feat: retrieve tenant from collection for items and ingest endpoints by botanical · Pull Request #573 · NASA-IMPACT/veda-backend

botanical · 2026-03-13T21:07:34Z

Issue

#559
And to begin supporting #560

What?

This handles item operations, making a look up on the collection object's tenant property to determine tenancy and then calling out to the PDP to ensure the user has permission to make that item request.
Extends PEP to ingest DELETE endpoint

Testing?

https://sit.openveda.cloud/api/ingest/docs
https://sit.openveda.cloud/api/stac/docs

API	Test Case	Expected Result	Actual Result
STAC	User in tenant1 is able to update an item in tenant1	Allow	✅
STAC	User in tenant1 is able to delete an item in tenant1	Allow	✅
STAC	User in tenant2 attempt to delete item in tenant1	Deny	✅
STAC	User in tenant1 attempts to patch an item in tenant2	Deny	✅
STAC	User with no tenant memberships updates a public item	Allow	✅
Ingest	User is an Admin of Tenant 1 and tries to delete a tenant1 collection	Allow	✅
Ingest	User is an Editor of Tenant 1 and tries to delete a collection in tenant1	Deny	✅
Ingest	User is an Editor of Tenant 2 and tries to delete a collection in tenant1	Deny	✅
Ingest	User is an Admin of Tenant 2 and tries to delete a collection in tenant1	Deny	✅

smohiudd

collection_tenant_resolver and querying the db looks like a good way to get the tenant for items endpoints. No proposed changes from me.

…a-backend into mt-uma/pep-items

…te lookup method, add to config

…nfig

botanical · 2026-03-25T21:36:38Z

+        )
+        creds = get_db_credentials(os.environ["DB_SECRET_ARN"])
+        try:
+            with PgstacDB(dsn=creds.dsn_string, debug=True) as db:


I initially tried to use the collection loader / VEDALoader to get information on the collection, but because the tenancy field is non standard, it didn't yield any results compared to directly querying like so (lines 49-50).

sandrahoang686 · 2026-03-30T18:01:28Z

+            tenant = await _collection_tenant_for_item(request, collection_id)
+            if tenant:
+                return STAC_COLLECTION_TEMPLATE.format(tenant)
+            return _stac_collection_resource_id(request)


Can probably remove this? Since without this, it will next land on line 153 which is returning same?

I think we need it because, otherwise, it wouldn't land on line 153 but it would land on the outermost return which would be None, and we want to make sure it falls back to get the collection resource ID using the request if it doesn't manage to resolve using the resolver (looking up in the DB in the case of DELETEs)

sandrahoang686 · 2026-03-30T18:11:05Z

+
+
+async def _extract_item_stac_resource_id(
+    request: Request, path: str, method: str


is method being used?

😯 good call out! Let me remove it

…h logic

sandrahoang686

code wise - lgtm!

fix: wip retrieve tenant from collection

4760fe4

botanical added the work in progress label Mar 13, 2026

botanical changed the title ~~fix: wip retrieve tenant from collection proof of concept~~ fix: wip retrieve tenant from collection for items proof of concept Mar 13, 2026

botanical added 5 commits March 13, 2026 14:48

fix: break up function, fix linting errors

583c1d2

fix: add some tests

c62415b

fix: update tests to use item from conftest

fad4908

fix: move resolver outside of lifespan

62e052b

fix: update resource extractors to check for tenant strings:

793e74b

smohiudd approved these changes Mar 19, 2026

View reviewed changes

botanical changed the title ~~fix: wip retrieve tenant from collection for items proof of concept~~ feat(stac): wip retrieve tenant from collection for items proof of concept Mar 19, 2026

botanical added 20 commits March 24, 2026 09:29

feat: wip extend to ingest api

fb8dd98

Merge branch 'develop' into mt-uma/pep-items

59626e6

Merge branch 'mt-uma/pep-items' of https://github.com/NASA-IMPACT/ved…

ec9a8eb

…a-backend into mt-uma/pep-items

fix: linting and set tenant resolver always

ea3a243

fix: fix template response

2f862dc

Merge branch 'develop' into mt-uma/pep-items

3367a16

fix: extend tenant lookup resolver to stac delete endpoint

205ae6b

feat: extend pep to delete ingest endpoint

45cf990

fix: update tests

9ad6e67

fix: update pep integration tests

64a2a39

fix: update readme for ingest delete endpoint description

5aeac85

fix: update ingest api to include tenant filter field in lambda, upda…

19e5443

…te lookup method, add to config

fix: formatting

7e17817

fix: add debug logging

eaa8435

fix: add more logging

98906eb

fix: try alternative collection lookup and add validation alias to co…

469c7f4

…nfig

fix: add logging to determine content shape

8391d89

fix: update log level

1e13f3f

fix: update logs and remove tuple, use dict only

3e63e03

fix: linting

470e5ed

botanical commented Mar 25, 2026

View reviewed changes

fix: simplify logging

4281ed0

botanical changed the title ~~feat(stac): wip retrieve tenant from collection for items proof of concept~~ feat(stac): retrieve tenant from collection for items and ingest endpoints Mar 25, 2026

botanical changed the title ~~feat(stac): retrieve tenant from collection for items and ingest endpoints~~ feat: retrieve tenant from collection for items and ingest endpoints Mar 25, 2026

botanical added needs review and removed work in progress labels Mar 25, 2026

botanical requested review from aliziel, anayeaye, ividito, sandrahoang686, smohiudd and stephenkilbourn March 25, 2026 21:48

sandrahoang686 reviewed Mar 30, 2026

View reviewed changes

fix: remove unused method param, consolidate items and bulk items pat…

60b529e

…h logic

sandrahoang686 approved these changes Apr 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: retrieve tenant from collection for items and ingest endpoints#573

feat: retrieve tenant from collection for items and ingest endpoints#573
botanical wants to merge 28 commits intodevelopfrom
mt-uma/pep-items

botanical commented Mar 13, 2026 •

edited

Loading

Uh oh!

smohiudd left a comment •

edited

Loading

Uh oh!

botanical Mar 25, 2026

Uh oh!

sandrahoang686 Mar 30, 2026

Uh oh!

botanical Mar 31, 2026

Uh oh!

sandrahoang686 Mar 30, 2026

Uh oh!

botanical Mar 31, 2026

Uh oh!

botanical Mar 31, 2026

Uh oh!

Uh oh!

sandrahoang686 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants



		async def _extract_item_stac_resource_id(
		request: Request, path: str, method: str

Conversation

botanical commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

What?

Testing?

Uh oh!

smohiudd left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

botanical Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

sandrahoang686 Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

botanical Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

sandrahoang686 Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

botanical Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

botanical Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sandrahoang686 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

botanical commented Mar 13, 2026 •

edited

Loading

smohiudd left a comment •

edited

Loading