eodag 3.4.3__tar.gz → 3.5.0__tar.gz

{eodag-3.4.3 → eodag-3.5.0}/.github/workflows/deploy.yml

@@ -33,9 +33,12 @@ jobs:
         source .venv/bin/activate
         uv pip install python-semantic-release packaging
     - name: Set Git config
+      env:
+        TOKEN: ${{ secrets.USER_TOKEN }}
       run: |
         git config user.name "github-actions[bot]"
         git config user.email "'github-actions[bot]@users.noreply.github.com"
+        git remote set-url origin https://$TOKEN@github.com/${{ github.repository }}.git
     - name: Git merge develop in master
       run: |
         git checkout master
@@ -62,9 +65,12 @@ jobs:
         # Get history and tags for SCM versioning to work
         fetch-depth: 0
     - name: Set Git config
+      env:
+        TOKEN: ${{ secrets.USER_TOKEN }}
       run: |
         git config user.name "github-actions[bot]"
         git config user.email "'github-actions[bot]@users.noreply.github.com"
+        git remote set-url origin https://$TOKEN@github.com/${{ github.repository }}.git
     - name: Git merge master in develop
       run: |
         git checkout develop

{eodag-3.4.3 → eodag-3.5.0}/CHANGES.rst

@@ -3,6 +3,66 @@ Release history
 ===============
 
 
+v3.5.0 (2025-06-20)
+===================
+
+Bug Fixes
+---------
+
+* **core**: Always validate PluginConfig before loading (`#1690`_, `59ac437`_)
+
+* **core**: Skip provider empty conf on init (`#1687`_, `0a4104e`_)
+
+* **plugins**: Raise errors when metadata discovery is not allowed (`#1534`_, `855ffa3`_)
+
+Build System
+------------
+
+* Update usgs to 0.3.6 (`#1688`_, `e63cfb1`_)
+
+Continuous Integration
+----------------------
+
+* Use personal access token for deploy github action (`#1693`_, `ff777d7`_)
+
+Documentation
+-------------
+
+* Dead-links and out-of-date param fix (`#1692`_, `445a20e`_)
+
+Features
+--------
+
+* **core**: Add env variable to whitelist providers (`#1672`_, `b93c4c8`_)
+
+* **core**: Add strict product types mode (`#1677`_, `5077fa5`_)
+
+* **plugins**: Auth token expiration margin (`#1665`_, `ef5fc18`_)
+
+* **server**: Added bbox filter support for collections search (`#1671`_, `5717f0d`_)
+
+.. _#1534: https://github.com/CS-SI/eodag/pull/1534
+.. _#1665: https://github.com/CS-SI/eodag/pull/1665
+.. _#1671: https://github.com/CS-SI/eodag/pull/1671
+.. _#1672: https://github.com/CS-SI/eodag/pull/1672
+.. _#1677: https://github.com/CS-SI/eodag/pull/1677
+.. _#1687: https://github.com/CS-SI/eodag/pull/1687
+.. _#1688: https://github.com/CS-SI/eodag/pull/1688
+.. _#1690: https://github.com/CS-SI/eodag/pull/1690
+.. _#1692: https://github.com/CS-SI/eodag/pull/1692
+.. _#1693: https://github.com/CS-SI/eodag/pull/1693
+.. _0a4104e: https://github.com/CS-SI/eodag/commit/0a4104e0518abc70e2133ca98472eea87d673a1c
+.. _445a20e: https://github.com/CS-SI/eodag/commit/445a20e060730642e703615c73225c0df3cc84d0
+.. _5077fa5: https://github.com/CS-SI/eodag/commit/5077fa591496811fb100c1e6b6a3e452cbdbe2a5
+.. _5717f0d: https://github.com/CS-SI/eodag/commit/5717f0deddbf022f2c6d5207ade77de6afb0f9d5
+.. _59ac437: https://github.com/CS-SI/eodag/commit/59ac437de01a8996d247b1f8239f332ed5dc5456
+.. _855ffa3: https://github.com/CS-SI/eodag/commit/855ffa39fa9b914eb39cc20d6e5c2cbbc1b2097a
+.. _b93c4c8: https://github.com/CS-SI/eodag/commit/b93c4c88f323af0eecb0950c90c6862ca9a7c3f4
+.. _e63cfb1: https://github.com/CS-SI/eodag/commit/e63cfb19ca64a2ed65f500ae9678e117a2ea4cf8
+.. _ef5fc18: https://github.com/CS-SI/eodag/commit/ef5fc188e515759c9227584b25805db75f537833
+.. _ff777d7: https://github.com/CS-SI/eodag/commit/ff777d7a1e33f612c5227dba4fecfcec55ff18fc
+
+
 v3.4.3 (2025-06-12)
 ===================
 

