Database authorization capability with SSL disabled

Author: Grzegorz Pustulka

stac_fastapi/elasticsearch/stac_fastapi/elasticsearch/config.py

@@ -51,6 +51,10 @@ def _es_config() -> Dict[str, Any]:
     if http_compress:
         config["http_compress"] = True
 
+    # Handle authentication
+    if (u := os.getenv("ES_USER")) and (p := os.getenv("ES_PASS")):
+        config["http_auth"] = (u, p)
+
     # Explicitly exclude SSL settings when not using SSL
     if not use_ssl:
         return config
@@ -63,10 +67,6 @@ def _es_config() -> Dict[str, Any]:
     if config["verify_certs"]:
         config["ca_certs"] = os.getenv("CURL_CA_BUNDLE", certifi.where())
 
-    # Handle authentication
-    if (u := os.getenv("ES_USER")) and (p := os.getenv("ES_PASS")):
-        config["http_auth"] = (u, p)
-
     return config
 
 

stac_fastapi/opensearch/stac_fastapi/opensearch/config.py

@@ -39,18 +39,6 @@ def _es_config() -> Dict[str, Any]:
     if http_compress:
         config["http_compress"] = True
 
-    # Explicitly exclude SSL settings when not using SSL
-    if not use_ssl:
-        return config
-
-    # Include SSL settings if using https
-    config["ssl_version"] = ssl.PROTOCOL_SSLv23
-    config["verify_certs"] = get_bool_env("ES_VERIFY_CERTS", default=True)
-
-    # Include CA Certificates if verifying certs
-    if config["verify_certs"]:
-        config["ca_certs"] = os.getenv("CURL_CA_BUNDLE", certifi.where())
-
     # Handle authentication
     if (u := os.getenv("ES_USER")) and (p := os.getenv("ES_PASS")):
         config["http_auth"] = (u, p)
@@ -64,6 +52,18 @@ def _es_config() -> Dict[str, Any]:
 
         config["headers"] = headers
 
+    # Explicitly exclude SSL settings when not using SSL
+    if not use_ssl:
+        return config
+
+    # Include SSL settings if using https
+    config["ssl_version"] = ssl.PROTOCOL_SSLv23
+    config["verify_certs"] = get_bool_env("ES_VERIFY_CERTS", default=True)
+
+    # Include CA Certificates if verifying certs
+    if config["verify_certs"]:
+        config["ca_certs"] = os.getenv("CURL_CA_BUNDLE", certifi.where())
+
     return config