Scope of Work

This milestone delivered the Sonador access control (ACL) system: the two-tier authorization model that now governs all resource access across the platform. It began (December 2023) as a tightly scoped security extension for a partner hip pre-operative planning (HPOP) engagement and grew into the platform's security foundation. Unifying themes:

• Two-tier authorization. "Global" policies defined in the Sonador web application (pattern-based, group-scoped, per imaging server) layered with "local" policies defined per resource in Orthanc (explicit user/group grants on patients, studies, and series, with downward inheritance). Global rules are evaluated first; local grants extend access to specific resources.
• Built on the Orthanc Advanced Authorization Plugin. The originally planned custom "filter function" was dropped (February 2024) in favor of integrating with the plugin's external web-service model — Sonador provides the token validation, profile, and authorization endpoints the plugin calls on every request. Architecture-decision record: orthanc-sonador#56 (closed).
• Identity-provider integration. Validation of IdP-issued tokens (AWS Cognito), group synchronization between the IdP and Sonador, offline/cryptographic token validation, and a credentials cache to keep authorization latency low.
• A functional-test foundation. Data tenancy, server permissions, and global/local resource policies verified end-to-end through the Sonador IO client — the beginning of the ACL functional test suite that later work expanded to full permission-matrix coverage (sonador#55 (closed)).

The permission vocabulary established here (query, upload, view, modify, remove, comment_edit, comment_view, and later acl and worklist) remains the platform's authorization model.

Refer to oak-tree/medical-imaging/imaging-development-env#58 and oak-tree/medical-imaging/sonador#53 for milestone discussion and questions/answers. The question lists previously part of this issue have been copied there. Refer to oak-tree/medical-imaging/sonador#53 for tracking/updates, and to oak-tree/medical-imaging/imaging-development-env#71 for the R2 (January 2024) scope, task list, and history.

Filter Function Filter function dropped from implementation in favor of the Orthanc Advanced Authorization Plugin. Newer version of the authorization plugin includes support for user profiles. Original requirements have been kept for reference; disposition record: orthanc-sonador#56 (closed).

• Improve the permissions and access control to the Cloud Orthanc Database.
  • Build a User Model inside Orthanc (orthanc-sonador#32 (closed)) --> to be complete, Feb 12 2024 Changed to be ACL models with regular synchronization against a user/group history endpoint provided by Sonador (sonador#58).
  • Filter function in Orthanc for validating user configurations from Sonador (orthanc-sonador#32 (closed)). Dropped from milestone scope.
    • Refactor Orthanc Resources into their own class modules --> to be complete, Feb 12 2024
    • Parse DICOM Web requests for identifying Orthanc Resources in the filter function --> to be complete, Feb 12 2024
    • Parse Public System and resource requests for identifying Orthanc resources in the filter function (12/29/23) --> to be complete, Feb 12 2024
    • Write functional tests for all endpoints to test the filter method successfully --> to be complete, Feb 12 2024
    • Optimize the filter function to reduce the overhead of overloaded requests. --> to be complete, Feb 16 2024
  • Make Requests in Orthanc aware of the user associated. This way to limit the access to data based on user.

ACL Models: API Support for managing users in groups and providing a user context to Orthanc requests