{eodag-3.4.3/eodag.egg-info → eodag-3.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eodag
-Version: 3.4.3
+Version: 3.5.0
 Summary: Earth Observation Data Access Gateway
 Home-page: https://github.com/CS-SI/eodag
 Author: CS GROUP - France
@@ -64,7 +64,7 @@ Requires-Dist: OWSLib>=0.27.1; extra == "csw"
 Provides-Extra: ecmwf
 Requires-Dist: ecmwf-api-client; extra == "ecmwf"
 Provides-Extra: usgs
-Requires-Dist: usgs>=0.3.1; extra == "usgs"
+Requires-Dist: usgs>=0.3.6; extra == "usgs"
 Provides-Extra: server
 Requires-Dist: fastapi>=0.93.0; extra == "server"
 Requires-Dist: pygeofilter; extra == "server"
@@ -317,7 +317,7 @@ An eodag instance can be exposed through a STAC compliant REST api from the comm
 
 .. code-block:: bash
 
-    docker run -p 5000:5000 --rm csspace/eodag-server:3.4.3
+    docker run -p 5000:5000 --rm csspace/eodag-server:3.5.0
 
 You can also browse over your STAC API server using `STAC Browser <https://github.com/radiantearth/stac-browser>`_.
 Simply run:

{eodag-3.4.3 → eodag-3.5.0}/README.rst

@@ -187,7 +187,7 @@ An eodag instance can be exposed through a STAC compliant REST api from the comm
 
 .. code-block:: bash
 
-    docker run -p 5000:5000 --rm csspace/eodag-server:3.4.3
+    docker run -p 5000:5000 --rm csspace/eodag-server:3.5.0
 
 You can also browse over your STAC API server using `STAC Browser <https://github.com/radiantearth/stac-browser>`_.
 Simply run:

{eodag-3.4.3 → eodag-3.5.0}/charts/eodag-server/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 3.4.3
+appVersion: 3.5.0
 dependencies:
 - name: common
   repository:  oci://registry-1.docker.io/bitnamicharts
@@ -15,4 +15,4 @@ name: eodag-server
 sources:
 - https://github.com/CS-SI/eodag
 type: application
-version: 3.4.3
+version: 3.5.0

{eodag-3.4.3 → eodag-3.5.0}/docs/getting_started_guide/configure.rst

@@ -157,6 +157,26 @@ Some EODAG core settings can be overriden using environment variables:
   <https://eodag.readthedocs.io/en/stable/notebooks/api_user_guide/2_providers_products_available.html#Product-types-discovery>`_
   in place of https://cs-si.github.io/eodag/eodag/resources/ext_product_types.json.
   If the file is not readable, only user-modified providers will be fetched.
+* ``EODAG_PROVIDERS_WHITELIST`` to restrict EODAG to only use a specific list of providers.
+
+  If this environment variable is set (as a comma-separated list of provider names), EODAG will only load and use the specified providers.
+  All other providers will be ignored, regardless of their presence in configuration files.
+
+  This is useful for restricting EODAG to a subset of providers, for example in controlled or production environments.
+* ``EODAG_STRICT_PRODUCT_TYPES`` to control how product types are listed.
+
+  If this environment variable is set to a truthy value (such as ``1``, ``true``, ``yes``, or ``on``), EODAG will only list product types that are present in the main product types configuration file.
+  Product types defined only in provider configurations (but not in the main product types configuration) will be ignored.
+  If not set, EODAG will also include product types defined only in provider configurations, with minimal metadata.
+
+  This is useful if you want to strictly control which product types are available, for example to ensure consistency across environments.
+
+Example usage:
+
+.. code-block:: bash
+
+   export EODAG_PROVIDERS_WHITELIST=peps,creodias,theia
+   export EODAG_STRICT_PRODUCT_TYPES=true
 
 CLI configuration
 ^^^^^^^^^^^^^^^^^

{eodag-3.4.3 → eodag-3.5.0}/docs/getting_started_guide/register.rst

@@ -150,7 +150,7 @@ No authentication needed.
 
