Skip to content

Commit 9f54854

Browse files
jamesfisher-geojamesfisher-geo
committed
resolve
2 parents e8fdc88 + 418c3d5 commit 9f54854

File tree

10 files changed

+337
-136
lines changed

10 files changed

+337
-136
lines changed

‎CHANGELOG.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,40 @@
11
# Changelog
22

3+
## [0.8.0](https://github.com/developmentseed/stac-auth-proxy/compare/v0.7.1...v0.8.0) (2025-08-16)
4+
5+
6+
### Features
7+
8+
* add `configure_app` for applying middleware to existing FastAPI applications ([#85](https://github.com/developmentseed/stac-auth-proxy/issues/85)) ([3c5cf69](https://github.com/developmentseed/stac-auth-proxy/commit/3c5cf694c26520fd141faf84c23fe621413e244e))
9+
* add aws lambda handler ([#81](https://github.com/developmentseed/stac-auth-proxy/issues/81)) ([214de02](https://github.com/developmentseed/stac-auth-proxy/commit/214de02301b909347e847c66c7e12b88ba74fdea))
10+
* add configurable audiences ([#83](https://github.com/developmentseed/stac-auth-proxy/issues/83)) ([58d05ea](https://github.com/developmentseed/stac-auth-proxy/commit/58d05ea665c48cc86e4774e2e7337b7ad277ab2f))
11+
* **config:** expand default endpoints ([#79](https://github.com/developmentseed/stac-auth-proxy/issues/79)) ([6718991](https://github.com/developmentseed/stac-auth-proxy/commit/67189917c2b38620dc92fb7836d25b68901f59ae))
12+
13+
14+
### Documentation
15+
16+
* add changelog ([5710853](https://github.com/developmentseed/stac-auth-proxy/commit/57108531a5259f0d5db81a449e9b2246b2f0a522))
17+
* add version badges to README ([d962230](https://github.com/developmentseed/stac-auth-proxy/commit/d9622300275f4488cf1cda90a60f2f4ee013aa69))
18+
* **architecture:** add data filtering diagrams ([48afd7e](https://github.com/developmentseed/stac-auth-proxy/commit/48afd7e353144b98e5b97bfc87cc067f34933634))
19+
* build out separate documentation website ([#78](https://github.com/developmentseed/stac-auth-proxy/issues/78)) ([6c9b6ba](https://github.com/developmentseed/stac-auth-proxy/commit/6c9b6ba15c63a39410a71cac13de87daa84284f3))
20+
* **cicd:** correct filename in deploy-mkdocs workflow ([5f00eca](https://github.com/developmentseed/stac-auth-proxy/commit/5f00eca440926652d4bb7abcf20748aac96e16bb))
21+
* **cicd:** fix deploy step ([5178b92](https://github.com/developmentseed/stac-auth-proxy/commit/5178b92b189a8af8aff6ed923b312a494b03b573))
22+
* **deployment:** Add details of deploying STAC Auth Proxy ([aaf3802](https://github.com/developmentseed/stac-auth-proxy/commit/aaf3802ed97096ffb1233875b1be59230da2a043))
23+
* describe installation via pip ([bfb9ca8](https://github.com/developmentseed/stac-auth-proxy/commit/bfb9ca8e20fa86d248e9c5c375eb18359206761b))
24+
* **docker:** Add OpenSearch backend stack to docker-compose ([#71](https://github.com/developmentseed/stac-auth-proxy/issues/71)) ([d779321](https://github.com/developmentseed/stac-auth-proxy/commit/d779321e992b0ae724520a38d3353cd7bbb07fcf))
25+
* fix getting started link ([8efe5e5](https://github.com/developmentseed/stac-auth-proxy/commit/8efe5e5d6c449d91b2f957bad259649008bcc308))
26+
* **tips:** add details about CORS configuration ([#84](https://github.com/developmentseed/stac-auth-proxy/issues/84)) ([fc1e217](https://github.com/developmentseed/stac-auth-proxy/commit/fc1e2173e778f148f4f23cabe19611eb43c2df6a))
27+
* **user-guide:** Add record-level auth section ([89377c6](https://github.com/developmentseed/stac-auth-proxy/commit/89377c6e23b3d21751b08eceb0dd222f8217663a))
28+
* **user-guide:** Add route-level auth user guide ([#80](https://github.com/developmentseed/stac-auth-proxy/issues/80)) ([a840234](https://github.com/developmentseed/stac-auth-proxy/commit/a84023431634f933db965d09632736d55b3d26e8))
29+
* **user-guide:** create getting-started section ([6ba081e](https://github.com/developmentseed/stac-auth-proxy/commit/6ba081ef174d529a2341058d262f324b6354819a))
30+
* **user-guide:** fix configuration links ([11a5d28](https://github.com/developmentseed/stac-auth-proxy/commit/11a5d28756057e868d731d72ca3174e613f1a474))
31+
* **user-guide:** fix tips file ref ([2d5d2ac](https://github.com/developmentseed/stac-auth-proxy/commit/2d5d2ac511fc304e8d88cae1567fb065c0316b4d))
32+
* **user-guide:** formatting ([8ed08bc](https://github.com/developmentseed/stac-auth-proxy/commit/8ed08bc0713c816dbb0af336f147a62756114ffc))
33+
* **user-guide:** Mention row-level authorization ([5fbd5df](https://github.com/developmentseed/stac-auth-proxy/commit/5fbd5dff311518684b566b6837a835ee1b753962))
34+
* **user-guide:** Move configuration & installation to user guide ([170f001](https://github.com/developmentseed/stac-auth-proxy/commit/170f0015a6349cfdd45b7ea13464082128f70b7b))
35+
* **user-guide:** Mv tips to user-guide ([d829800](https://github.com/developmentseed/stac-auth-proxy/commit/d829800fa838cb34a977e135e7576e4dc0ea03b7))
36+
* **user-guide:** Reword authentication to authorization ([37fa12d](https://github.com/developmentseed/stac-auth-proxy/commit/37fa12d315ba6bd0f01a41cf906510a9f149e88b))
37+
338
## [0.7.1](https://github.com/developmentseed/stac-auth-proxy/compare/v0.7.0...v0.7.1) (2025-07-31)
439

