Refinements to advanced authorization plugin to allow for the reporting of which resources/actions a a user is requesting access to

Rob Oakesrequested to merge
roakes/comments-auth into master

Summary

Extends the Sonador fork of the Orthanc Advanced Authorization Plugin to include an action field in resource authorization requests, enabling Sonador to apply granular per-action permission checks (specifically comment_edit and comment_view) at all resource levels.

Problem

The Orthanc authorization plugin sends permission checks to Sonador at each parent level (patient, study, series) for every resource request. At parent levels, the uri field in the auth request is empty, so Sonador received requests like level: 'patient', method: 'post', uri: '' with no way to distinguish a comment creation from a generic resource modification. Sonador's authorization logic therefore checked the modify permission rather than comment_edit, causing authorized comment operations to return 403.

Changes

New action field

Resource authorization requests now include an action field set to 'comment' when the plugin detects a comment-related URL. Detection covers:

Standard Orthanc API (/series/<id>/comments, /series/<id>/comments/<id>, same for /studies/):

  • POST to the collection endpoint
  • GET, PUT, DELETE on both collection and item endpoints

DICOMweb API (/dicom-web/series/<uid>/comments, /dicom-web/series/<uid>/comments/<id>):

  • All methods on both collection and item endpoints

The action field is included at all levels (patient, study, series) so Sonador has the context regardless of which level is being evaluated.

When action is absent or empty, all existing authorization behavior is unchanged.

Configuration

IncludeResourceUri must be true in the plugin configuration for the URL pattern matching to receive the full URI at the series level. This setting is now part of the default Sonador deployment configuration.

Notes

This is the first merge request into the Sonador fork of the upstream Orthanc advanced authorization project. The action field change will be submitted upstream to the Orthanc team for consideration in the official plugin, but is maintained here in the interim.

Related

  • sonador#52 (closed) — originating issue
  • oak-tree/medical-imaging/sonador!87 — Sonador web application changes that consume the action field
  • orthanc-sonador!52 (merged) — container build that packages this plugin
  • oak-tree/medical-imaging/sonador-client!70 — functional tests validating the full stack
Edited by Sonador Claude

Merge request reports