feat(stac): policy enforcement point proof of concept by botanical · Pull Request #569 · NASA-IMPACT/veda-backend

botanical · 2026-02-14T01:34:43Z

Issue

What?

Creates proof of concept Policy Enforcement Point on STAC and Ingest API's POST /collections endpoints
Handles writes for tenantless collections for users who are developers but do not belong to any tenant group

Testing?

Integration tests and ad hoc testing matrix (Tested on SIT https://sit.openveda.cloud/api/stac/docs)

API	Test Case	Expected Result	Actual Result
STAC	User is an Admin of Tenant 1	Can POST to tenant1	✅
STAC	User is an Editor of Tenant 1	Can POST to tenant1	✅
STAC	User is NOT an Admin of Tenant 1, and NOT an editor	Can't POST to tenant1	✅
Ingest	User is an Admin of Tenant 1	Can POST to tenant1	✅
Ingest	User is an Editor of Tenant 1	Can POST to tenant1	✅
Ingest	User is NOT an Admin of Tenant 1, and NOT an editor	Can't POST to tenant1	✅
STAC	User is an Admin of Tenant 2	Can POST to tenant2	✅
STAC	User is an Editor of Tenant 2	Can POST to tenant2	✅
STAC	User is NOT an Admin of Tenant 2, and NOT an editor of Tenant 2	Can't POST to tenant2	✅
Ingest	User is an Admin of Tenant 2	Can POST to tenant2	✅
Ingest	User is an Editor of Tenant 2	Can POST to tenant2	✅
Ingest	User is NOT an Admin of Tenant 2, and NOT an editor of Tenant 2	Can't POST to tenant2	✅
STAC	User is an Admin of Tenant 3	Can POST to tenant3	✅
STAC	User is an Editor of Tenant 3	Can POST to tenant3	✅
STAC	User is NOT an Admin of Tenant 3, and NOT an editor of Tenant 3	Can't POST to tenant3	✅
Ingest	User is an Admin of Tenant 3	Can POST to tenant3	✅
Ingest	User is an Editor of Tenant 3	Can POST to tenant3	✅
Ingest	User is NOT an Admin of Tenant 3, and NOT an editor of Tenant 3	Can't POST to tenant3	✅
STAC	User is NOT a part of any tenancy but is a developer	Can post a public "tenant-less" collection	✅
Ingest	User is NOT a part of any tenancy but is a developer	Can post a public "tenant-less" collection	✅

…sname

…stac api

common/auth/veda_auth/keycloak_client.py

common/auth/veda_auth/pep_middleware.py

Co-authored-by: sandrahoang686 <sandrahoang686@gmail.com>

…p middleware

smohiudd · 2026-03-03T17:37:01Z

common/auth/veda_auth/resource_extractors.py

    return None


 async def extract_ingest_resource_id(request: Request) -> Optional[str]:


I should have asked this in the resource extractor PR, sorry...do we need to consider the ingest api /ingestions/* endpoints POST, PATCH and DELETE?

No worries @smohiudd. Yes, eventually to cover the ingestions endpoints but not all of them. We need to cover POST, but I think PATCH only updates the status and message right?

ividito

A couple questions and very minor suggestions. It all works as intended AFAIK. Ran most tests locally and also tried a few requests to SIT.

ividito · 2026-03-05T18:43:53Z

common/auth/veda_auth/keycloak_client.py

+        See https://www.keycloak.org/docs/latest/authorization_services/#_service_rpt_overview
+        """
+        for permission in permissions:
+            rsname = permission.get("rsname") or permission.get("resource_id")


I'm unclear on why rsid isn't relevant to check anymore

Yeah that's a good question! Basically we're not using rsid because the RPT puts the name in rsname (e.g. "stac:item:faketenant2:*") and the UUID in rsid (and sometimes in resource_id). You can check this yourself by requesting an RPT and introspecting it but basically it will show something like

{ "scopes": [ "read" ], "rsid": "some-uuid", "rsname": "stac:item:faketenant2:*", "resource_id": "some-uuid", "resource_scopes": [ "read" ] }

We need the name to match and to parse type/tenant, so we use rsname (and resource_id when it’s the name). rsid only ever gives us the UUID which we don't use. I guess really we don't need resource_id but I had that as a fallback because I wasn't sure where keycloak would put the resource name.

ividito · 2026-03-05T18:50:11Z

common/auth/veda_auth/keycloak_client.py

+                "Access token is expired or invalid. Please re-authenticate."
+            ) from error
+        if error.response.status_code == 403:
+            return False


What do you think about raising another error (PermissionDeniedError?) here and catching it in the middleware? I think the return False/raise Error pattern is a bit confusing, this way we could replace https://github.com/NASA-IMPACT/veda-backend/pull/569/changes#diff-4857746bfd90942dbb37adfab0448bb3a8c3683230e3fadf002e8e89b615445cR187-R202 with another except block

I think your suggestion makes sense! The bool/error return is confusing, sorry about that.
2176ff9 What do you think of something like this?