 ``ecmwf``
 ^^^^^^^^^
-Create an account `here <https://apps.ecmwf.int/registration/>`__.
+Create an account `here <https://www.ecmwf.int/user/login>`__.
 
 Then use *email* as ``username`` and *key* as ``password`` from `here <https://api.ecmwf.int/v1/key/>`__ in eodag credentials.
 EODAG can be used to request for public datasets as for operational archive. Please note that for public datasets you

{eodag-3.4.3 → eodag-3.5.0}/docs/stac_rest.rst

@@ -115,7 +115,7 @@ available on `https://hub.docker.com/r/csspace/eodag-server <https://hub.docker.
 
 .. code-block:: bash
 
-    $ docker run -p 5000:5000 --rm csspace/eodag-server:3.4.3
+    $ docker run -p 5000:5000 --rm csspace/eodag-server:3.5.0
 
 Example
 -------

{eodag-3.4.3 → eodag-3.5.0}/eodag/api/core.py

@@ -36,6 +36,7 @@ from whoosh.index import exists_in, open_dir
 from whoosh.qparser import QueryParser
 
 from eodag.api.product.metadata_mapping import (
+    NOT_AVAILABLE,
     ONLINE_STATUS,
     mtd_cfg_as_conversion_and_querypath,
 )
@@ -79,6 +80,7 @@ from eodag.utils import (
     string_to_jsonpath,
     uri_to_path,
 )
+from eodag.utils.env import is_env_var_true
 from eodag.utils.exceptions import (
     AuthenticationError,
     EodagError,
@@ -175,12 +177,19 @@ class EODataAccessGateway:
         share_credentials(self.providers_config)
 
         # init updated providers conf
+        strict_mode = is_env_var_true("EODAG_STRICT_PRODUCT_TYPES")
+        available_product_types = set(self.product_types_config.source.keys())
+
         for provider in self.providers_config.keys():
             provider_config_init(
                 self.providers_config[provider],
                 load_stac_provider_config(),
             )
 
+            self._sync_provider_product_types(
+                provider, available_product_types, strict_mode
+            )
+
         # re-build _plugins_manager using up-to-date providers_config
         self._plugins_manager.rebuild(self.providers_config)
 
@@ -226,6 +235,61 @@ class EODataAccessGateway:
                     )
         self.set_locations_conf(locations_conf_path)
 
+    def _sync_provider_product_types(
+        self,
+        provider: str,
+        available_product_types: set[str],
+        strict_mode: bool,
+    ) -> None:
+        """
+        Synchronize product types for a provider based on strict or permissive mode.
+
+        In strict mode, removes product types not in available_product_types.
+        In permissive mode, adds empty product type configs for missing types.
+
+        :param provider: The provider name whose product types should be synchronized.
+        :param available_product_types: The set of available product type IDs.
+        :param strict_mode: If True, remove unknown product types; if False, add empty configs for them.
+        :returns: None
+        """
+        provider_products = self.providers_config[provider].products
+        products_to_remove: list[str] = []
+        products_to_add: list[str] = []
+
+        for product_id in provider_products:
+            if product_id == GENERIC_PRODUCT_TYPE:
+                continue
+
+            if product_id not in available_product_types:
+                if strict_mode:
+                    products_to_remove.append(product_id)
+                    continue
+
+                empty_product = {
+                    "title": product_id,
+                    "abstract": NOT_AVAILABLE,
+                }
+                self.product_types_config.source[
+                    product_id
+                ] = empty_product  # will update available_product_types
+                products_to_add.append(product_id)
+
+        if products_to_add:
+            logger.debug(
+                "Product types permissive mode, %s added (provider %s)",
+                ", ".join(products_to_add),
+                provider,
+            )
+
+        if products_to_remove:
+            logger.debug(
+                "Product types strict mode, ignoring %s (provider %s)",
+                ", ".join(products_to_remove),
+                provider,
+            )
+            for id in products_to_remove:
+                del self.providers_config[provider].products[id]
+
     def get_version(self) -> str:
         """Get eodag package version"""
         return version("eodag")
@@ -608,11 +672,14 @@ class EODataAccessGateway:
             for product_type_id in p.products:  # type: ignore
                 if product_type_id == GENERIC_PRODUCT_TYPE:
                     continue
+
                 config = self.product_types_config[product_type_id]
                 config["_id"] = product_type_id
+
                 if "alias" in config:
                     product_type_id = config["alias"]
                 product_type = {"ID": product_type_id, **config}
+
                 if product_type not in product_types:
                     product_types.append(product_type)
 
