geeViz.eeAuth.registry

Multi-tenant Earth Engine service-account registry.

Loads service-account credentials from env vars at startup and provides per-tenant token minting with caching. Used by the proxy server to pick which SA to authenticate as for each incoming request.

Env-var convention:

• GEE_SERVICE_ACCOUNT_B64 — the default tenant (legacy name kept for backward compatibility).

• GEE_<NAME>_SERVICE_ACCOUNT — additional tenants. The middle capture group becomes the tenant id, lowercased. So GEE_TRAINING_SERVICE_ACCOUNT registers as the training tenant.

Each value is base64-encoded service-account JSON. To add a tenant:

1. Create the SA, register it with Earth Engine.

2. Base64-encode the JSON key file.

3. Set GEE_<NAME>_SERVICE_ACCOUNT=<b64> in your env / deploy.

Tokens are minted on demand and cached. The registry is thread-safe; concurrent requests for the same tenant share one in-flight refresh via the lock.

Functions

get_registry()	Return the process-wide SA registry, constructing it lazily on first access.
reset_registry()	Clear the singleton so the next get_registry() re-reads the env.

Classes

SARegistry()

Per-tenant service-account credentials + cached access tokens.

class geeViz.eeAuth.registry.SARegistry

Bases: object

Per-tenant service-account credentials + cached access tokens.

list_tenants() → list[str]

All tenant slugs currently registered, sorted alphabetically.

has_tenant(tenant: str) → bool

True iff the registry has a service-account entry for tenant.

resolve(tenant: str | None) → str

Pick the actual tenant to use. Unknown / missing → default. Returns "" if neither the requested tenant nor a default is configured — callers should treat that as “registry not ready”.

get_token(tenant: str | None, force_refresh: bool = False) → dict

Return {access_token, project_id, client_email, tenant} for the given tenant. Caches across calls; refresh-on-expire happens automatically. Raises KeyError if no tenant matches and no default is configured.

geeViz.eeAuth.registry.get_registry() → SARegistry

Return the process-wide SA registry, constructing it lazily on first access.

Thread-safe: the constructor grabs its own lock. Subsequent callers receive the same instance.

Returns:

The singleton registry.

Return type:

SARegistry

geeViz.eeAuth.registry.reset_registry() → None

Clear the singleton so the next get_registry() re-reads the env.

Used by tests that mutate GEEVIZ_SA_JSON_* env vars between cases — without a reset the cached registry would ignore the changes.