downloading STAC 1.1 asset returns 401 Unauthorized

[bossie]

Example job on Terrascope prod: j-2601060936304db8ab09986ed10481fa with "stac-version-experimental": "1.1"

Attempting to download an asset returns a 401 Unauthorized.

Asset href looks like this (note the absolute /data/projects/... path): https://openeo.vito.be/openeo/1.2/jobs/j-2601060936304db8ab09986ed10481fa/results/assets/.../...//data/projects/OpenEO/j-2601060936304db8ab09986ed10481fa/openEO_2023-09-07Z.tif?expires=1768299594

[soxofaan]

does it work after removing ``.../...//data/projects/OpenEO/j-2601060936304db8ab09986ed10481fa` from the URL?

also strange that there triple dots components in there

[bossie]

This is the original error:

{"code":"AuthenticationRequired","id":"r-26010713225843cd9a6953fcec92fbb9","message":"Unauthorized."}

which maps to this stack trace:

Traceback (most recent call last):
  File "/opt/venv/lib64/python3.8/site-packages/flask/app.py", line 880, in full_dispatch_request
    rv = self.dispatch_request()
  File "/opt/venv/lib64/python3.8/site-packages/flask/app.py", line 865, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)  # type: ignore[no-any-return]
  File "/opt/venv/lib64/python3.8/site-packages/openeo_driver/users/auth.py", line 85, in decorated
    user = self.get_user_from_bearer_token(flask.request)
  File "/opt/venv/lib64/python3.8/site-packages/openeo_driver/users/auth.py", line 110, in get_user_from_bearer_token
    bearer = self.get_auth_token(request, "Bearer")
  File "/opt/venv/lib64/python3.8/site-packages/openeo_driver/users/auth.py", line 100, in get_auth_token
    raise AuthenticationRequiredException
openeo_driver.errors.AuthenticationRequiredException: Unauthorized.

My guess is that the python-driver does not recognize this as a signed URL and goes looking for the Bearer token instead (there is none).

does it work after removing ``.../...//data/projects/OpenEO/j-2601060936304db8ab09986ed10481fa` from the URL?

No:

{"code":"CredentialsInvalid","id":"r-26010713272840a6a79c39dba186bc22","message":"Credentials are not correct."}

but that is to be expected because the file name is part of the signature.

also strange that there triple dots components in there

I redacted some parts because paranoia.

Anyway, this probably just an oversight in #430 and needs a fix.