• Create Access Control Models (ACL) which can be used to securely authorize resource access (orthanc-sonador#32 (closed), oak-tree/medical-imaging/sonador#53)
  • Implement model schema in both Orthanc and Sonador to provide support for query, upload, view, modify, remove, manage comments, and view comments (orthanc-sonador!23 (merged), oak-tree/medical-imaging/sonador!63)
  • Expand the implementation of the Orthanc advanced authorization API in Sonador to support profiles, more granular permissions, and resource tokens (oak-tree/medical-imaging/sonador!64, orthanc-sonador!24 (merged))
  • Integrate Orthanc Cloud Plugin ACL models with Sonador authorization forms/views in order to incorporate local (Orthanc) policy checks into the authorization workflow (oak-tree/medical-imaging/sonador!64)
• Expand test suite to test for data tenancy and isolation. access control. Ensure that data is only seen by authorized users (sonador-client#23 (closed))
  • Create technical reference notebook showing the workflow for creating a test group, test user, and test credentials. Demonstrate use of authorizing patient, study, and series for view permissions via both global and local policies (sonador-examples!13 (merged))
  • Implement notebook as set of functional tests within Sonador IO client library (sonador-ftests!3 (merged), sonador-ftests!4 (merged))
  • Generate test matrix for all roles and combinations of permissions, ensure that roles and test cases are covered in both test and validation plan (sonador#35 (closed), oak-tree/medical-imaging/sonador#64) (moved to MS4; completed June 2026 — sonador-ftests!8 (merged), tracked in sonador#55 (closed))
  • Implement all functional test cases within Sonador IO client library showing complete coverage of query, upload, view, modify, remove, manage comments, and view comments for all resource types (patient, study, and series) (oak-tree/medical-imaging/sonador#64) (moved to MS4; completed June–July 2026, tracked in sonador#55 (closed) — the acl permission suite closed out via sonador#73 (closed) and sonador-ftests!13 (merged))
• Implement API support for creating User, Groups, and access credentials within Sonador (oak-tree/medical-imaging/sonador!63)
• Create a "filter" API within Sonador to allow for users to be looked up via token (introspect) and UID (sonador#59 (closed))
• Integrate the user/group lookup/filter/search into Orthanc so that Orthanc is able to verify user identity when creating comments and ACL policies (orthanc-sonador#39 (closed))

IdP Sync: Ensure that groups defined in the IdP are defined in Sonador and that the user is correctly assigned

• Implement fields in wgtauth to allow for a sync_groups method which is able to execute after a user logs into Sonador (django-apps/wagtail-auth!4) and validate_token
  • Dynamic field for sync_groups
  • Dynamic field for validate_token
  • Group synchronization for Cognito (should be part of the login AND token validation) (oak-tree/medical-imaging/sonador!66, oak-tree/medical-imaging/sonador!68, django-apps/wagtail-auth!5)
    • Query the remote group membership in Cognito
    • If a group exists in the IdP, but not in Sonador, create a group of the same name in Sonador
    • Add the user to the group
    • If a user is member of a group in Sonador, but not in the IdP, remove the user from the group
  • Remote token validation: receive a token from Orthanc, check local token sources, if no match check remote providers to see if it is a valid token from an IdP (sonador#60 (closed))
• Add a "credentials cache" to Sonador that is able to determine if a credential has already been authorized by the system and is still valid (required to speed up IdP validation of remote tokens) (oak-tree/medical-imaging/sonador#68, sonador#63 (closed))
• Add cryptography, hashlib, and other tools for performing "offline" validation of Cognito issued tokens (sonador#67 (closed))
• Add support to Cognito auth provider so it is able to perform offline/cryptographic validation of IdP tokens and cache the results (sonador#60 (closed), sonador#67 (closed))

Test Suite: Data tenancy and access control (implemented in sonador-ftests!3 (merged) and sonador-ftests!4 (merged))

• Test 1 (upload server permission): upload data to Sonador
  • Admin creates a policy to authorize upload to Sonador
  • Test user uploads an image to the server
  • Admin revokes the policy by setting upload to False
  • Test user attempts an upload to the server and receives a 403 error

• Test 2 (query server permission): check that the user receives 403 if query is not enabled
  • Admin creates a policy with query permission
  • Known data is uploaded by admin
  • Test user is able to query and find the uploaded data
  • Policy is revoked
  • Test user receives a 403 when attempting to utilize query endpoint

Test Suite: Global Permissions (sonador#56 (closed); implemented in sonador-ftests!3 (merged))

• Test 1: series access permission (view)
• Test 2: study access permission (view)
• Test 3: patient access permission (view)

Test Suite: Local Permissions (sonador#65 (moved), sonador#57 (closed) — completed per the Functional Tests record on oak-tree/medical-imaging/sonador#53 (closed 2026-06-30), implemented in sonador-ftests!4 (merged); expanded local-permission coverage delivered June 2026 via sonador-ftests!8 (merged), tracked in sonador#55 (closed))