540

‎docs/user-guide/configuration.md‎

Lines changed: 63 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -8,57 +8,57 @@ The application is configurable via environment variables.
88

99
: STAC API URL
1010

11-
**Type:** HTTP(S) URL
12-
**Required:** Yes
11+
**Type:** HTTP(S) URL
12+
**Required:** Yes
1313
**Example:** `https://your-stac-api.com/stac`
1414

1515
### `WAIT_FOR_UPSTREAM`
1616

1717
: Wait for upstream API to become available before starting proxy
1818

19-
**Type:** boolean
20-
**Required:** No, defaults to `true`
19+
**Type:** boolean
20+
**Required:** No, defaults to `true`
2121
**Example:** `false`, `1`, `True`
2222

2323
### `CHECK_CONFORMANCE`
2424

2525
: Ensure upstream API conforms to required conformance classes before starting proxy
2626

27-
**Type:** boolean
28-
**Required:** No, defaults to `true`
27+
**Type:** boolean
28+
**Required:** No, defaults to `true`
2929
**Example:** `false`, `1`, `True`
3030

3131
### `ENABLE_COMPRESSION`
3232

3333
: Enable response compression
3434

35-
**Type:** boolean
36-
**Required:** No, defaults to `true`
35+
**Type:** boolean
36+
**Required:** No, defaults to `true`
3737
**Example:** `false`, `1`, `True`
3838

3939
### `HEALTHZ_PREFIX`
4040

4141
: Path prefix for health check endpoints
4242

43-
**Type:** string
44-
**Required:** No, defaults to `/healthz`
43+
**Type:** string
44+
**Required:** No, defaults to `/healthz`
4545
**Example:** `''` (disabled)
4646

4747
### `OVERRIDE_HOST`
4848

4949
: Override the host header for the upstream API
5050

51-
**Type:** boolean
52-
**Required:** No, defaults to `true`
51+
**Type:** boolean
52+
**Required:** No, defaults to `true`
5353
**Example:** `false`, `1`, `True`
5454

5555
### `ROOT_PATH`
5656

5757
: Path prefix for the proxy API
5858

59-
**Type:** string
60-
**Required:** No, defaults to `''` (root path)
61-
**Example:** `/api/v1`
59+
**Type:** string
60+
**Required:** No, defaults to `''` (root path)
61+
**Example:** `/api/v1`
6262
**Note:** This is independent of the upstream API's path. The proxy will handle removing this prefix from incoming requests and adding it to outgoing links.
6363

6464
## Authentication
@@ -67,41 +67,40 @@ The application is configurable via environment variables.
6767

6868
: OpenID Connect discovery document URL
6969

70-
**Type:** HTTP(S) URL
71-
**Required:** Yes
70+
**Type:** HTTP(S) URL
71+
**Required:** Yes
7272
**Example:** `https://auth.example.com/.well-known/openid-configuration`
7373

