developmentseed / developmentseed/stac-auth-proxy

Generalize path parameter extraction beyond the core STAC layout

Open
#206 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
46
Forks
8
Avg merge
1d 7h
Merged PRs (30d)
2

Description

## Motivation

This is a feature request motivated to support endpoints beyond the core STAC API spec. These endpoints might include ones from the wider ecosystem (e.g., https://github.com/stac-api-extensions/aggregation or https://github.com/StacLabs/multi-tenant-catalogs), or for custom endpoints that users may have added. It would be excellent to be able to use just `stac-auth-proxy` as the one approach for authorizing core, extension, and arbitrary endpoints.

## Description

There is already support for covering arbitrary endpoints via the regexes in `collections_filter_path` and `items_filter_path`, but the `utils.requests.extract_variables` hard codes the extraction of `collection_id` and/or `item_id` to specific core API spec paths.

We can cover arbitrary paths, but the filters we build and use with `Cql2BuildFilterMiddleware` against these paths won't receive any useful data because the regexes for path extraction are hard coded to cover the core STAC API spec endpoints.

This feature request is a `n>1` case extension of #204 which adds `n=1` support for `/collections/{collection_id}/queryables` to the regex extraction.

## Proposed Implementation Details

I think of the `[collections|items]_filter_path` settings that define which paths to cover as coupled to what information should be extracted, so I would be inclined to have these settings control both.

To keep this backwards compatible we could keep the current implementation in `utils.requests.extract_variables` as a default pathway. However, if users provide regex capture groups within `[collections|items]_filter_path` we could use those instead of the hard coded `utils.requests.extract_variables` implementation that works great with the core spec API paths.

Using `collections_filter_path` as an example:

- `r"^/collections(/[^/]+)?$"` (current default) would fall back to `utils.requests.extract_variables` for variable extraction
- `r"^/collections(?:/(?P[^/]+))?$"` has a named capture group (``) that would be used for variable extraction

This could enable support for non-core paths like the aggregation STAC API extension via:
```
COLLECTIONS_FILTER_PATH='[
"^/collections(?:/(?P[^/]+))?$",
"^/collections/(?P[^/]+)/aggregate$",
"^/collections/(?P[^/]+)/aggregations$"
]'
```

---

I also considering building an entirely new middleware to cover arbitrary endpoints, but I abandoned that because I think it would be a better user experience to make the existing `Cql2BuildFilterMiddleware` more fully featured.

Happy to submit a PR to iterate over if this sounds close to reasonable, or also happy to try implementing other ideas! Thank you 🙇

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in utils.requests.extract_variables and trace how Cql2BuildFilterMiddleware uses collection_id and item_id for filters. Compare the default collections_filter_path and items_filter_path behavior with named capture groups, then verify that custom paths provide the captured values while core STAC paths remain backwards compatible.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.