chore: rewrite project structure

.github/workflows/deploy.yml

@@ -48,12 +48,10 @@ jobs:
       USER_STAC_COLLECTION_ID_REGISTRY: ${{ vars.USER_STAC_COLLECTION_ID_REGISTRY }}
       USER_STAC_COLLECTION_TRANSACTIONS_AUTH_MODE: ${{ vars.USER_STAC_COLLECTION_TRANSACTIONS_AUTH_MODE }}
       USER_STAC_COLLECTION_TRANSACTIONS_AUTH_SECRET_ARN: ${{ vars.USER_STAC_COLLECTION_TRANSACTIONS_AUTH_SECRET_ARN }}
-      USER_STAC_COLLECTION_TRANSACTIONS_ENABLED: ${{ vars.USER_STAC_COLLECTION_TRANSACTIONS_ENABLED }}
       USER_STAC_CATALOGS_ENABLED: ${{ vars.USER_STAC_CATALOGS_ENABLED }}
       USER_STAC_CATALOGS_HIDE_ALTERNATE_PARENTS: ${{ vars.USER_STAC_CATALOGS_HIDE_ALTERNATE_PARENTS }}
       USER_STAC_CATALOG_TRANSACTIONS_AUTH_MODE: ${{ vars.USER_STAC_CATALOG_TRANSACTIONS_AUTH_MODE }}
       USER_STAC_CATALOG_TRANSACTIONS_AUTH_SECRET_ARN: ${{ vars.USER_STAC_CATALOG_TRANSACTIONS_AUTH_SECRET_ARN }}
-      USER_STAC_CATALOG_TRANSACTIONS_ENABLED: ${{ vars.USER_STAC_CATALOG_TRANSACTIONS_ENABLED }}
       USER_STAC_STAC_API_CUSTOM_DOMAIN_NAME: ${{ vars.USER_STAC_STAC_API_CUSTOM_DOMAIN_NAME }}
       USER_STAC_TITILER_PGSTAC_API_CUSTOM_DOMAIN_NAME: ${{ vars.USER_STAC_TITILER_PGSTAC_API_CUSTOM_DOMAIN_NAME }}
       WEB_ACL_ARN: ${{ vars.WEB_ACL_ARN }}
@@ -62,14 +60,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
-          node-version: 20
-          cache: 'npm'
+          enable-cache: true
 
       - name: Install dependencies
-        run: npm ci
+        run: uv sync --locked
 
       - name: Assume Github OIDC role
         uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
@@ -103,8 +100,8 @@ jobs:
           echo "AWS_DEFAULT_REGION=us-west-2" >> $GITHUB_ENV
 
       - name: Run CDK synth
-        run: npm run cdk -- synth
+        run: uv run npx cdk synth "*"
 
       - name: Run CDK deploy
         if: github.event_name == 'workflow_dispatch'
-        run: npm run cdk -- deploy --all --require-approval never
+        run: uv run npx cdk deploy "*" --require-approval never

.github/workflows/tests.yml

@@ -10,28 +10,6 @@ on:
   workflow_dispatch:
 
 jobs:
-  node-tests:
-    name: node-tests
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "20"
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
   python-runtime-tests:
     name: pytest (${{ matrix.runtime.name }})
     runs-on: ubuntu-latest
@@ -54,11 +32,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:

.gitignore

@@ -1,16 +1,12 @@
-*.js
-!jest.config.js
-*.d.ts
-node_modules
-
 .pyc
 __pycache__
+.pytest_cache
 .venv
-.env
-.envrc
+.env*
 .env-test
 .test-env
 .DS_Store
+.ruff_cache
 
 # CDK asset staging directory
 .cdk.staging

README.md

@@ -5,7 +5,7 @@
 
 ## Overview
 
-This repository contains the AWS CDK code (written in typescript) used to deploy the MAAP project eoapi infrastructure. It is based on the [eoapi-template example](https://github.com/developmentseed/eoapi-template). For the MAAP use case, we use a subset of the eoapi CDK constructs to define a database, an ingestion API, a STAC API, a raster API (i.e a tiling API) and a pgbouncer instance to manage connections to the database. Here, we deploy all these components into a custom VPC.
+This repository contains the AWS CDK code (written in Python) used to deploy the MAAP project eoapi infrastructure. It is based on the [eoapi-template example](https://github.com/developmentseed/eoapi-template). For the MAAP use case, we use a subset of the eoapi CDK constructs to define a database, an ingestion API, a STAC API, a raster API (i.e a tiling API) and a pgbouncer instance to manage connections to the database. Here, we deploy all these components into a custom VPC.
 
 
 ## Automated Deployment
@@ -20,13 +20,11 @@ User STAC catalog configuration:
 
 - `USER_STAC_CATALOGS_ENABLED=false` disables read-only `/catalogs` routes.
 - `USER_STAC_CATALOGS_HIDE_ALTERNATE_PARENTS=true` hides alternate parent links in catalog responses.
-- `USER_STAC_CATALOG_TRANSACTIONS_ENABLED=true` enables catalog write routes. This requires catalogs to stay enabled.
-- `USER_STAC_CATALOG_TRANSACTIONS_AUTH_MODE=basic` selects the supported auth mode.
+- `USER_STAC_CATALOG_TRANSACTIONS_AUTH_MODE=basic` enables catalog write routes and selects the supported auth mode. Catalog write routes require catalogs to stay enabled.
 - `USER_STAC_CATALOG_TRANSACTIONS_AUTH_SECRET_ARN` can point at an existing auth secret.
 
