aviso-server 0.4.1

[!IMPORTANT]
This software is Emerging and subject to ECMWF's guidelines on Software Maturity.

Overview

Aviso Server is a notification service for data-driven workflows.

It helps you answer questions like:

• "What just arrived?"
• "Give me updates for this exact subset of data."
• "Replay everything I missed since yesterday."

Producers publish notifications once, and consumers can either follow live updates or replay history using the same filter model. Aviso keeps this predictable by validating identifiers against schema rules and streaming notifications in a consistent event format. For regional use cases, Aviso also supports spatial filtering so clients can subscribe to notifications relevant to a specific area or point.

Key Features

• Publish notifications through a simple HTTP API
• Watch live updates over SSE with connection and replay controls
• Replay historical notifications by sequence or timestamp
• Filter by exact identifier values or constraints (for supported field types)
• Use spatial filters for polygon/point use cases
• Run with either in-memory storage (local/dev) or JetStream (durable environments)

Quick Start

Run locally (in-memory backend)

cargo run

Run tests

cargo test --workspace

JetStream integration tests are opt-in:

AVISO_RUN_NATS_TESTS=1 cargo test --workspace

Build Docs Locally

cargo install mdbook
mdbook build docs
mdbook serve docs --open

Authentication (Optional)

Aviso Server supports authentication via auth-o-tron as an external authentication service.

Quick Start with Auth

1. Start auth-o-tron using Docker:

./scripts/auth-o-tron-docker.sh

By default this uses scripts/example_auth_config.yaml. Use a custom config if needed:

AUTH_O_TRON_CONFIG_FILE=/path/to/auth-config.yaml ./scripts/auth-o-tron-docker.sh

2. Configure auth in configuration/config.yaml:

auth:
  enabled: true
  auth_o_tron_url: "http://localhost:8080"
  jwt_secret: "your-shared-secret" # must match auth-o-tron jwt.secret
  admin_roles:
    your-realm: ["admin", "superuser"]
  timeout_ms: 5000

3. Run aviso-server with auth enabled

Per-Stream Authentication

You can configure authentication requirements per stream in your notification schema:

notification_schema:
  # Authenticated stream - any valid user
  public_stream:
    # ... other config
    auth:
      required: true  # Any authenticated user allowed

  # Separate read/write access
  restricted_stream:
    # ... other config
    auth:
      required: true
      read_roles:
        your-realm: ["*"]
      write_roles:
        your-realm: ["admin", "operator"]

Admin Endpoints

Admin endpoints (/api/v1/admin/*) require users to have one of the configured admin_roles.

Disabling Auth

To disable authentication completely:

auth:
  enabled: false

Or omit the auth section entirely from your configuration.