Sign model URL when needed. Open-EO/openeo-geopyspark-driver#562

openeo_driver/views.py

@@ -1346,7 +1346,7 @@ def _download_ml_model_metadata(job_id: str, file_name: str, user_id) -> flask.R
         for asset in assets.values():
             if not asset["href"].startswith("http"):
                 asset_file_name = pathlib.Path(asset["href"]).name
-                asset["href"] = url_for('.download_job_result', job_id=job_id, filename=asset_file_name, _external=True)
+                asset["href"] = _job_result_download_url(job_id, user_id, asset_file_name)
         stac_item = {
             "stac_version": ml_model_metadata.get("stac_version", "0.9.0"),
             "stac_extensions": ml_model_metadata.get("stac_extensions", []),

tests/test_views.py

@@ -2565,6 +2565,16 @@ def test_get_job_result_item(self, flask_app, api110, backend_config_overrides):
             extensions=resp_data.get("stac_extensions", []),
         )
 
+    @mock.patch("time.time", mock.MagicMock(return_value=1234))
+    @pytest.mark.parametrize("backend_config_overrides", [{"url_signer": UrlSigner(secret="123&@#", expiration=1000)}])
+    def test_download_ml_model_metadata_signed(self, flask_app, api110, backend_config_overrides):
+        with self._fresh_job_registry():
+            resp = api110.get(
+                "/jobs/53c71345-09b4-46b4-b6b0-03fd6fe1f199/results/items/ml_model_metadata.json",
+                headers=self.AUTH_HEADER,
+            )
+        assert "expires" in resp.assert_status_code(200).json["assets"]["model"]["href"]  # signed result
+
     @mock.patch("time.time", mock.MagicMock(return_value=1234))
     def test_download_ml_model_metadata(self, flask_app, api110, backend_config_overrides):
         with self._fresh_job_registry():
@@ -2573,6 +2583,7 @@ def test_download_ml_model_metadata(self, flask_app, api110, backend_config_over
                 headers=self.AUTH_HEADER,
             )
         random_id = resp.assert_status_code(200).json["id"]
+        assert "expires" not in resp.assert_status_code(200).json["assets"]["model"]["href"]  # not signed result
         assert resp.assert_status_code(200).json == {
             'id': random_id,
             'type': 'Feature',