ACL functional test suite — local/remote permission matrix for cloud-plugin endpoints (0.4 ACL release)
Summary
Adds the functional-test coverage for the Sonador two-layer ACL system (global Sonador/Django pattern policy + local Orthanc-metadata resource ACL) for the 0.4 ACL release. This MR is the test evidence for the companion fix MRs:
- oak-tree/medical-imaging/sonador!88 — Sonador-side policy builder / ancestor-traversal signals
- orthanc-sonador!53 (merged) — Orthanc-side policy builder, comment permissions, traversal signals
Coverage is tracked in sonador#55 (closed) (canonical inventory) and assessed against the role matrix in oak-tree/medical-imaging/sonador#64.
What's added
New cli/roles.py — shared role/credential helpers so every test provisions the four ACL roles (ADMIN / REVIEWER / TECHNICIAN / REFERRING) consistently.
Six new tests/tests_sonadoracl_*.py modules, organized by the test-matrix axis they exercise:
| Module | Matrix axis covered |
|---|---|
tests_sonadoracl_query.py |
Server permissions — query / upload (grant → use → revoke → 403) |
tests_sonadoracl_local_view.py |
Local (Orthanc-metadata) view grants across patient / study / series |
tests_sonadoracl_modify_remove.py |
modify / remove resource permissions, global + local scope |
tests_sonadoracl_local_comments.py |
comment_view / comment_edit permissions and ancestor-view implication |
tests_sonadoracl_roles.py |
Role-driven combinations across the four ACL roles |
tests_sonadoracl_worklist_security.py |
Worklist creation under ancestor-traversal grants (guards the modify_traverse / remove_traverse regression fixed in sonador!88 / orthanc-sonador!53 (merged)) |
tests/__init__.py updated to register the new modules.
Test matrix dimensions
-
Permission: server (
query,upload) vs resource (view,modify,remove,comment_view,comment_edit,acl) - Scope: global (Sonador pattern policy) vs local (Orthanc resource ACL), combined additively — local grant wins; local deny/None falls through to global
- Resource type: patient / study / series (the forked Advanced Authorization Plugin explodes sub-resource requests across all three levels; all levels must be granted the same method)
- Role: ADMIN / REVIEWER / TECHNICIAN / REFERRING
Known gap
The acl permission functional tests are not in this MR — tracked as the highest-priority remaining gap in sonador#73 (closed) (7-case spec). All other permission axes above are covered here.
Review path
fix → test evidence: sonador!88 / orthanc-sonador!53 (merged) → this MR → coverage tracked in sonador#55 (closed) / assessed in sonador#64.