Add 'action' field to resource authorization requests to support granular comment permission checks

Background

The Orthanc Advanced Authorization Plugin mediates all access to Sonador's Orthanc PACS instance by sending authorization requests to the Sonador web application for each incoming Orthanc API call. For requests targeting DICOM resources (patient, study, series), the plugin sends separate authorization checks at each parent level.

A bug was discovered during functional testing of the comment_edit and comment_view permissions: when a limited user attempted to create or modify a comment via the standard Orthanc API (e.g. POST /series/<orthanc-id>/comments), the authorization checks at the patient and study levels arrived at Sonador with an empty uri field. Without the URI, Sonador could not identify the operation as a comment action and fell back to checking the modify permission — which denied the request even when the user had comment_edit: True in their ACL.

Simultaneously, the DICOMweb comment endpoints (/dicom-web/series/<uid>/comments and /dicom-web/series/<uid>/comments/<id>) were handled as level: system requests without any resource-level context, preventing per-user comment permission checks on those paths.

Changes

This issue tracks the changes in !1 (merged).

New action field in resource authorization requests

The plugin now includes an action field in resource authorization requests sent to Sonador when it detects a comment-related URL. The field is set to 'comment' for the following URL patterns:

Standard Orthanc API:

  • POST /series/<id>/comments — create a series comment
  • GET /series/<id>/comments — list series comments
  • GET /series/<id>/comments/<comment-id> — retrieve a specific comment
  • PUT /series/<id>/comments/<comment-id> — update a comment
  • DELETE /series/<id>/comments/<comment-id> — delete a comment
  • Same patterns for /studies/<id>/comments

DICOMweb API:

  • POST /dicom-web/series/<uid>/comments
  • GET /dicom-web/series/<uid>/comments
  • GET /dicom-web/series/<uid>/comments/<comment-id>
  • PUT /dicom-web/series/<uid>/comments/<comment-id>
  • DELETE /dicom-web/series/<uid>/comments/<comment-id>

The action field is included in auth requests at all levels (patient, study, series) so that Sonador can identify the operation type even when the uri field is empty at parent levels. When action is absent or empty, the existing authorization logic is unchanged.

IncludeResourceUri configuration requirement

For the action: 'comment' injection to work correctly on the standard Orthanc API paths, the IncludeResourceUri option in the plugin configuration must be set to true. This causes Orthanc to include the full resource URI in the series-level authorization request, which is required for the URL pattern matching logic.

Implementation Notes

The action detection is based on URL suffix matching (.../comments and .../comments/<uuid>). The pattern is intentionally broad to handle both standard and DICOMweb endpoints and both collection and item-level operations.

Changes are maintained in the Sonador fork of the upstream Orthanc advanced authorization project. The changes will be submitted upstream to the Orthanc team for inclusion in the official plugin.

Related

Project Tracking

OP#41 OP#49 OP#74

Edited by Sonador ChatGPT