how to secure STAC-FASTAPI Transaction Extension

[sylar11]

Hi all,
is there a way to secure the STAC-FASTAPI concerning that Transaction Extension that can be dangerous if everyone can easily run from the API?

[vincentsarago]

you can inject dependencies to the endpoints you want

see https://github.com/stac-utils/stac-fastapi/blob/main/stac_fastapi/api/tests/test_api.py#L74-L85

[sylar11]

@vincentsarago I tried to follow your suggestions but I think I'm doing something wrong.
I installed the pgstac backend as suggested in the repo:

git clone https://github.com/stac-utils/stac-fastapi-pgstac
cd stac-fastapi-pgstac/
pip install -e ".[dev,server,docs]

but first of all if I run make test I got this error

docker-compose run --rm -p 8080:8080 -e APP_HOST=0.0.0.0 -e APP_PORT=8080 app /bin/bash -c 'export && ./scripts/wait-for-it.sh database:5432 && cd /app/tests/ && pytest -vvv --log-cli-level warning'
no configuration file provided: not found
make: *** [Makefile:31: test] Error 14

Moreover, if I look at the file you suggested test_api.py it is different from the one in the link.

could you please tell me what I'm doing wrong?

[vincentsarago]

yes it's different, I just mentioned it to show you how it was implemented in this repo