ividito · 2026-03-05T18:52:29Z

stac_api/runtime/src/app.py

 )
 from src.extension import TiTilerExtension
 from stac_auth_proxy import configure_app
+from veda_auth.pep_middleware import PEPMiddleware


nit: should we put this import in the same conditional that instantiates it?

ividito · 2026-03-05T18:53:17Z

stac_api/runtime/src/app.py

+    )
+else:
+    logger.info(
+        "PEP middleware disabled,  openid_url=%s, secret_name=%s",


Suggested change

"PEP middleware disabled, openid_url=%s, secret_name=%s",

"PEP middleware disabled, openid_url=%s, secret_name=%s",

smohiudd · 2026-03-09T15:35:02Z

common/auth/veda_auth/pep_middleware.py

+                resource_id=resource_id,
+                scope=scope,
+            )
+        except TokenError as e:


Appreciate the structured and comprehensive error responses!

botanical added 14 commits February 12, 2026 14:30

fix: move parse_keycloak_from_openid_url to common/auth package to reuse

66d464b

fix: linting and generalize regexes to use in pep middleware

a17407f

feat: create policy enforcement point for stac api

921095c

feat: add pep middleware to stac api

2d96128

fix: import common auth in dockerfile

9d08bef

fix: attempt to resolve dependencies

9e5a724

fix: add debugging

0629819

fix: env vars for lambda

283f9ab

fix: update to use keycloak secret instead

605a881

fix: add prefix to keycloak secret env var

bb514b4

fix: update error message, and also update keycloak client to check r…

e4c4a9d

…sname

fix: catch invalid token case and throw helpful error

b0a0342

fix: move pep middleware to common auth so it's reusable

38bc05f

fix: add pep middleware to ingest api, delete old middleware file in …

c64d035

…stac api

botanical added the work in progress label Feb 14, 2026

botanical added 8 commits February 13, 2026 17:57

fix: formatting

bec19a6

feat: add integration tests for proof of concept

3fa37e1

fix: attempt to fix mutable mapping incompatible type issue

cd79d46

fix: attempt to fix tests, and enable transactions on pep int tests

266818c

fix: add logging to conftest to debug

480d5bb

fix: linting

e7c004f

fix: clear cache and reload config and app to properly register endpoint

aaf029a

fix: add root path to pep int tests

e4f0113

sandrahoang686 reviewed Feb 18, 2026

View reviewed changes

common/auth/veda_auth/keycloak_client.py Show resolved Hide resolved

common/auth/veda_auth/keycloak_client.py Outdated Show resolved Hide resolved

common/auth/veda_auth/keycloak_client.py Show resolved Hide resolved

common/auth/veda_auth/pep_middleware.py Show resolved Hide resolved

botanical and others added 3 commits February 18, 2026 10:17

fix: add back arg comment

e360ced

Update common/auth/veda_auth/keycloak_client.py

a6e4f60

Co-authored-by: sandrahoang686 <sandrahoang686@gmail.com>

fix: add path to error message, and add error message function for pe…

5c0b8c1

…p middleware

botanical marked this pull request as ready for review February 19, 2026 23:19

botanical added needs review and removed work in progress labels Feb 19, 2026

botanical requested review from anayeaye and smohiudd February 20, 2026 00:57

botanical added 2 commits March 2, 2026 09:51

fix: add case to handle nonexistent tenant

b2380c2

fix: attempt to fix tests

9b033e0

smohiudd reviewed Mar 3, 2026

View reviewed changes

ividito approved these changes Mar 5, 2026

View reviewed changes

botanical added 6 commits March 6, 2026 14:53

fix: create new error for permission denied

2176ff9

Merge branch 'develop' into mt-uma/pep-poc

601fdc1

fix: remove return type on check_permission

31c8873

fix: formatting, remove unused variable

a8a9a55

fix: update readme

6721ff0

fix: update tests

afdc19a

smohiudd reviewed Mar 9, 2026

View reviewed changes

fix: spacing, move import

243a793

botanical merged commit 1f45cb4 into develop Mar 9, 2026
4 checks passed

botanical deleted the mt-uma/pep-poc branch March 9, 2026 17:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(stac): policy enforcement point proof of concept#569

feat(stac): policy enforcement point proof of concept#569
botanical merged 34 commits intodevelopfrom
mt-uma/pep-poc

botanical commented Feb 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smohiudd Mar 3, 2026

Uh oh!

botanical Mar 3, 2026

Uh oh!

ividito left a comment

Uh oh!

ividito Mar 5, 2026

Uh oh!

botanical Mar 6, 2026

Uh oh!

ividito Mar 5, 2026

Uh oh!

botanical Mar 6, 2026

Uh oh!

ividito Mar 5, 2026

Uh oh!

ividito Mar 5, 2026

Uh oh!

smohiudd Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		return None


		async def extract_ingest_resource_id(request: Request) -> Optional[str]:

	"PEP middleware disabled, openid_url=%s, secret_name=%s",
	"PEP middleware disabled, openid_url=%s, secret_name=%s",

Conversation

botanical commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

What?

Testing?

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ividito left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

botanical commented Feb 14, 2026 •

edited

Loading