@@ -620,11 +687,18 @@ class EODataAccessGateway:
         return sorted(product_types, key=itemgetter("ID"))
 
     def fetch_product_types_list(self, provider: Optional[str] = None) -> None:
-        """Fetch product types list and update if needed
+        """Fetch product types list and update if needed.
+
+        If strict mode is enabled (by setting the ``EODAG_STRICT_PRODUCT_TYPES`` environment variable
+        to a truthy value), this method will not fetch or update product types and will return immediately.
 
         :param provider: The name of a provider or provider-group for which product types
                          list should be updated. Defaults to all providers (None value).
         """
+        strict_mode = is_env_var_true("EODAG_STRICT_PRODUCT_TYPES")
+        if strict_mode:
+            return
+
         providers_to_fetch = list(self.providers_config.keys())
         # check if some providers are grouped under a group name which is not a provider name
         if provider is not None and provider not in self.providers_config:

{eodag-3.4.3 → eodag-3.5.0}/eodag/api/product/metadata_mapping.py

@@ -54,6 +54,7 @@ from eodag.utils import (
     string_to_jsonpath,
     update_nested_dict,
 )
+from eodag.utils.exceptions import ValidationError
 
 if TYPE_CHECKING:
     from shapely.geometry.base import BaseGeometry
@@ -1286,7 +1287,10 @@ def mtd_cfg_as_conversion_and_querypath(
 
 
 def format_query_params(
-    product_type: str, config: PluginConfig, query_dict: dict[str, Any]
+    product_type: str,
+    config: PluginConfig,
+    query_dict: dict[str, Any],
+    error_context: str = "",
 ) -> dict[str, Any]:
     """format the search parameters to query parameters"""
     if "raise_errors" in query_dict.keys():
@@ -1299,10 +1303,26 @@ def format_query_params(
         **config.products.get(product_type, {}).get("metadata_mapping", {}),
     )
 
+    # Raise error if non-queryables parameters are used and raise_mtd_discovery_error configured
+    if (
+        raise_mtd_discovery_error := config.products.get(product_type, {})
+        .get("discover_metadata", {})
+        .get("raise_mtd_discovery_error")
+    ) is None:
+        raise_mtd_discovery_error = getattr(config, "discover_metadata", {}).get(
+            "raise_mtd_discovery_error", False
+        )
+
     query_params: dict[str, Any] = {}
     # Get all the search parameters that are recognised as queryables by the
     # provider (they appear in the queryables dictionary)
-    queryables = _get_queryables(query_dict, config, product_type_metadata_mapping)
+    queryables = _get_queryables(
+        query_dict,
+        config,
+        product_type_metadata_mapping,
+        raise_mtd_discovery_error,
+        error_context,
+    )
 
     for eodag_search_key, provider_search_key in queryables.items():
         user_input = query_dict[eodag_search_key]
@@ -1438,6 +1458,8 @@ def _get_queryables(
     search_params: dict[str, Any],
     config: PluginConfig,
     metadata_mapping: dict[str, Any],
+    raise_mtd_discovery_error: bool,
+    error_context: str,
 ) -> dict[str, Any]:
     """Retrieve the metadata mappings that are query-able"""
     logger.debug("Retrieving queryable metadata from metadata_mapping")
@@ -1445,6 +1467,13 @@ def _get_queryables(
     for eodag_search_key, user_input in search_params.items():
         if user_input is not None:
             md_mapping = metadata_mapping.get(eodag_search_key, (None, NOT_MAPPED))
+            # raise an error when a query param not allowed by the provider is found
+            if not isinstance(md_mapping, list) and raise_mtd_discovery_error:
+                raise ValidationError(
+                    "Search parameters which are not queryable are disallowed for this product type on this provider: "
+                    f"please remove '{eodag_search_key}' from your search parameters. {error_context}",
+                    {eodag_search_key},
+                )
             _, md_value = md_mapping
             # query param from defined metadata_mapping
             if md_mapping is not None and isinstance(md_mapping, list):

