Secure Map Service

.github/workflows/tethys.yml

@@ -189,7 +189,9 @@ jobs:
         conda activate tethys
         conda list
         tethys db start
-        pip install coveralls reactpy_django pytest pytest-django pytest-cov
+        # pytest-django 4.13 dropped Django 4.2 support.
+        # Remove this pin when we drop support for Django 4.2 in Tethys.
+        pip install coveralls reactpy_django pytest "pytest-django<4.13" pytest-cov
     # Test Tethys
     - name: Test Tethys
       run: |

.gitignore

@@ -12,6 +12,7 @@
 build/
 dist/
 docs/_build
+*.env
 *~
 tethys_gizmos/static/tethys_gizmos/less/bower_components/*
 node_modules

docs/conf.py

@@ -71,6 +71,8 @@
     "docker",
     "docker.types",
     "docker.errors",
+    "encrypted_fields",
+    "encrypted_fields.fields",
     "guardian",
     "guardian.admin",
     "guardian.models",
@@ -93,7 +95,6 @@
     "sqlalchemy",
     "sqlalchemy.orm",
     "tethys_apps.harvester",
-    "tethys_apps.models",  # Mocked to prevent issues with loading apps during docs build.
     "tethys_apps.admin",  # Mocked to prevent issues with loading models during docs build.
     "yaml",
 ]

docs/tethys_portal/admin_pages/service_settings.rst

@@ -4,7 +4,7 @@
 Service Settings
 ****************
 
-There are several different types of Service Settings including: ``Persistent Store Connection Settings``, ``Persistent Store Database Settings``, ``Dataset Service Settings``, ``Spatial Dataset Service Settings``, and ``Web Processing Service Settings`` (see Figure 1). These settings specify the types of services that the apps require. Use the drop down next to each Service Setting to assign a pre-registered ``Tethys Service`` to that app or use the *plus* button to create a new one.
+There are several different types of Service Settings including: ``Persistent Store Connection Settings``, ``Persistent Store Database Settings``, ``Dataset Service Settings``, ``Spatial Dataset Service Settings``, ``Web Processing Service Settings``, and ``Secure Map Service Settings`` (see Figure 1). These settings specify the types of services that the apps require. Use the drop down next to each Service Setting to assign a pre-registered ``Tethys Service`` to that app or use the *plus* button to create a new one.
 
 .. figure:: ../../images/site_admin/service_settings.png
     :width: 675px

docs/tethys_portal/admin_pages/tethys_services.rst

@@ -4,7 +4,7 @@
 Tethys Services
 ***************
 
-The links under the ``TETHYS SERVICES`` heading can be used to register external services with Tethys Platform for use by apps and extensions. Use the ``Spatial Dataset Services`` link to register your Tethys Portal to GeoServer, the ``Dataset Services`` link to register to CKAN or HydroShare instances, the ``Web Processing Services`` link to register to WPS instances, or the ``PostgreSQL Persistent Store Services`` or ``SQLite Persistent Store Services`` link to register a database.
+The links under the ``TETHYS SERVICES`` heading can be used to register external services with Tethys Platform for use by apps and extensions. Use the ``Spatial Dataset Services`` link to register your Tethys Portal to GeoServer, the ``Dataset Services`` link to register to CKAN or HydroShare instances, the ``Web Processing Services`` link to register to WPS instances, the ``Secure Map Services`` link to register map services that require an API key or OAuth2 access token, or the ``PostgreSQL Persistent Store Services`` or ``SQLite Persistent Store Services`` link to register a database.
 
 .. tip::
 
@@ -13,6 +13,7 @@ The links under the ``TETHYS SERVICES`` heading can be used to register external
         * :doc:`../tethys_sdk/tethys_services/spatial_dataset_services`
         * :doc:`../tethys_sdk/tethys_services/dataset_services`
         * :doc:`../tethys_sdk/tethys_services/web_processing_services`
+        * :doc:`../tethys_sdk/tethys_services/secure_map_services`
         * :doc:`../tethys_sdk/tethys_services/persistent_store`
         * :doc:`../tethys_sdk/tethys_services/spatial_persistent_store`
         * :ref:`tethys_portal_service_settings`