 Collection-only STAC transactions can still be enabled with:
 
-- `USER_STAC_COLLECTION_TRANSACTIONS_ENABLED=true`
 - `USER_STAC_COLLECTION_TRANSACTIONS_AUTH_MODE=basic`
 
 When either collection or catalog transactions are enabled, this CDK stack creates and manages the Secrets Manager secret used for STAC basic auth by default, grants the STAC Lambda read access to it, and publishes the secret ARN to SSM at:
@@ -69,7 +67,7 @@ For a catalogs-enabled deployment, verify:
 
 - OpenAPI includes read-only catalog routes such as `GET /catalogs`, `GET /catalogs/{catalog_id}`, and catalog-scoped collection/item reads.
 - `GET /` includes `rel="child"` links for listed catalogs so STAC Browser can discover catalog roots.
-- catalog write routes are absent unless `USER_STAC_CATALOG_TRANSACTIONS_ENABLED=true`.
+- catalog write routes are absent unless `USER_STAC_CATALOG_TRANSACTIONS_AUTH_MODE=basic` is configured.
 
 For a transaction-enabled internal deployment, verify:
 

app.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+import aws_cdk as cdk
+
+from cdk.config import Config
+from cdk.maap_eoapi_common import MaapEoapiCommon
+from cdk.patch_manager import PatchManagerStack
+from cdk.pgstac_infra import PgStacInfra
+from cdk.vpc import VpcStack
+
+config = Config()
+
+app = cdk.App()
+dps_stac_item_gen_config = config.dps_stac_item_gen()
+
+vpc_stack = VpcStack(
+    app,
+    config.build_stack_name("vpc"),
+    termination_protection=False,
+    tags=config.tags,
+    nat_gateway_count=None if config.stage == "prod" else 1,
+)
+
+# Create common resources to be shared by pgSTAC and userSTAC stacks
+common = MaapEoapiCommon(
+    app,
+    config.build_stack_name("common"),
+    tags=config.tags,
+    stage=config.stage,
+    termination_protection=False,
+)
+
+core_infrastructure = PgStacInfra(
+    app,
+    config.build_stack_name("pgSTAC"),
+    vpc=vpc_stack.vpc,
+    tags=config.tags,
+    stage=config.stage,
+    type="public",
+    version=config.version,
+    certificate_arn=config.certificate_arn,
+    web_acl_arn=config.web_acl_arn,
+    logging_bucket_arn=common.logging_bucket.bucket_arn,
+    pgstac_db_config=config.pgstac_db(),
+    stac_api_config=config.public_stac_api(),
+    titiler_pgstac_config=config.public_titiler_pgstac(),
+    stac_browser_config=config.stac_browser(),
+    ingestor_config=config.ingestor(),
+    add_stactools_item_generator=True,
+    termination_protection=False,
+)
+
+user_infrastructure = PgStacInfra(
+    app,
+    config.build_stack_name("userSTAC"),
+    vpc=vpc_stack.vpc,
+    tags=config.tags,
+    stage=config.stage,
+    type="internal",
+    version=config.version,
+    certificate_arn=config.certificate_arn,
+    web_acl_arn=config.web_acl_arn,
+    logging_bucket_arn=common.logging_bucket.bucket_arn,
+    pgstac_db_config=config.pgstac_db(),
+    stac_api_config=config.user_stac_api(),
+    titiler_pgstac_config=config.user_titiler_pgstac(),
+    add_stactools_item_generator=False,
+    **(
+        {"dps_stac_item_gen_config": dps_stac_item_gen_config}
+        if dps_stac_item_gen_config
+        else {}
+    ),
+    termination_protection=False,
+)
+
+patch_manager = PatchManagerStack(
+    app,
+    config.build_stack_name("patch-manager"),
+    pgbouncer_param_names=[
+        f"/maap-eoapi/{config.stage}/public/pgbouncer-instance-id",
+        f"/maap-eoapi/{config.stage}/internal/pgbouncer-instance-id",
+    ],
+    termination_protection=False,
+)
+patch_manager.add_dependency(core_infrastructure)
+patch_manager.add_dependency(user_infrastructure)
+
+app.synth()

cdk.json

@@ -1,17 +1,17 @@
 {
-  "app": "npx ts-node --prefer-ts-exts cdk/app.ts",
+  "app": "python app.py",
   "watch": {
     "include": ["**"],
     "exclude": [
       "README.md",
       "cdk*.json",
       "**/*.d.ts",
       "**/*.js",
-      "tsconfig.json",
-      "package*.json",
-      "yarn.lock",
       "node_modules",
-      "test"
+      "tests",
+      "**/__pycache__",
+      "**/.venv",
+      "uv.lock"
     ]
   },
   "context": {