docs: clarify when middleware is active

Author: alukach

docs/architecture/middleware-stack.md

@@ -10,23 +10,25 @@ Aside from the actual communication with the upstream STAC API, the majority of
 
 1.  **[`CompressionMiddleware`](https://github.com/developmentseed/starlette-cramjam)**
 
-    - Handles response compression when [`ENABLE_COMPRESSION`](configuration.md#enable_compression) is enabled
+    - **Enabled if:** [`ENABLE_COMPRESSION`](configuration.md#enable_compression) is enabled
+    - Handles response compression
     - Reduces response size for better performance
 
 2.  **[`RemoveRootPathMiddleware`][stac_auth_proxy.middleware.RemoveRootPathMiddleware]**
 
+    - **Enabled if:** [`ROOT_PATH`](configuration.md#root_path) is configured
     - Removes the application root path from incoming requests
     - Ensures requests are properly routed to upstream API
-    - Only active if [`ROOT_PATH`](configuration.md#root_path) is configured
 
 3.  **[`ProcessLinksMiddleware`][stac_auth_proxy.middleware.ProcessLinksMiddleware]**
 
+    - **Enabled if:** [`ROOT_PATH`](configuration.md#root_path) is set or [`UPSTREAM_URL`](configuration.md#upstream_url) path is not `"/"`
     - Updates links in JSON responses to handle root path and upstream URL path differences
     - Removes upstream URL path from links and adds root path if configured
-    - Only active if [`ROOT_PATH`](configuration.md#root_path) is set or `upstream_url.path != "/"`
 
 4.  **[`EnforceAuthMiddleware`][stac_auth_proxy.middleware.EnforceAuthMiddleware]**
 
+    - **Enabled if:** Always active (core authentication middleware)
     - Handles authentication and authorization
     - Configurable public/private endpoints via [`PUBLIC_ENDPOINTS`](configuration.md#public_endpoints) and [`PRIVATE_ENDPOINTS`](configuration.md#private_endpoints)
     - OIDC integration via [`OIDC_DISCOVERY_INTERNAL_URL`](configuration.md#oidc_discovery_internal_url)
@@ -35,47 +37,47 @@ Aside from the actual communication with the upstream STAC API, the majority of
 
 5.  **[`AddProcessTimeHeaderMiddleware`][stac_auth_proxy.middleware.AddProcessTimeHeaderMiddleware]**
 
+    - **Enabled if:** Always active (monitoring middleware)
     - Adds processing time headers to responses
     - Useful for monitoring and debugging
 
 6.  **[`Cql2BuildFilterMiddleware`][stac_auth_proxy.middleware.Cql2BuildFilterMiddleware]**
 
+    - **Enabled if:** [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls) is configured
     - Builds CQL2 filters based on request context/state
     - Places [CQL2 expression](http://developmentseed.org/cql2-rs/latest/python/#cql2.Expr) in request state
-    - Only active if [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls) is configured
 
 7.  **[`Cql2RewriteLinksFilterMiddleware`][stac_auth_proxy.middleware.Cql2RewriteLinksFilterMiddleware]**
 
+    - **Enabled if:** [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls) is configured
     - Rewrites filter parameters in response links to remove applied filters
     - Ensures links in responses show the original filter state
-    - Only active if filtering is enabled (see [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls))
 
 8.  **[`Cql2ApplyFilterQueryStringMiddleware`][stac_auth_proxy.middleware.Cql2ApplyFilterQueryStringMiddleware]**
 
+    - **Enabled if:** [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls) is configured
     - Retrieves [CQL2 expression](http://developmentseed.org/cql2-rs/latest/python/#cql2.Expr) from request state
     - Augments `GET` requests with CQL2 filter by appending to querystring
-    - Only active if filtering is enabled (see [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls))
 
 9.  **[`Cql2ApplyFilterBodyMiddleware`][stac_auth_proxy.middleware.Cql2ApplyFilterBodyMiddleware]**
 
+    - **Enabled if:** [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls) is configured
     - Retrieves [CQL2 expression](http://developmentseed.org/cql2-rs/latest/python/#cql2.Expr) from request state
     - Augments `POST`/`PUT`/`PATCH` requests with CQL2 filter by modifying body
-    - Only active if filtering is enabled (see [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls))
 
 10. **[`Cql2ValidateResponseBodyMiddleware`][stac_auth_proxy.middleware.Cql2ValidateResponseBodyMiddleware]**
 
+    - **Enabled if:** [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls) is configured
     - Retrieves [CQL2 expression](http://developmentseed.org/cql2-rs/latest/python/#cql2.Expr) from request state
     - Validates response against CQL2 filter for non-filterable endpoints
-    - Only active if filtering is enabled (see [`ITEMS_FILTER_CLS`](configuration.md#items_filter_cls) or [`COLLECTIONS_FILTER_CLS`](configuration.md#collections_filter_cls))
 
 11. **[`OpenApiMiddleware`][stac_auth_proxy.middleware.OpenApiMiddleware]**
 
+    - **Enabled if:** [`OPENAPI_SPEC_ENDPOINT`](configuration.md#openapi_spec_endpoint) is set
     - Modifies OpenAPI specification based on endpoint configuration, adding security requirements
     - Configurable via [`OPENAPI_AUTH_SCHEME_NAME`](configuration.md#openapi_auth_scheme_name) and [`OPENAPI_AUTH_SCHEME_OVERRIDE`](configuration.md#openapi_auth_scheme_override)
-    - Only active if [`OPENAPI_SPEC_ENDPOINT`](configuration.md#openapi_spec_endpoint) is configured
 
 12. **[`AuthenticationExtensionMiddleware`][stac_auth_proxy.middleware.AuthenticationExtensionMiddleware]**
-
+    - **Enabled if:** [`ENABLE_AUTHENTICATION_EXTENSION`](configuration.md#enable_authentication_extension) is enabled
     - Adds authentication extension information to STAC responses
     - Annotates links with authentication requirements based on [`PUBLIC_ENDPOINTS`](configuration.md#public_endpoints) and [`PRIVATE_ENDPOINTS`](configuration.md#private_endpoints)
-    - Only active if [`ENABLE_AUTHENTICATION_EXTENSION`](configuration.md#enable_authentication_extension) is enabled