{eodag-3.4.3 → eodag-3.5.0}/eodag/config.py

@@ -194,12 +194,24 @@ class ProviderConfig(yaml.YAMLObject):
             },
         )
         for key in PLUGINS_TOPICS_KEYS:
-            current_value: Optional[dict[str, Any]] = getattr(self, key, None)
+            current_value: Optional[PluginConfig] = getattr(self, key, None)
             mapping_value = mapping.get(key, {})
             if current_value is not None:
                 current_value.update(mapping_value)
             elif mapping_value:
-                setattr(self, key, PluginConfig.from_mapping(mapping_value))
+                try:
+                    setattr(self, key, PluginConfig.from_mapping(mapping_value))
+                except ValidationError as e:
+                    logger.warning(
+                        (
+                            "Could not add %s Plugin config to %s configuration: %s. "
+                            "Try updating existing %s Plugin configs instead."
+                        ),
+                        key,
+                        self.name,
+                        str(e),
+                        ", ".join([k for k in PLUGINS_TOPICS_KEYS if hasattr(self, k)]),
+                    )
 
 
 class PluginConfig(yaml.YAMLObject):
@@ -256,9 +268,11 @@ class PluginConfig(yaml.YAMLObject):
         #: Metadata regex pattern used for discovery in search result properties
         metadata_pattern: str
         #: Configuration/template that will be used to query for a discovered parameter
-        search_param: str
+        search_param: str | dict[str, Any]
         #: Path to the metadata in search result
         metadata_path: str
+        #: Whether an error must be raised when using a search parameter which is not queryable or not
+        raise_mtd_discovery_error: bool
 
     class DiscoverProductTypes(TypedDict, total=False):
         """Configuration for product types discovery"""
@@ -628,6 +642,10 @@ class PluginConfig(yaml.YAMLObject):
     #: :class:`~eodag.plugins.authentication.token_exchange.OIDCTokenExchangeAuth`
     #: Identifies the issuer of the `subject_token`
     subject_issuer: str
+    #: :class:`~eodag.plugins.authentication.token.TokenAuth`
+    #: :class:`~eodag.plugins.authentication.openid_connect.OIDCRefreshTokenBase`
+    #: Safety buffer to prevent token rejection from unexpected expiry between validity check and request.
+    token_expiration_margin: int
     #: :class:`~eodag.plugins.authentication.token_exchange.OIDCTokenExchangeAuth`
     #: Audience that the token ID is intended for. :attr:`~eodag.config.PluginConfig.client_id` of the Relying Party
     audience: str
@@ -648,6 +666,7 @@ class PluginConfig(yaml.YAMLObject):
     @classmethod
     def from_mapping(cls, mapping: dict[str, Any]) -> PluginConfig:
         """Build a :class:`~eodag.config.PluginConfig` from a mapping"""
+        cls.validate(tuple(mapping.keys()))
         c = cls()
         c.__dict__.update(mapping)
         return c
@@ -657,7 +676,7 @@ class PluginConfig(yaml.YAMLObject):
         """Validate a :class:`~eodag.config.PluginConfig`"""
         if "type" not in config_keys:
             raise ValidationError(
-                "A Plugin config must specify the Plugin it configures"
+                "A Plugin config must specify the type of Plugin it configures"
             )
 
     def update(self, mapping: Optional[dict[Any, Any]]) -> None:
@@ -689,6 +708,8 @@ def load_default_config() -> dict[str, ProviderConfig]:
 def load_config(config_path: str) -> dict[str, ProviderConfig]:
     """Load the providers configuration into a dictionary from a given file
 
