Skip to content

feat(release)!: observability updates, multitenant filtering and authorization on STAC + Ingest API#601

Merged
botanical merged 257 commits into
mainfrom
develop
May 26, 2026
Merged

feat(release)!: observability updates, multitenant filtering and authorization on STAC + Ingest API#601
botanical merged 257 commits into
mainfrom
develop

Conversation

@botanical

@botanical botanical commented May 21, 2026

Copy link
Copy Markdown
Member

Summary

This release extends the STAC API with optional Transactions, multitenancy, and layered authorization, and observability improvements.

API Updates

  • Multitenancy
    • Tenant URL paths with link rewriting in responses
    • Tenant filtering on collections (by filtering on value set by eic:tenant)
  • Transactions
    • Configurable STAC transaction endpoints (requires STAC auth proxy and openID configuration when enabled)
  • Authorization
    • STAC auth proxy: OIDC and JWT scope checks on private transaction routes
    • STAC API: POST, PUT, PATCH on /collections and /collections/{id}
    • Ingest API: POST on /collections

Full description of tests can be found in this spreadsheet

botanical and others added 30 commits September 22, 2025 11:24
…ult stac version (#530)

## What
- STAC metadata validations are currently failing due to a import error
that is corrected in a newer version of pystac
#527.
- The default stac version in the updated pystac is higher than the stac
version of our records so additional configuration was added with a
default value of the current catalog's stac version.

## How tested
The tests are now passing on the github runner:
https://github.com/NASA-IMPACT/veda-backend/actions/runs/17841567081/job/50732312624
botanical and others added 12 commits April 17, 2026 10:29
… extraction middleware tests and logic change
Co-authored-by: Alexandra Kirk <alexandra@developmentseed.org>
### Issue

#596
NASA-IMPACT/veda-architecture#754

### What?

- Updates the docs to include more information about disabling
multitenancy features, distinguishing between filtering and
authorization
- Updates TenantExtractionMiddleware logic for root paths with trailing
slash (so it skips trailing slash removal for `{root_path}/`)
- Adds unit tests for TenantExtractionMiddleware

Tested tenant extraction change in UAH-SIT.
| Test setup | Result |
| --|--|
| Envs: STAC_AUTH_PROXY_ENABLED=False, used v14.0.0-rc.16 | redirect
errors on https://sit.openveda.cloud/api/stac/ |
| Envs: STAC_AUTH_PROXY_ENABLED=False, used this branch's commit SHA |
redirect errors resolved on https://sit.openveda.cloud/api/stac/|

The reason we didn't notice this before is because we never had an
instance tested where we had the Tenant Extraction middleware running
while Tenant Filtering (AKA stac-auth-proxy) was disabled.
### Issue

#600

### What?

Resolves merge conflicts from main into develop branch to prepare for
the release
@botanical botanical marked this pull request as ready for review May 22, 2026 19:00
@botanical

botanical commented May 22, 2026

Copy link
Copy Markdown
Member Author

@botanical botanical changed the title feat(release)!: observability updates, multitenant filtering and authorization on STAC API feat(release)!: observability updates, multitenant filtering and authorization on STAC API May 22, 2026
@botanical botanical changed the title feat(release)!: observability updates, multitenant filtering and authorization on STAC API feat(release)!: observability updates, multitenant filtering and authorization on STAC + Ingest API May 22, 2026
@botanical botanical mentioned this pull request May 22, 2026
17 tasks

@anayeaye anayeaye left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When we cut the release I think we should also include these in the custom summary we add to the automated release notes (not necessarily in this order). I can also add these in!

  • List new env variables (still use drafted release)
  • Note upgrade stac-fastapi to v6
  • Note dynamic item renders links extended to all assets (not just 'dashboard' asset in renders config)
  • removed deprecated ingest-api items/ endpoints

@botanical botanical merged commit ec5d248 into main May 26, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants