You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<palign="center">Reverse proxy to apply auth*n scenarios to STAC APIs.</p>
3
+
<palign="center">Reverse proxy to apply auth*n to STAC APIs.</p>
4
4
</div>
5
5
6
6
---
7
7
8
8
> [!WARNING]
9
9
> This project is currently in active development and may change drastically in the near future while we work towards solidifying a first release.
10
10
11
-
STAC Auth Proxy is a proxy API that mediates between the client and an internally accessible STAC API in order to provide a flexible authentication, authorization, and contentfiltering mechanism.
11
+
STAC Auth Proxy is a proxy API that mediates between the client and an internally accessible STAC API to provide a flexible authentication, authorization, and content-filtering mechanism.
12
12
13
13
## Features
14
14
15
15
- 🔐 Authentication: Selectively apply OIDC auth to some or all endpoints & methods
16
16
- 🎟️ Content Filtering: Apply CQL2 filters to client requests, filtering API content based on user context
17
-
- 📖 OpenAPI Augmentation: Update [OpenAPI](https://swagger.io/specification/) with security requirements, keeping auto-generated docs(e.g. [Swagger UI](https://swagger.io/tools/swagger-ui/)) accurate
17
+
- 📖 OpenAPI Augmentation: Update [OpenAPI](https://swagger.io/specification/) with security requirements, keeping auto-generated docs/UIs accurate (e.g. [Swagger UI](https://swagger.io/tools/swagger-ui/))
18
18
19
19
## Usage
20
20
21
21
> [!NOTE]
22
-
> Currently, the project is only installable by downlaoding the repository. It will eventually be available on Docker ([#5](https://github.com/developmentseed/issues/5)) and PyPi ([#30](https://github.com/developmentseed/issues/30)).
22
+
> Currently, the project can only be installed by downloading the repository. It will eventually be available on Docker ([#5](https://github.com/developmentseed/issues/5)) and PyPi ([#30](https://github.com/developmentseed/issues/30)).
23
23
24
24
### Installation
25
25
26
-
For local development, his project uses[`uv`](https://docs.astral.sh/uv/) to manage project dependencies and environment.
26
+
For local development, we use[`uv`](https://docs.astral.sh/uv/) to manage project dependencies and environment.
27
27
28
28
```sh
29
29
uv sync
@@ -32,7 +32,7 @@ uv sync
32
32
Otherwise, the application can be installed as a standard Python module:
33
33
34
34
```sh
35
-
python3 install src
35
+
pip install -e .
36
36
```
37
37
38
38
### Running
@@ -66,16 +66,16 @@ The application is configurable via environment variables.
66
66
-`OIDC_DISCOVERY_INTERNAL_URL`
67
67
- The internal network OpenID Connect discovery document URL
68
68
-**Type:** HTTP(S) URL
69
-
-**Required:** No, defaults to value of `OIDC_DISCOVERY_URL`
69
+
-**Required:** No, defaults to the value of `OIDC_DISCOVERY_URL`
-**Description:** Default access policy for endpoints
73
73
-**Type:** boolean
74
74
-**Default:**`false`
75
75
-**Example:**`false`, `1`, `True`
76
76
-`PRIVATE_ENDPOINTS`
77
-
-**Description:** Endpoints explicitely marked as requiring authentication, for use when `DEFAULT_PUBLIC == True`
78
-
-**Type:** JSON object mapping regex patterns to HTTP methods OR to tuples of HTTP methods and an array of strings representing required scopes.
77
+
-**Description:** Endpoints explicitly marked as requiring authentication, for use when `DEFAULT_PUBLIC == True`
78
+
-**Type:** JSON object mapping regex patterns to HTTP methods OR tuples of HTTP methods and an array of strings representing required scopes
79
79
-**Default:**
80
80
```json
81
81
{
@@ -87,7 +87,7 @@ The application is configurable via environment variables.
87
87
}
88
88
```
89
89
- `PUBLIC_ENDPOINTS`
90
-
- **Description:** Endpoints explicitely marked as not requiring authentication, for use when `DEFAULT_PUBLIC == False`
90
+
- **Description:** Endpoints explicitly marked as not requiring authentication, for use when `DEFAULT_PUBLIC == False`
91
91
- **Type:** JSON object mapping regex patterns to HTTP methods
92
92
- **Default:**
93
93
```json
@@ -132,7 +132,7 @@ The application is configurable via environment variables.
132
132
133
133
### Customization
134
134
135
-
While this project aims to provide utility out-of-the-box as a runnable application, it's likely won't address every project's needs. In these situations, this codebase can instead be treated as a library of components that can be used to augment any webserver that makes use of the [ASGI protocol](https://asgi.readthedocs.io/en/latest/) (e.g. [Django](https://docs.djangoproject.com/en/3.0/topics/async/), [Falcon](https://falconframework.org/), [FastAPI](https://github.com/tiangolo/fastapi),[Litestar](https://litestar.dev/), [Responder](https://responder.readthedocs.io/en/latest/), [Sanic](https://sanic.dev/), [Starlette](https://www.starlette.io/)). Review [`app.py`](https://github.com/developmentseed/stac-auth-proxy/blob/main/src/stac_auth_proxy/app.py) to get a sense of how we make use of the various components to construct a FastAPI application.
135
+
While this project aims to provide utility out-of-the-box as a runnable application, it's likely won't address every project's needs. In these situations, this codebase can instead be treated as a library of components that can be used to augment any webserver that makes use of the [ASGI protocol](https://asgi.readthedocs.io/en/latest/) (e.g. [Django](https://docs.djangoproject.com/en/3.0/topics/async/), [Falcon](https://falconframework.org/), [FastAPI](https://github.com/tiangolo/fastapi),[Litestar](https://litestar.dev/), [Responder](https://responder.readthedocs.io/en/latest/), [Sanic](https://sanic.dev/), [Starlette](https://www.starlette.io/)). Review [`app.py`](https://github.com/developmentseed/stac-auth-proxy/blob/main/src/stac_auth_proxy/app.py) to get a sense of how we make use of the various components to construct a FastAPI application.
136
136
137
137
## Architecture
138
138
@@ -170,7 +170,7 @@ The middleware stack is processed in reverse order (bottom to top):
170
170
171
171
### Data filtering via CQL2
172
172
173
-
In order to provide row-level content filtering, the system supports generating CQL2 filters based on request context. These CQL2 filters are then set on outgoing requests prior to the upstream API.
173
+
The system supports generating CQL2 filters based on request context to provide row-level content filtering. These CQL2 filters are then set on outgoing requests prior to the upstream API.
174
174
175
175
> [!IMPORTANT]
176
176
> The upstream STAC API must support the [STAC API Filter Extension](https://github.com/stac-api-extensions/filter/blob/main/README.md).
0 commit comments