+    If EODAG_PROVIDERS_WHITELIST is set, only load listed providers.
+
     :param config_path: The path to the provider config file
     :returns: The default provider's configuration
     """
@@ -701,10 +722,23 @@ def load_config(config_path: str) -> dict[str, ProviderConfig]:
     except yaml.parser.ParserError as e:
         logger.error("Unable to load configuration")
         raise e
+
     stac_provider_config = load_stac_provider_config()
+
+    whitelist_env = os.getenv("EODAG_PROVIDERS_WHITELIST")
+    whitelist = None
+    if whitelist_env:
+        whitelist = {provider for provider in whitelist_env.split(",")}
+        logger.info("Using providers whitelist: %s", ", ".join(whitelist))
+
     for provider_config in providers_configs:
+        if provider_config is None or (
+            whitelist and provider_config.name not in whitelist
+        ):
+            continue
         provider_config_init(provider_config, stac_provider_config)
         config[provider_config.name] = provider_config
+
     return config
 
 
@@ -803,7 +837,9 @@ def provider_config_init(
         pass
 
 
-def override_config_from_file(config: dict[str, Any], file_path: str) -> None:
+def override_config_from_file(
+    config: dict[str, ProviderConfig], file_path: str
+) -> None:
     """Override a configuration with the values in a file
 
     :param config: An eodag providers configuration dictionary
@@ -818,10 +854,11 @@ def override_config_from_file(config: dict[str, Any], file_path: str) -> None:
         except yaml.parser.ParserError as e:
             logger.error("Unable to load user configuration file")
             raise e
+
     override_config_from_mapping(config, config_in_file)
 
 
-def override_config_from_env(config: dict[str, Any]) -> None:
+def override_config_from_env(config: dict[str, ProviderConfig]) -> None:
     """Override a configuration with environment variables values
 
     :param config: An eodag providers configuration dictionary
@@ -892,16 +929,25 @@ def override_config_from_env(config: dict[str, Any]) -> None:
 
 
 def override_config_from_mapping(
-    config: dict[str, Any], mapping: dict[str, Any]
+    config: dict[str, ProviderConfig], mapping: dict[str, Any]
 ) -> None:
-    """Override a configuration with the values in a mapping
+    """Override a configuration with the values in a mapping.
+
+    If the environment variable ``EODAG_PROVIDERS_WHITELIST`` is set (as a comma-separated list of provider names),
+    only the listed providers will be used from the mapping. All other providers in the mapping will be ignored.
 
     :param config: An eodag providers configuration dictionary
     :param mapping: The mapping containing the values to be overriden
     """
+    whitelist_env = os.getenv("EODAG_PROVIDERS_WHITELIST")
+    whitelist = None
+    if whitelist_env:
+        whitelist = {provider for provider in whitelist_env.split(",")}
+
     for provider, new_conf in mapping.items():
         # check if metada-mapping as already been built as jsonpath in providers_config
-        if not isinstance(new_conf, dict):
+        # or provider not in whitelist
+        if not isinstance(new_conf, dict) or (whitelist and provider not in whitelist):
             continue
         new_conf_search = new_conf.get("search", {}) or {}
         new_conf_api = new_conf.get("api", {}) or {}
@@ -930,7 +976,7 @@ def override_config_from_mapping(
                 )
 
         # try overriding conf
-        old_conf: Optional[dict[str, Any]] = config.get(provider)
+        old_conf: Optional[ProviderConfig] = config.get(provider)
         if old_conf is not None:
             old_conf.update(new_conf)
         else:

{eodag-3.4.3 → eodag-3.5.0}/eodag/plugins/authentication/keycloak.py

@@ -60,8 +60,10 @@ class KeycloakOIDCPasswordAuth(OIDCRefreshTokenBase):
           The allowed audiences that have to be present in the user token.
         * :attr:`~eodag.config.PluginConfig.auth_error_code` (``int``): which error code is
           returned in case of an authentication error
-        * :attr:`~eodag.config.PluginConfig.ssl_verify` (``bool``): if the ssl certificates
+        * :attr:`~eodag.config.PluginConfig.ssl_verify` (``bool``): If the SSL certificates
           should be verified in the token request; default: ``True``
+        * :attr:`~eodag.config.PluginConfig.token_expiration_margin` (``int``): The margin of time (in seconds)
+          before a token is considered expired. Default: 60 seconds
 
     Using :class:`~eodag.plugins.download.http.HTTPDownload` a download link
     ``http://example.com?foo=bar`` will become