7474
### `OIDC_DISCOVERY_INTERNAL_URL`
7575

7676
: Internal network OpenID Connect discovery document URL
7777

78-
**Type:** HTTP(S) URL
79-
**Required:** No, defaults to the value of `OIDC_DISCOVERY_URL`
78+
**Type:** HTTP(S) URL
79+
**Required:** No, defaults to the value of `OIDC_DISCOVERY_URL`
8080
**Example:** `http://auth/.well-known/openid-configuration`
8181

82-
### `ALLOWED_JWT_AUDIENCES`
82+
### `ALLOWED_JWT_AUDIENCES`
8383

8484
: Unique identifier(s) of API resource server(s)
8585

86-
**Type:** string
87-
**Required:** No
86+
**Type:** string
87+
**Required:** No
8888
**Example:** `https://auth.example.audience.1.net,https://auth.example.audience.2.net`
89-
**Note** A comma-separated list of the intended recipient(s) of the JWT. At least one audience value must match the `aud` (audience) claim present in the incoming JWT. If undefined, the API will not impose a check on the `aud` claim
90-
89+
**Note:** A comma-separated list of the intended recipient(s) of the JWT. At least one audience value must match the `aud` (audience) claim present in the incoming JWT. If undefined, the API will not impose a check on the `aud` claim
9190

9291
### `DEFAULT_PUBLIC`
9392

9493
: Default access policy for endpoints
9594

96-
**Type:** boolean
97-
**Required:** No, defaults to `false`
95+
**Type:** boolean
96+
**Required:** No, defaults to `false`
9897
**Example:** `false`, `1`, `True`
9998

10099
### `PRIVATE_ENDPOINTS`
101100

102101
: Endpoints explicitly marked as requiring authentication and possibly scopes
103102

104-
**Type:** JSON object mapping regex patterns to HTTP methods OR tuples of an HTTP method and string representing required scopes
103+
**Type:** JSON object mapping regex patterns to HTTP methods OR tuples of an HTTP method and string representing required scopes
105104
**Required:** No, defaults to the following:
106105
```json
107106
{
@@ -117,13 +116,14 @@ The application is configurable via environment variables.
117116

118117
: Endpoints explicitly marked as not requiring authentication, used when `DEFAULT_PUBLIC == False`
119118

120-
**Type:** JSON object mapping regex patterns to HTTP methods
119+
**Type:** JSON object mapping regex patterns to HTTP methods
121120
**Required:** No, defaults to the following:
122121
```json
123122
{
124123
"^/$": ["GET"],
125124
"^/api.html$": ["GET"],
126125
"^/api$": ["GET"],
126+
"^/conformance$": ["GET"],
127127
"^/docs/oauth2-redirect": ["GET"],
128128
"^/healthz": ["GET"]
129129
}
@@ -133,8 +133,8 @@ The application is configurable via environment variables.
133133

134134
: Enable authentication extension in STAC API responses
135135

136-
**Type:** boolean
137-
**Required:** No, defaults to `true`
136+
**Type:** boolean
137+
**Required:** No, defaults to `true`
138138
**Example:** `false`, `1`, `True`
139139

140140
## OpenAPI / Swagger UI
@@ -143,30 +143,30 @@ The application is configurable via environment variables.
143143

144144
: Path of OpenAPI specification, used for augmenting spec response with auth configuration
145145

146-
**Type:** string or null
147-
**Required:** No, defaults to `null` (disabled)
148-
**Example:** `/api`
146+
**Type:** string or null
147+
**Required:** No, defaults to `/api`
148+
**Example:** `''` (disabled)
149149

150150
### `OPENAPI_AUTH_SCHEME_NAME`
151151

152152
: Name of the auth scheme to use in the OpenAPI spec
153153

154-
**Type:** string
155-
**Required:** No, defaults to `oidcAuth`
154+
**Type:** string
155+
**Required:** No, defaults to `oidcAuth`
156156
**Example:** `jwtAuth`
157157

158158
### `OPENAPI_AUTH_SCHEME_OVERRIDE`
159159

160160
: Override for the auth scheme in the OpenAPI spec
161161

162-
**Type:** JSON object
163-
**Required:** No, defaults to `null` (disabled)
164-
**Example:**
162+
**Type:** JSON object
163+
**Required:** No, defaults to `null` (disabled)
164+
**Example:**
165165
```json
166166
{
167-
"type": "http",
168-
"scheme": "bearer",
169-
"bearerFormat": "JWT",
167+
"type": "http",
168+
"scheme": "bearer",
169+
"bearerFormat": "JWT",
170170
"description": "Paste your raw JWT here. This API uses Bearer token authorization.\n"
171171
}
172172
```
@@ -175,16 +175,16 @@ The application is configurable via environment variables.
175175

176176
: Path of Swagger UI, used to indicate that a custom Swagger UI should be hosted, typically useful when providing accompanying `SWAGGER_UI_INIT_OAUTH` arguments
177177

