Skip to content

Week 11 Report

Jump to bottom
Vishmayraj Zala edited this page Aug 19, 2026 · 3 revisions

Weekly Report - Week 11 (August 8 - August 14, 2026)

Note: Met with mentors on August 14 and walked through the completed authorization layer end to end. Was asked to put together a workshop page on the connector next, alongside general final cleanup.

I performed the following tasks during week 11:

Config (config.py)

  • Added OPEN_CATALOG_METADATA (bool, default 1) to control whether the connector's catalog/item metadata is public or requires a token, one flag covering both STAC and DCAT.
  • Added CATALOG_CLOSED_NETWORKS, a comma-separated list of network ids that always return 404 to unauthenticated callers so their existence isn't leaked.
  • Added STAC_AUTH_DESCRIPTION, deployment-overridable text shown in the STAC auth prompt.

Auth gate (auth_gate.py, new)

  • Built a single gate() dependency used by every connector route, STAC and DCAT alike.
  • AUTHORIZATION=0 or ANONYMOUS_VIEWER=1 opens everything; in strict mode, closed networks 404 without a token and everything else follows OPEN_CATALOG_METADATA.
  • Kept this separate in scope from the STAC auth extension: this gate controls whether the connector's own metadata is visible, the extension controls what a client is told when an Item's data assets need a token, even if the Item itself is public.

Closed-network leak prevention

  • Filtered closed network ids out of STAC/DCAT nav links, root links, and the GET /connector summary.

STAC auth extension (stac_transformer.py)

  • Wired in stac-extensions/authentication v1.1.0 so assets that need a token declare it instead of just 401ing with no context.
  • Declared two schemes for the same /Login endpoint: an oauth2 one matching istSOS's actual flow, and an apiKey/header one because STAC Browser only renders a working prompt for that type.
  • Declared the extension at every level (root catalog, network sub-catalogs, collections, item properties) since STAC validators check each document standalone.
  • Assets get auth:refs whenever the deployment requires auth, no-op otherwise.

Tests

  • Added test_auth_gate.py and test_auth.py: full matrix across AUTHORIZATION, ANONYMOUS_VIEWER, OPEN_CATALOG_METADATA, closed networks, and invalid tokens.
  • Added test_dcat_gate_parity.py: asserts every gated route uses the same gate function, and that equivalent STAC/DCAT routes behave identically under every flag combination.
  • 19 tests, all passing.
  • Manually verified schema validation at every hierarchy level, a real token issued via /Login and used against a protected endpoint via curl, and the apiKey prompt working on a live browser.moregeo.it instance.

PR #210 opened

  • Opened feat(connector): shallow/deep tier authorization, STAC auth extension, closed-network gating. Depends on #204 and #208.
  • Noted a known limitation: STAC Browser doesn't forward the auth token on asset downloads (plain or CSV). Confirmed via HAR capture and reproduced across three separate instances, so it's a STAC Browser-side issue, tracked upstream at radiantearth/stac-browser#356. Interactive login has only been checked against STAC Browser itself; other extension-aware clients should work off the oauth2 scheme but haven't been separately tested.

Details can be found in:

  • PR: #210
  • Auth work: api/app/v1/connector/auth_gate.py, config.py, stac_transformer.py, tests/connector/test_auth_gate.py, test_auth.py, test_dcat_gate_parity.py

What do I plan to do next week?

  • Put together a workshop page on the STAC/DCAT-AP connector covering entity mapping, NETWORK scoping, and usage both as a consumer and as a deployer.
  • General final cleanup on the connector package ahead of wrapping up.

Am I blocked on anything?

  • No blockages.

Clone this wiki locally