feat(release)!: update colormaps, update default collection assets, update readme, fix pagination, add eoapi-auth-util keycloak (#476)

botanical · web-flow · commit ddd143e6b594 · 2025-04-22T13:59:57.000-07:00
## Changed/Updated - #467 (Keycloak) - #470 ## Fixed - #466 - #468 - #469 - #472
diff --git a/.example.env b/.example.env
@@ -32,6 +32,8 @@ VEDA_CLIENT_ID=
 VEDA_CLIENT_SECRET=secret
 VEDA_DATA_ACCESS_ROLE_ARN=
 VEDA_COGNITO_DOMAIN=
+VEDA_OPENID_CONFIGURATION_URL=
+VEDA_KEYCLOAK_CLIENT_ID=
 
 STAC_BROWSER_BUCKET=
 STAC_URL=
diff --git a/.github/actions/cdk-deploy/action.yml b/.github/actions/cdk-deploy/action.yml
@@ -17,9 +17,9 @@ runs:
   using: "composite"
   steps:
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.11'
         cache: 'pip'
@@ -28,11 +28,11 @@ runs:
           ${{ inputs.dir }}/setup.cfg
 
     - name: Setup Node
-      uses: actions/setup-node@v4
-      with: 
+      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e4 #v4.3.0
+      with:
         node-version: 20
 
-    - uses: actions/cache@v4
+    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
       with:
         path: ~/.npm
         key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
@@ -41,7 +41,7 @@ runs:
       shell: bash
       run: npm install -g aws-cdk@2
 
-    - uses: actions/cache@v4
+    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
       with:
         path: ${{ env.pythonLocation }}
         key:  ${{ env.pythonLocation }}-${{ hashFiles('${{ inputs.dir }}/setup.py') }}
diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml
@@ -34,16 +34,16 @@ jobs:
     needs: [define-environment]
     environment: ${{ needs.define-environment.outputs.env_name }}
     concurrency: ${{ needs.define-environment.outputs.env_name }}
-    
+
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           lfs: "true"
           submodules: "false"
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 #v4.1.0
         with:
           role-to-assume: ${{ secrets.DEPLOYMENT_ROLE_ARN }}
           role-session-name: "veda-backend-github-${{ needs.define-environment.outputs.env_name }}-deployment"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -6,13 +6,13 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: '3.11'
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: ${{ env.pythonLocation }}
           key:  ${{ env.pythonLocation }}-${{ hashFiles('setup.py') }}
@@ -28,16 +28,16 @@ jobs:
   lint-conventional-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 #v5.5.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   test:
     needs: [lint, lint-conventional-pr]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Launch services
         run: |
@@ -46,11 +46,11 @@ jobs:
           docker compose up --build -d
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: '3.11'
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: ${{ env.pythonLocation }}
           key:  ${{ env.pythonLocation }}-${{ hashFiles('setup.py') }}
@@ -98,33 +98,33 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: '3.11'
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e4 #v4.3.0
         with:
           node-version: 20
 
       - name: Configure awscli
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 #v4.1.0
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-west-2
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: ~/.npm
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
 
       - name: Install CDK
         run: npm install -g aws-cdk@2
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: ${{ env.pythonLocation }}
           key:  ${{ env.pythonLocation }}-${{ hashFiles('setup.py') }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,13 +17,13 @@ jobs:
         permissions:
           id-token: write
           contents: write
-    
+
         steps:
-        - uses: actions/checkout@v4
+        - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
           with:
             fetch-depth: 0
         - name: Python Semantic Release
-          uses: python-semantic-release/python-semantic-release@master
+          uses: python-semantic-release/python-semantic-release@26bb37cfab71a5a372e3db0f48a6eac57519a4a6 #v9.21.0
           with:
             changelog: "false"
             github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/README.md b/README.md
@@ -79,21 +79,25 @@ These can be installed with [homebrew](https://brew.sh/) on MacOS
 
 ```bash
 brew install node
-brew install nvm
+brew install nvm # Make sure to add nvm to your path
 brew install jq
+nvm install 20 # .github/workflows/pr.yml uses node version 20
 ```
 
 #### Virtual environment example
 
 ```bash
+# `pipes` package required by the `fire` package deprecated in python >3.11
+pyenv install 3.11
+pyenv shell 3.11
 python3 -m venv .venv
 source .venv/bin/activate
 ```
 
