to 6a5556a Compare October 21, 2025 19:17

botanical merged commit e9f1c7e into develop Oct 21, 2025
4 checks passed

botanical deleted the jt/tenant-filtering-stac-auth-proxy branch October 21, 2025 22:10

feat(stac)!: experimenting with stac auth proxy configure_app #531

feat(stac)!: experimenting with stac auth proxy configure_app #531

Uh oh!

Conversation

botanical commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

What?

Testing?

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alukach left a comment

Choose a reason for hiding this comment

Uh oh!

anayeaye Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

botanical commented Oct 20, 2025

Uh oh!

alukach commented Oct 21, 2025

Uh oh!

botanical commented Oct 21, 2025

Uh oh!

anayeaye commented Oct 21, 2025

Uh oh!

alukach commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

anayeaye commented Oct 21, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

botanical commented Sep 19, 2025 •

edited

Loading

alukach commented Oct 21, 2025 •

edited

Loading