load_stac of signed batch job result Item fails

[bossie]

The VITO back end returns batch job results as a STAC Collection with (signed) child Items. If you point load_stac to one of these signed child items, load_stac fails because the link to its parent collection is not signed (it tries to fetch some common band metadata from the parent collection).

[bossie]

Then again: should a user with only a signed Item URL also have access to its signed Collection URL?

[soxofaan]

should a user with only a signed Item URL also have access to its signed Collection URL

yes I think that is the intended workflow when working with signed URLs: a document at a signed URL should link to other "protected" documents with valid signed URLs.
E.g in the same spirit or related: Open-EO/openeo-api#508