 #### Install requirements
 
 ```bash
-nvm use --lts
+nvm use 20
 npm install --location=global aws-cdk
 python3 -m pip install --upgrade pip
 python3 -m pip install -e ".[dev,deploy,test]"
diff --git a/ingest_api/runtime/src/collection_publisher.py b/ingest_api/runtime/src/collection_publisher.py
@@ -15,7 +15,7 @@ def ingest(self, collection: DashboardCollection):
         and loads into the PgSTAC collection table
         """
         creds = get_db_credentials(os.environ["DB_SECRET_ARN"])
-        collection = [collection.to_dict()]
+        collection = [collection.to_dict(exclude_unset=True)]
         with PgstacDB(dsn=creds.dsn_string, debug=True) as db:
             load_into_pgstac(
                 db=db, ingestions=collection, table=IngestionType.collections
diff --git a/ingest_api/runtime/src/schemas.py b/ingest_api/runtime/src/schemas.py
@@ -66,7 +66,7 @@ class DashboardCollection(Collection):
     time_density: Optional[str] = Field(default=None, alias="dashboard:time_density")
     item_assets: Optional[Dict]
     links: Optional[List[LinkWithExtraFields]]
-    assets: Optional[Dict]
+    assets: Optional[Dict] = None
     extent: SpatioTemporalExtent
     model_config = ConfigDict(populate_by_name=True)
     # workaround for https://github.com/pydantic/pydantic/discussions/8211 and https://github.com/pydantic/pydantic/issues/7186 (changes expected on pydantic 3 roadmap)
diff --git a/local/Dockerfile.stac b/local/Dockerfile.stac
@@ -12,9 +12,6 @@ RUN pip install --upgrade pip
 RUN pip install boto3
 
 COPY stac_api/runtime /tmp/stac
-
-COPY common/auth /tmp/stac/common/auth
-RUN pip install /tmp/stac/common/auth
 RUN pip install /tmp/stac 
 RUN rm -rf /tmp/stac
 
diff --git a/raster_api/runtime/src/app.py b/raster_api/runtime/src/app.py
@@ -6,7 +6,7 @@
 from src.algorithms import PostProcessParams
 from src.alternate_reader import PgSTACReaderAlt
 from src.config import ApiSettings
-from src.dependencies import ColorMapParams
+from src.dependencies import ColorMapParams, cmap
 from src.extensions import stacViewerExtension
 from src.monitoring import LoggerRouteHandler, logger, metrics, tracer
 from src.version import __version__ as veda_raster_version
@@ -205,7 +205,8 @@ async def lifespan(app: FastAPI):
 ###############################################################################
 # Colormaps endpoints
 ###############################################################################
-cmaps = ColorMapFactory()
+# Set supported colormaps to be the modified cmap list with added colormaps
+cmaps = ColorMapFactory(supported_colormaps=cmap)
 app.include_router(cmaps.router, tags=["ColorMaps"])
 
 
diff --git a/stac_api/infrastructure/config.py b/stac_api/infrastructure/config.py
@@ -45,16 +45,9 @@ class vedaSTACSettings(BaseSettings):
         description="Description of the STAC Catalog",
     )
 
-    userpool_id: Optional[str] = Field(
-        None, description="The Cognito Userpool used for authentication"
-    )
-    cognito_domain: Optional[AnyHttpUrl] = Field(
-        None,
-        description="The base url of the Cognito domain for authorization and token urls",
-    )
-    client_id: Optional[str] = Field(None, description="The Cognito APP client ID")
-    client_secret: Optional[str] = Field(
-        "", description="The Cognito APP client secret"
+    keycloak_client_id: Optional[str] = Field(None, description="Auth client ID")
+    openid_configuration_url: Optional[AnyHttpUrl] = Field(
+        None, description="OpenID config url"
     )
     stac_enable_transactions: bool = Field(
         False, description="Whether to enable transactions endpoints"
@@ -69,10 +62,10 @@ def check_transaction_fields(cls, values):
         """
         Validates the existence of auth env vars in case stac_enable_transactions is True
         """
-        if values.get("stac_enable_transactions"):
+        if values.get("stac_enable_transactions") == "True":
             missing_fields = [
                 field
-                for field in ["userpool_id", "cognito_domain", "client_id"]
+                for field in ["keycloak_client_id", "openid_configuration_url"]
                 if not values.get(field)
             ]
             if missing_fields:
diff --git a/stac_api/infrastructure/construct.py b/stac_api/infrastructure/construct.py
@@ -42,9 +42,6 @@ def __init__(
             "VEDA_STAC_PROJECT_DESCRIPTION": veda_stac_settings.project_description,
             "VEDA_STAC_ROOT_PATH": veda_stac_settings.stac_root_path,
             "VEDA_STAC_STAGE": stage,
-            "VEDA_STAC_USERPOOL_ID": veda_stac_settings.userpool_id,
-            "VEDA_STAC_CLIENT_ID": veda_stac_settings.client_id,
-            "VEDA_STAC_COGNITO_DOMAIN": str(veda_stac_settings.cognito_domain),
             "VEDA_STAC_ENABLE_TRANSACTIONS": str(
                 veda_stac_settings.stac_enable_transactions
             ),
@@ -53,6 +50,13 @@ def __init__(
             **{k.upper(): v for k, v in veda_stac_settings.env.items()},
         }
 
+        if veda_stac_settings.keycloak_client_id is not None:
+            lambda_env["VEDA_STAC_CLIENT_ID"] = veda_stac_settings.keycloak_client_id
+        if veda_stac_settings.openid_configuration_url is not None:
+            lambda_env["VEDA_STAC_OPENID_CONFIGURATION_URL"] = str(
+                veda_stac_settings.openid_configuration_url
+            )
+
         lambda_function = aws_lambda.Function(
             self,
             "lambda",
diff --git a/stac_api/runtime/Dockerfile b/stac_api/runtime/Dockerfile
@@ -5,8 +5,6 @@ WORKDIR /tmp
 COPY stac_api/runtime /tmp/stac
 
 RUN pip install "mangum" "plpygis>=0.2.1" /tmp/stac -t /asset --no-binary pydantic
-COPY common/auth /tmp/stac/common/auth
-RUN pip install /tmp/stac/common/auth -t /asset
 RUN rm -rf /tmp/stac
 
 # Reduce package size and remove useless files
diff --git a/stac_api/runtime/setup.py b/stac_api/runtime/setup.py
@@ -20,6 +20,7 @@
     "aws_xray_sdk>=2.6.0,<3",
     "pystac[validation]==1.10.1",
     "pydantic>2",
+    "eoapi-auth-utils==0.3.0",
 ]
 
 extra_reqs = {
diff --git a/stac_api/runtime/src/app.py b/stac_api/runtime/src/app.py
diff --git a/stac_api/runtime/src/config.py b/stac_api/runtime/src/config.py
diff --git a/stac_api/runtime/src/routes.py b/stac_api/runtime/src/routes.py
diff --git a/stac_api/runtime/tests/conftest.py b/stac_api/runtime/tests/conftest.py
