Week 11 Report

Weekly Report - Week 11 (August 8 - August 14, 2026)

I performed the following tasks during week 11:

Config (config.py)

Added OPEN_CATALOG_METADATA (bool, default 1) to control whether the connector's catalog/item metadata is public or requires a token, one flag covering both STAC and DCAT.
Added CATALOG_CLOSED_NETWORKS, a comma-separated list of network ids that always return 404 to unauthenticated callers so their existence isn't leaked.
Added STAC_AUTH_DESCRIPTION, deployment-overridable text shown in the STAC auth prompt.

Auth gate (auth_gate.py, new)

Built a single gate() dependency used by every connector route, STAC and DCAT alike.
AUTHORIZATION=0 or ANONYMOUS_VIEWER=1 opens everything; in strict mode, closed networks 404 without a token and everything else follows OPEN_CATALOG_METADATA.
Kept this separate in scope from the STAC auth extension: this gate controls whether the connector's own metadata is visible, the extension controls what a client is told when an Item's data assets need a token, even if the Item itself is public.

Closed-network leak prevention

Filtered closed network ids out of STAC/DCAT nav links, root links, and the GET /connector summary.

STAC auth extension (stac_transformer.py)

Wired in stac-extensions/authentication v1.1.0 so assets that need a token declare it instead of just 401ing with no context.
Declared two schemes for the same /Login endpoint: an oauth2 one matching istSOS's actual flow, and an apiKey/header one because STAC Browser only renders a working prompt for that type.
Declared the extension at every level (root catalog, network sub-catalogs, collections, item properties) since STAC validators check each document standalone.
Assets get auth:refs whenever the deployment requires auth, no-op otherwise.

Tests

Added test_auth_gate.py and test_auth.py: full matrix across AUTHORIZATION, ANONYMOUS_VIEWER, OPEN_CATALOG_METADATA, closed networks, and invalid tokens.
Added test_dcat_gate_parity.py: asserts every gated route uses the same gate function, and that equivalent STAC/DCAT routes behave identically under every flag combination.
19 tests, all passing.
Manually verified schema validation at every hierarchy level, a real token issued via /Login and used against a protected endpoint via curl, and the apiKey prompt working on a live browser.moregeo.it instance.

PR #210 opened

Opened feat(connector): shallow/deep tier authorization, STAC auth extension, closed-network gating. Depends on #204 and #208.
Noted a known limitation: STAC Browser doesn't forward the auth token on asset downloads (plain or CSV). Confirmed via HAR capture and reproduced across three separate instances, so it's a STAC Browser-side issue, tracked upstream at radiantearth/stac-browser#356. Interactive login has only been checked against STAC Browser itself; other extension-aware clients should work off the oauth2 scheme but haven't been separately tested.

Mentor sync

Met with mentors on August 14 and walked through the completed authorization layer end to end. Was asked to put together a workshop page on the connector next, alongside general final cleanup.

Details can be found in:

PR: #210
Auth work: api/app/v1/connector/auth_gate.py, config.py, stac_transformer.py, tests/connector/test_auth_gate.py, test_auth.py, test_dcat_gate_parity.py

What do I plan to do next week?

Put together a workshop page on the STAC/DCAT-AP connector covering entity mapping, NETWORK scoping, and usage both as a consumer and as a deployer.
General final cleanup on the connector package ahead of wrapping up.

Am I blocked on anything?