fix: Adding a key for technical/private data in SFEOS

Author: Yuri Zmytrakov

stac_fastapi/core/stac_fastapi/core/serializers.py

@@ -2,6 +2,7 @@
 
 import abc
 import logging
+import os
 from copy import deepcopy
 from typing import Any, List, Optional
 
@@ -108,7 +109,7 @@ def db_to_stac(cls, item: dict, base_url: str) -> stac_types.Item:
         else:
             assets = item.get("assets", {})
 
-        return stac_types.Item(
+        stac_item = stac_types.Item(
             type="Feature",
             stac_version=item.get("stac_version", ""),
             stac_extensions=item.get("stac_extensions", []),
@@ -121,6 +122,11 @@ def db_to_stac(cls, item: dict, base_url: str) -> stac_types.Item:
             assets=assets,
         )
 
+        private_data_field = os.getenv("PRIVATE_DATA_FIELD")
+        if get_bool_env("HIDE_PRIVATE_DATA") and private_data_field:
+            stac_item.pop(private_data_field, None)
+        return stac_item
+
 
 class CollectionSerializer(Serializer):
     """Serialization methods for STAC collections."""

stac_fastapi/tests/api/test_api.py

@@ -1657,3 +1657,55 @@ async def test_use_datetime_false(app_client, load_test_data, txn_client, monkey
 
     assert "test-item-datetime-only" not in found_ids
     assert "test-item-start-end-only" in found_ids
+
+
+@pytest.mark.asyncio
+async def test_hide_private_data_true(app_client, txn_client, load_test_data):
+    """Test hiding the private data from response"""
+
+    os.environ["PRIVATE_DATA_FIELD"] = "private_field"
+    os.environ["HIDE_PRIVATE_DATA"] = "true"
+
+    test_collection = load_test_data("test_collection.json")
+    test_collection_id = "test-collection-hide-private-data"
+    test_collection["id"] = test_collection_id
+    await create_collection(txn_client, test_collection)
+
+    test_item = load_test_data("test_item.json")
+    test_item_id = "test-item-hide-private-data"
+    test_item["id"] = test_item_id
+    test_item["collection"] = test_collection_id
+    test_item["private_data"] = {"item_secret": "sensitive_info"}
+    await create_item(txn_client, test_item)
+
+    # Test /collections/{collection_id}/items
+    resp = await app_client.get(f"/collections/{test_collection_id}/items")
+    assert resp.status_code == 200
+    resp_json = resp.json()
+    item = resp_json["features"][0]
+    assert "private_data" not in item
+
+    # Test /collections/{collection_id}/items/{item_id}
+    resp = await app_client.get(
+        f"/collections/{test_collection_id}/items/{test_item_id}"
+    )
+    assert resp.status_code == 200
+    resp_json = resp.json()
+    assert "private_data" not in resp_json
+
+    # Test GET /search
+    resp = await app_client.get(f"/search?collections={test_collection_id}")
+    assert resp.status_code == 200
+    resp_json = resp.json()
+    item = resp_json["features"][0]
+    assert "private_data" not in item
+
+    # Test POST /search
+    resp = await app_client.post("/search", json={"collections": [test_collection_id]})
+    assert resp.status_code == 200
+    resp_json = resp.json()
+    item = resp_json["features"][0]
+    assert "private_data" not in item
+
+    del os.environ["PRIVATE_DATA_FIELD"]
+    del os.environ["HIDE_PRIVATE_DATA"]