docs/tethys_portal/configuration.rst

@@ -70,6 +70,8 @@ CONTEXT_PROCESSORS_OVERRIDE                        override for ``CONTEXT_PROCES
 RESOURCE_QUOTA_HANDLERS                            a list of Tethys ``ResourceQuotaHandler`` classes to load (see: :ref:`sdk_quotas_api`). For convenience, any quota handlers listed here will be appended to the default list of quota handlerss. To override ``RESOURCE_QUOTA_HANDLERS`` completely, use the ``RESOURCE_QUOTA_HANDLERS_OVERRIDE`` setting.
 RESOURCE_QUOTA_HANDLERS_OVERRIDE                   override for ``RESOURCE_QUOTA_HANDLERS`` setting. CAUTION: improper use of this setting can break the Tethys Portal.
 USE_OLD_WORKSPACES_API                             a temporary setting that maintains backward compatibility for the :ref:`tethys_workspaces_api` when True. When False the the new :ref:`tethys_paths_api` functionality will apply. Defaults to True. Will be removed in 5.0.
+SALT_KEY                                           the key used to encrypt sensitive values that are stored in the database, such as ``SecureMapService`` API keys (see: :ref:`secure_map_services_api`). Automatically generated by ``tethys gen portal_config``. Generate a new one at any time with ``tethys settings --generate-salt-key``.
+OAUTH_REQUIREMENTS                                 a mapping of app package to the name of a social auth provider that users must be linked to before they can access that app (e.g. ``{"my_first_app": "my_provider"}``). Users who have not linked an account are redirected to their user settings page. See :ref:`secure_map_services_oauth`.
 ================================================== ================================================================================
 
 .. _tethys_portal_config_settings:

docs/tethys_sdk/app_class.rst

@@ -47,6 +47,9 @@ Override these methods (add them to your app class) to define objects that are u
 .. automethod:: tethys_sdk.base.TethysAppBase.web_processing_service_settings
    :noindex:
 
+.. automethod:: tethys_sdk.base.TethysAppBase.secure_map_service_settings
+   :noindex:
+
 .. automethod:: tethys_sdk.base.TethysAppBase.scheduler_settings
    :noindex:
 
@@ -86,6 +89,12 @@ Class Methods
 .. automethod:: tethys_sdk.base.TethysAppBase.get_web_processing_service
    :noindex:
 
+.. automethod:: tethys_sdk.base.TethysAppBase.get_secure_map_service
+   :noindex:
+
+.. automethod:: tethys_sdk.base.TethysAppBase.update_secure_map_service_params
+   :noindex:
+
 .. automethod:: tethys_sdk.base.TethysAppBase.get_handoff_manager
    :noindex:
 

docs/tethys_sdk/app_settings.rst

@@ -108,6 +108,30 @@ To retrieve a connection to a Web Processing Service, import your :term:`app cla
 
     See the :doc:`./tethys_services/web_processing_services` for more details on how to use Dataset Services in your apps.
 
+.. _app_settings_secure_map_service_settings:
+
+Secure Map Service Settings
+===========================
+
+Secure Map Service Settings are used to request map services that require credentials to access (e.g. a WMS service authenticated with an API key or an OAuth2 access token). Create Secure Map Service Settings by implementing the ``secure_map_service_settings()`` method in your :term:`app class`. This method should return a list of SecureMapServiceSetting_ objects:
+
+.. automethod:: tethys_apps.base.TethysAppBase.secure_map_service_settings
+   :noindex:
+
+To retrieve a Secure Map Service, import your :term:`app class` and call the ``get_secure_map_service()`` class method:
+
+.. automethod:: tethys_apps.base.TethysAppBase.get_secure_map_service
+   :noindex:
+
+To update the parameters of the service assigned to a setting, call the ``update_secure_map_service_params()`` class method:
+
+.. automethod:: tethys_apps.base.TethysAppBase.update_secure_map_service_params
+   :noindex:
+
+.. tip::
+
+    See the :doc:`./tethys_services/secure_map_services` for more details on how to use Secure Map Services in your apps.
+
 .. _app_settings_scheduler_settings:
 
 Scheduler Settings
@@ -163,6 +187,10 @@ Settings Objects
 
 .. autoclass:: tethys_sdk.app_settings.WebProcessingServiceSetting
 
+.. _SecureMapServiceSetting:
+
+.. autoclass:: tethys_sdk.app_settings.SecureMapServiceSetting
+
 .. _SchedulerSetting:
 
 .. autoclass:: tethys_sdk.app_settings.SchedulerSetting
@@ -180,6 +208,8 @@ Settings Declaration Methods
 
 .. automethod:: tethys_apps.base.TethysAppBase.web_processing_service_settings
 
+.. automethod:: tethys_apps.base.TethysAppBase.secure_map_service_settings
+
 .. automethod:: tethys_apps.base.TethysAppBase.scheduler_settings
 