178-
**Type:** string or null
179-
**Required:** No, defaults to `null` (disabled)
180-
**Example:** `/api.html`
178+
**Type:** string or null
179+
**Required:** No, defaults to `/api.html`
180+
**Example:** `''` (disabled)
181181

182182
### `SWAGGER_UI_INIT_OAUTH`
183183

184184
: Initialization options for the [Swagger UI OAuth2 configuration](https://swagger.io/docs/open-source-tools/swagger-ui/usage/oauth2/) on custom Swagger UI
185185

186-
**Type:** JSON object
187-
**Required:** No, defaults to `null` (disabled)
186+
**Type:** JSON object
187+
**Required:** No, defaults to `null` (disabled)
188188
**Example:** `{"clientId": "stac-auth-proxy", "usePkceWithAuthorizationCodeGrant": true}`
189189

190190
## Filtering
@@ -193,62 +193,62 @@ The application is configurable via environment variables.
193193

194194
: CQL2 expression generator for item-level filtering
195195

196-
**Type:** JSON object with class configuration
197-
**Required:** No, defaults to `null` (disabled)
196+
**Type:** JSON object with class configuration
197+
**Required:** No, defaults to `null` (disabled)
198198
**Example:** `stac_auth_proxy.filters:Opa`, `stac_auth_proxy.filters:Template`, `my_package:OrganizationFilter`
199199

200200
### `ITEMS_FILTER_ARGS`
201201

202202
: Positional arguments for CQL2 expression generator
203203

204-
**Type:** List of positional arguments used to initialize the class
205-
**Required:** No, defaults to `[]`
204+
**Type:** List of positional arguments used to initialize the class
205+
**Required:** No, defaults to `[]`
206206
**Example:** `["org1"]`
207207

208208
### `ITEMS_FILTER_KWARGS`
209209

210210
: Keyword arguments for CQL2 expression generator
211211

212-
**Type:** Dictionary of keyword arguments used to initialize the class
213-
**Required:** No, defaults to `{}`
212+
**Type:** Dictionary of keyword arguments used to initialize the class
213+
**Required:** No, defaults to `{}`
214214
**Example:** `{"field_name": "properties.organization"}`
215215

216216
### `ITEMS_FILTER_PATH`
217217

218218
: Regex pattern used to identify request paths that require the application of the items filter
219219

220-
**Type:** Regex string
221-
**Required:** No, defaults to `^(/collections/([^/]+)/items(/[^/]+)?$|/search$)`
220+
**Type:** Regex string
221+
**Required:** No, defaults to `^(/collections/([^/]+)/items(/[^/]+)?$|/search$)`
222222
**Example:** `^(/collections/([^/]+)/items(/[^/]+)?$|/search$|/custom$)`
223223

224224
### `COLLECTIONS_FILTER_CLS`
225225

226226
: CQL2 expression generator for collection-level filtering
227227

228-
**Type:** JSON object with class configuration
229-
**Required:** No, defaults to `null` (disabled)
228+
**Type:** JSON object with class configuration
229+
**Required:** No, defaults to `null` (disabled)
230230
**Example:** `stac_auth_proxy.filters:Opa`, `stac_auth_proxy.filters:Template`, `my_package:OrganizationFilter`
231231

232232
### `COLLECTIONS_FILTER_ARGS`
233233

234234
: Positional arguments for CQL2 expression generator
235235

236-
**Type:** List of positional arguments used to initialize the class
237-
**Required:** No, defaults to `[]`
236+
**Type:** List of positional arguments used to initialize the class
237+
**Required:** No, defaults to `[]`
238238
**Example:** `["org1"]`
239239

240240
### `COLLECTIONS_FILTER_KWARGS`
241241

242242
: Keyword arguments for CQL2 expression generator
243243

244-
**Type:** Dictionary of keyword arguments used to initialize the class
245-
**Required:** No, defaults to `{}`
244+
**Type:** Dictionary of keyword arguments used to initialize the class
245+
**Required:** No, defaults to `{}`
246246
**Example:** `{"field_name": "properties.organization"}`
247247

248248
### `COLLECTIONS_FILTER_PATH`
249249

250250
: Regex pattern used to identify request paths that require the application of the collections filter
251251

252-
**Type:** Regex string
253-
**Required:** No, defaults to `^/collections(/[^/]+)?$`
254-
**Example:** `^.*?/collections(/[^/]+)?$`
252+
**Type:** Regex string
253+
**Required:** No, defaults to `^/collections(/[^/]+)?$`
254+
**Example:** `^.*?/collections(/[^/]+)?$`

0 commit comments

Comments
 (0)