{eodag-3.4.3 → eodag-3.5.0}/eodag/plugins/authentication/openid_connect.py

@@ -30,7 +30,14 @@ from lxml import etree
 from requests.auth import AuthBase
 
 from eodag.plugins.authentication import Authentication
-from eodag.utils import HTTP_REQ_TIMEOUT, USER_AGENT, parse_qs, repeatfunc, urlparse
+from eodag.utils import (
+    DEFAULT_TOKEN_EXPIRATION_MARGIN,
+    HTTP_REQ_TIMEOUT,
+    USER_AGENT,
+    parse_qs,
+    repeatfunc,
+    urlparse,
+)
 from eodag.utils.exceptions import (
     AuthenticationError,
     MisconfiguredError,
@@ -117,13 +124,22 @@ class OIDCRefreshTokenBase(Authentication):
 
     def _get_access_token(self) -> str:
         now = datetime.now(timezone.utc)
-        if self.access_token and now < self.access_token_expiration:
+        expiration_margin = timedelta(
+            seconds=getattr(
+                self.config, "token_expiration_margin", DEFAULT_TOKEN_EXPIRATION_MARGIN
+            )
+        )
+
+        if self.access_token and self.access_token_expiration - now > expiration_margin:
             logger.debug(
                 f"Existing access_token is still valid until {self.access_token_expiration.isoformat()}."
             )
             return self.access_token
 
-        elif self.refresh_token and now < self.refresh_token_expiration:
+        elif (
+            self.refresh_token
+            and self.refresh_token_expiration - now > expiration_margin
+        ):
             response = self._get_token_with_refresh_token()
             logger.debug(
                 "access_token expired, fetching new access_token using refresh_token"
@@ -268,6 +284,8 @@ class OIDCAuthorizationCodeFlowAuth(OIDCRefreshTokenBase):
           Refers to the name of the query param to be used in the query request
         * :attr:`~eodag.config.PluginConfig.refresh_token_key` (``str``): The key pointing to
           the refresh_token in the json response to the POST request to the token server
+        * :attr:`~eodag.config.PluginConfig.token_expiration_margin` (``int``): The margin of time (in seconds)
+          before a token is considered expired. Default: 60 seconds.
 
     """
 

{eodag-3.4.3 → eodag-3.5.0}/eodag/plugins/authentication/token.py

@@ -31,6 +31,7 @@ from urllib3 import Retry
 
 from eodag.plugins.authentication.base import Authentication
 from eodag.utils import (
+    DEFAULT_TOKEN_EXPIRATION_MARGIN,
     HTTP_REQ_TIMEOUT,
     REQ_RETRY_BACKOFF_FACTOR,
     REQ_RETRY_STATUS_FORCELIST,
@@ -90,6 +91,8 @@ class TokenAuth(Authentication):
         * :attr:`~eodag.config.PluginConfig.retry_status_forcelist` (``list[int]``): :class:`urllib3.util.Retry`
           ``status_forcelist`` parameter, list of integer HTTP status codes that we should force a retry on; default:
           ``[401, 429, 500, 502, 503, 504]``
+        * :attr:`~eodag.config.PluginConfig.token_expiration_margin` (``int``): The margin of time (in seconds) before
+          a token is considered expired. Default: 60 seconds.
     """
 
     def __init__(self, provider: str, config: PluginConfig) -> None:
@@ -152,9 +155,18 @@ class TokenAuth(Authentication):
 
         # Use a thread lock to avoid several threads requesting the token at the same time
         with self.auth_lock:
-
+            expiration_margin = timedelta(
+                seconds=getattr(
+                    self.config,
+                    "token_expiration_margin",
+                    DEFAULT_TOKEN_EXPIRATION_MARGIN,
+                )
+            )
             self.validate_config_credentials()
-            if self.token and self.token_expiration > datetime.now():
+            if (
+                self.token
+                and self.token_expiration - datetime.now() > expiration_margin
+            ):
                 logger.debug("using existing access token")
                 return RequestsTokenAuth(
                     self.token, "header", headers=getattr(self.config, "headers", {})

{eodag-3.4.3 → eodag-3.5.0}/eodag/plugins/authentication/token_exchange.py

@@ -79,6 +79,7 @@ class OIDCTokenExchangeAuth(Authentication):
             provider,
             PluginConfig.from_mapping(
                 {
+                    "type": "OIDCAuthorizationCodeFlowAuth",
                     "credentials": getattr(self.config, "credentials", {}),
                     **self.config.subject,
                 }