 
@@ -198,4 +228,6 @@ Settings Getter Methods
 
 .. automethod:: tethys_apps.base.TethysAppBase.get_web_processing_service
 
+.. automethod:: tethys_apps.base.TethysAppBase.get_secure_map_service
+
 .. automethod:: tethys_apps.base.TethysAppBase.get_scheduler

docs/tethys_sdk/layouts/map_layout.rst

@@ -60,7 +60,7 @@ Add Layers
 
 To add layers to the map in a ``MapLayout``, override the :ref:`compose_layers <map_layout_compose_layers>` method. The ``MapLayout`` view uses the :ref:`MapView Gizmo <map-view>` under the covers and it is given to the ``compose_layers()`` method via the ``map_view`` argument. Use the ``map_view`` argument to add new :ref:`MVLayers <gizmo_mvlayer>` to the ``MapView``.
 
-While the ``MapView`` Gizmo will be able to accept any ``MVLayer`` object, the ``MapLayout`` needs layers to have additional metadata attached for them to be recognized by the layers in the Layer Tree, legend, and other features of ``MapLayout``. Several helper methods are provided by ``MapLayout`` to assist with building ``MVLayer`` objects in the correct way: :ref:`build_wms_layer() <map_layout_build_wms_layer>`, :ref:`build_geojson_layer() <map_layout_build_geojson_layer>`, and :ref:`build_arc_gis_layer() <map_layout_build_arc_gis_layer>`.
+While the ``MapView`` Gizmo will be able to accept any ``MVLayer`` object, the ``MapLayout`` needs layers to have additional metadata attached for them to be recognized by the layers in the Layer Tree, legend, and other features of ``MapLayout``. Several helper methods are provided by ``MapLayout`` to assist with building ``MVLayer`` objects in the correct way: :ref:`build_wms_layer() <map_layout_build_wms_layer>`, :ref:`build_geojson_layer() <map_layout_build_geojson_layer>`, :ref:`build_arc_gis_layer() <map_layout_build_arc_gis_layer>`, and :ref:`build_gml_layer() <map_layout_build_gml_layer>`.
 
 In addition, the ``compose_layers()`` method needs to return a ``list`` of at least one Layer Group. A Layer Group contains a list of layers and is used by the Layer Tree of ``MapLayout`` to organize layers. In addition, a control type is specified for each Layer Group (``'check' or 'radio'``), and can be used to control whether all the layers in a Layer Group can be viewed simultaneously (``'check'``) or only one at a time (``'radio'``). Create Layer Groups using the :ref:`map_layout_build_layer_group` helper method.
 
@@ -838,6 +838,13 @@ build_arc_gis_layer
 
 .. automethod:: tethys_layouts.views.map_layout.MapLayout.build_arc_gis_layer
 
+.. _map_layout_build_gml_layer:
+
+build_gml_layer
+^^^^^^^^^^^^^^^
+
+.. automethod:: tethys_layouts.views.map_layout.MapLayout.build_gml_layer
+
 .. _map_layout_build_layer_group:
 
 build_layer_group

docs/tethys_sdk/tethys_services.rst

@@ -4,9 +4,9 @@
 Tethys Services APIs
 ********************
 
-**Last Updated:** May 2017
+**Last Updated:** August 2026
 
-Tethys Services consists of several APIs that can be used to work with external data and processing services. Use the Persistent Store Services APIs to connect to SQL databases. Use the Dataset Services to consume file dataset services like CKAN or HydroShare. The Spatial Dataset Services can be used to connect to map servers like GeoServer and the Web Processing Services can be used to consume processing services such as those hosted by 52 North installations.1
+Tethys Services consists of several APIs that can be used to work with external data and processing services. Use the Persistent Store Services APIs to connect to SQL databases. Use the Dataset Services to consume file dataset services like CKAN or HydroShare. The Spatial Dataset Services can be used to connect to map servers like GeoServer and the Web Processing Services can be used to consume processing services such as those hosted by 52 North installations. Use the Secure Map Services to securely consume map services that require an API key or an OAuth2 access token.
 
 .. toctree::
   :maxdepth: 1
@@ -15,4 +15,5 @@ Tethys Services consists of several APIs that can be used to work with external
   tethys_services/spatial_persistent_store
   tethys_services/dataset_services
   tethys_services/spatial_dataset_services
+  tethys_services/secure_map_services
   tethys_services/web_processing_services