From aa82a3490f916778fbb28d34bfa806149b979ee1 Mon Sep 17 00:00:00 2001
From: Matthias Laher <59236487+mattyfromtheblock@users.noreply.github.com>
Date: Mon, 24 Feb 2025 11:29:13 +0100
Subject: [PATCH] pass auth token via layered-env to GDAL

---
 semantique/datacube.py | 41 +++++++++++++++++++++++++++++------------
 1 file changed, 29 insertions(+), 12 deletions(-)

diff --git a/semantique/datacube.py b/semantique/datacube.py
index 3ffbb16e..4a396626 100644
--- a/semantique/datacube.py
+++ b/semantique/datacube.py
@@ -712,6 +712,8 @@ class STACCube(Datacube):
         * **reauth_individual** (:obj:`bool`): Should the items be resigned/reauthenticated
         before loading them? Defaults to False.
 
+        * **access_token** (:obj:`str`): Access token string (OAuth2) to be used in accessing the STAC href.
+
         * **value_type_mapping** (:obj:`dict`): How do value type encodings in
           the layout map to the value types used by semantique?
           Defaults to a one-to-one mapping: ::
@@ -774,6 +776,7 @@ def _default_config(self):
             "group_by_solar_day": True,
             "dask_params": None,
             "reauth_individual": False,
+            "access_token": "",
             "value_type_mapping": {
                 "nominal": "nominal",
                 "ordinal": "ordinal",
@@ -937,26 +940,40 @@ def _load(self, metadata, extent):
 
         # return extent array as NaN in case of no data
         if not len(item_coll):
-            empty_arr = xr.full_like(extent, np.NaN)
+            empty_arr = xr.full_like(extent, np.nan)
             return empty_arr
 
+        stackstac_inputs = {
+            "assets": [metadata["name"]],
+            "resampling": resampler_func,
+            "bounds": s_bounds,
+            "epsg": epsg,
+            "resolution": res,
+            "fill_value": lyr_na,
+            "dtype": lyr_dtype,
+            "rescale": False,
+            "errors_as_nodata": (RasterioIOError(".*"),),
+            "xy_coords": "center",
+            "snap_bounds": False,
+        }
+
         # reauth
         if self.config["reauth_individual"]:
             item_coll = STACCube._sign_metadata(item_coll)
 
+        # auth via token
+        if self.config["access_token"]:
+            gdal_env = stackstac.rio_env.LayeredEnv(
+                always=dict(
+                    GDAL_HTTP_AUTH="BEARER",
+                    GDAL_HTTP_BEARER=self.config["access_token"],
+                ), )
+
+            stackstac_inputs["gdal_env"] = gdal_env
+
         data = stackstac.stack(
             item_coll,
-            assets=[metadata["name"]],
-            resampling=resampler_func,
-            bounds=s_bounds,
-            epsg=epsg,
-            resolution=res,
-            fill_value=lyr_na,
-            dtype=lyr_dtype,
-            rescale=False,
-            errors_as_nodata=(RasterioIOError(".*"),),
-            xy_coords="center",
-            snap_bounds=False,
+            **stackstac_inputs
         )
         data = data.compute(**(self.config["dask_params"] or {}))