Astro API Endpoints & Backend Integration

Status: ✅ Fully documented

Overview

The p2d2 application uses Astro API Endpoints for secure backend integrations with external geodata services. These endpoints provide CORS handling, authentication, and robust error handling for WFS services, Overpass API, and Geoserver integrations.

Security Notes

Credential Status

Note: In production, credentials are managed exclusively via environment variables (import.meta.env.WFS_USERNAME, import.meta.env.WFS_PASSWORD). Hardcoded credentials must never be used in production. Any such usage is a temporary workaround or for development/testing only and must trigger explicit warnings.

Affected Files:

• src/pages/api/wfs-proxy.ts – expects environment variables
• src/utils/wfs-auth.ts – expects environment variables

Immediate Actions Required:

1. Ensure no hardcoded credentials remain in production code
2. Properly configure environment variables for all environments
3. For development/testing, clear warnings on fallback usage

Main API Endpoints

1. WFS Proxy Endpoint (/api/wfs-proxy.ts)

Secure proxy for WFS service requests, CORS support, and environment-based authentication.

Standard Implementation

const WFS_USERNAME = import.meta.env.WFS_USERNAME;
const WFS_PASSWORD = import.meta.env.WFS_PASSWORD;
if (!WFS_USERNAME || !WFS_PASSWORD) {
  throw new Error("WFS authentication not configured in environment");
}

Development Notes

// Dev fallback – for local tests only, with explicit warnings:
const WFS_USERNAME = import.meta.env.WFS_USERNAME || "dev_user";
const WFS_PASSWORD = import.meta.env.WFS_PASSWORD || "dev_password";

2. Polygon Sync Endpoint (/api/sync-polygons.ts)

API endpoint for automatic polygon synchronization with Overpass API and WFS-T.

Endpoint Specification

export async function POST({ request }) {
  const { slug, categories } = await request.json();
  const result = await syncKommunePolygons(slug, categories);
  return new Response(JSON.stringify(result), {
    status: result.success ? 200 : 500
  });
}

Backend Service Integrations

WFS Transaction Management

WFS-T access is analogous: credentials are always retrieved from .env variables.

Security Aspects

• Credentials must never be hardcoded
• Validation of .env variables at startup/request
• Clear error handling if missing

Conclusion

The documentation sets out production credential management via environment variables and best practices for development, testing and production use.