• Test 1: User data tenancy control (Orthanc)
  • Admin creates policy allowing upload of image to Sonador
  • Test user uploads data to the server
  • Admin creates a user grant on Orthanc giving the test user permission to access the uploaded study
  • Verify that the user has authorization
• Test 2: Inverse of Original test
  • User uploads image
  • Revoke their permissions with user model API, verifiy they aren't authorized
• Test 3: Test User grant to second user
  • User uploads image to Sonador
  • Utilize Sonador user/groups API to create a new limited user.
  • Create a grant providing access to the data.
  • Perform a retrieve operation using the limited user and ensure access to the data.
  • Remove the grant, perform a retrieve operation and ensure that access to the data is denied

Notes:

• February 15, 2024: Sonador was notified of changes to the scope of development due to updates to Orthanc's advanced authorization plugin (refer to comments above). The fundamental approach to validation of resource access will be the same and will be managed via an integration between Orthanc and Sonador.
• March 24, 2024: Milestone updated with further detail on tests, documentation, and sub-tasks needed to close out.
• March 28, 2024: Updated test cases with details about server permissions, global access policies, and local access policies. Agreed to focus on global policy tests for Mar 29 review.
• May 8, 2024: Initial implementation of Cognito credential provider is too slow. When enabled, the time for processing authorization requests increases from significantly less than a second to multiple seconds. Added two new issues: one calling for the creation of a credentials cache and a second to inject cryptography and hashing tools into the provider context to allow for "offline" (cryptographic) validation, without requiring an external network call.
• May 31, 2024: Added tasks for Sonador user/group lookup via UID and its integration into Orthanc.
• October 24, 2024: Created a follow-up milestone to group overflow and additional development. %Centinel: Sonador Security Upgrades (Again)
• July 9, 2026: Milestone reviewed and cleaned up in preparation for closure. Added the Scope of Work summary; associated previously unreferenced task-list items with their implementing issues and merge requests; normalized all references to full paths. Marked the Local Permissions test suite complete per the Functional Tests record on oak-tree/medical-imaging/sonador#53 (implemented in sonador-ftests!4 (merged); expanded June 2026 via sonador-ftests!8 (merged), tracked in sonador#55 (closed)). The December 2023 planning annotations were consolidated into the tracking issues (oak-tree/medical-imaging/imaging-development-env#58 and oak-tree/medical-imaging/imaging-development-env#71) with the originals archived in their comments; oak-tree/medical-imaging/imaging-development-env#71 now carries the R2 scope narrative, implemented-task list (verified 17/17 against the issue/MR record), and history.
• July 10, 2026 (scope changes — items carried under other milestones): The Visionaire POP end-to-end functional tests (oak-tree/medical-imaging/sonador#51), part of the December 2023 scope tracked in oak-tree/medical-imaging/imaging-development-env#58, are attached to and carried forward under %Centinel: Sonador Security Upgrades (Again); the outstanding Airflow-mediated test paths (Tests 2 and 4) remain open there. The viewer work items from the same December scope (oak-tree/medical-imaging/imaging-development-env#63, oak-tree/medical-imaging/imaging-development-env#66, imaging-development-env#84 (closed), imaging-development-env#85 (closed)) were carried and completed under %OHIF UI Enhancements and improved Sonador integration. Conversely, the role/permission test-matrix items annotated "(moved to MS4)" in the task list above (oak-tree/medical-imaging/sonador#64, sonador#55 (closed), sonador#73 (closed)) remained attached to this milestone and were closed here (June–July 2026). Remaining outstanding items from the December 2023 scope were re-scoped into standalone issues (sonador#78 (closed), ohif-viewers#117, ohif-viewers#118), linked to their existing tracking issues (ohif-viewers#8, ohif-viewers#20 (closed), oak-tree/medical-imaging/sonador#51, oak-tree/medical-imaging/imaging-development-env#68), or formally dispositioned (ohif-viewers#119 (closed) — duplicate; orthanc-sonador#56 (closed) — superseded); full trace in the re-scoping comment on oak-tree/medical-imaging/imaging-development-env#58.