Mercurial > hg > orthanc-tests
annotate NewTests/Authorization/test_authorization.py @ 631:3bf3ea08efde
typo
author | Alain Mazy <am@osimis.io> |
---|---|
date | Tue, 05 Mar 2024 09:13:02 +0100 |
parents | 78314ab6fc67 |
children | 2084e0640775 |
rev | line source |
---|---|
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
1 import unittest |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
2 import time |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
3 import pprint |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
4 import subprocess |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
5 from helpers import OrthancTestCase, Helpers |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
6 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
7 from orthanc_api_client import OrthancApiClient, generate_test_dicom_file |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
8 from orthanc_api_client import exceptions as orthanc_exceptions |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
9 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
10 import logging |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
11 import pathlib |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
12 here = pathlib.Path(__file__).parent.resolve() |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
13 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
14 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
15 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
16 class TestAuthorization(OrthancTestCase): |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
17 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
18 label_a_study_id = None |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
19 label_b_study_id = None |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
20 no_label_study_id = None |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
21 auth_service_process = None |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
22 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
23 @classmethod |
577 | 24 def terminate(cls): |
578 | 25 |
26 if Helpers.is_docker(): | |
27 subprocess.run(["docker", "rm", "-f", "auth-service"]) | |
28 else: | |
29 cls.auth_service_process.terminate() | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
30 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
31 @classmethod |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
32 def prepare(cls): |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
33 test_name = "Authorization" |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
34 storage_name = "authorization" |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
35 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
36 print(f'-------------- preparing {test_name} tests') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
37 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
38 cls.clear_storage(storage_name=storage_name) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
39 |
577 | 40 auth_service_hostname = "localhost" |
41 if Helpers.is_docker(): | |
42 auth_service_hostname = "auth-service" | |
43 cls.create_docker_network("auth-test-network") | |
44 | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
45 config = { |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
46 "AuthenticationEnabled": False, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
47 "Authorization": { |
577 | 48 "WebServiceRootUrl": f"http://{auth_service_hostname}:8020/", |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
49 "StandardConfigurations": [ |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
50 "orthanc-explorer-2", |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
51 "stone-webviewer" |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
52 ], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
53 "CheckedLevel": "studies", |
577 | 54 "TokenHttpHeaders": ["user-token-key", "resource-token-key"], |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
55 "TokenGetArguments": ["resource-token-key"] |
578 | 56 }, |
57 "DicomWeb": { | |
58 "Enable": True | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
59 } |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
60 } |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
61 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
62 config_path = cls.generate_configuration( |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
63 config_name=f"{test_name}", |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
64 storage_name=storage_name, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
65 config=config, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
66 plugins=Helpers.plugins |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
67 ) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
68 |
577 | 69 if Helpers.is_exe(): |
70 # Start the auth-service application as a subprocess and wait for it to start | |
71 cls.auth_service_process = subprocess.Popen(["uvicorn", "auth_service:app", "--host", "0.0.0.0", "--port", "8020"], cwd=here) | |
72 time.sleep(2) | |
73 else: | |
74 # first build the docker image for the auth-service | |
75 subprocess.run(["docker", "build", "-t", "auth-service", "."], cwd=here) | |
76 cls.auth_service_process = subprocess.Popen(["docker", "run", "-p", "8020:8020", "--network", "auth-test-network", "--name", "auth-service", "auth-service"]) | |
579 | 77 time.sleep(5) |
577 | 78 |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
79 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
80 if Helpers.break_before_preparation: |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
81 print(f"++++ It is now time to start your Orthanc under tests with configuration file '{config_path}' +++++") |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
82 input("Press Enter to continue") |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
83 else: |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
84 cls.launch_orthanc_under_tests( |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
85 config_name=f"{test_name}", |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
86 storage_name=storage_name, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
87 config=config, |
577 | 88 plugins=Helpers.plugins, |
89 docker_network="auth-test-network" | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
90 ) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
91 |
578 | 92 o = OrthancApiClient(cls.o._root_url, headers={"user-token-key": "token-uploader"}) |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
93 |
578 | 94 o.delete_all_content() |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
95 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
96 # upload a few studies and add labels |
578 | 97 cls.label_a_instance_id = o.upload_file(here / "../../Database/Knix/Loc/IM-0001-0001.dcm")[0] |
98 cls.label_a_study_id = o.instances.get_parent_study_id(cls.label_a_instance_id) | |
99 cls.label_a_series_id = o.instances.get_parent_series_id(cls.label_a_instance_id) | |
100 cls.label_a_study_dicom_id = o.studies.get_tags(cls.label_a_study_id)["StudyInstanceUID"] | |
101 cls.label_a_series_dicom_id = o.series.get_tags(cls.label_a_series_id)["SeriesInstanceUID"] | |
102 cls.label_a_instance_dicom_id = o.instances.get_tags(cls.label_a_instance_id)["SOPInstanceUID"] | |
103 o.studies.add_label(cls.label_a_study_id, "label_a") | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
104 |
578 | 105 cls.label_b_instance_id = o.upload_file(here / "../../Database/Brainix/Epi/IM-0001-0001.dcm")[0] |
106 cls.label_b_study_id = o.instances.get_parent_study_id(cls.label_b_instance_id) | |
107 cls.label_b_series_id = o.instances.get_parent_series_id(cls.label_b_instance_id) | |
108 cls.label_b_study_dicom_id = o.studies.get_tags(cls.label_b_study_id)["StudyInstanceUID"] | |
109 cls.label_b_series_dicom_id = o.series.get_tags(cls.label_b_series_id)["SeriesInstanceUID"] | |
110 cls.label_b_instance_dicom_id = o.instances.get_tags(cls.label_b_instance_id)["SOPInstanceUID"] | |
111 o.studies.add_label(cls.label_b_study_id, "label_b") | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
112 |
578 | 113 instances_ids = o.upload_file(here / "../../Database/Comunix/Pet/IM-0001-0001.dcm") |
114 cls.no_label_study_id = o.instances.get_parent_study_id(instances_ids[0]) | |
115 | |
116 cls.no_label_instance_id = o.upload_file(here / "../../Database/Comunix/Pet/IM-0001-0001.dcm")[0] | |
117 cls.no_label_study_id = o.instances.get_parent_study_id(cls.no_label_instance_id) | |
118 cls.no_label_series_id = o.instances.get_parent_series_id(cls.no_label_instance_id) | |
119 cls.no_label_study_dicom_id = o.studies.get_tags(cls.no_label_study_id)["StudyInstanceUID"] | |
120 cls.no_label_series_dicom_id = o.series.get_tags(cls.no_label_series_id)["SeriesInstanceUID"] | |
121 cls.no_label_instance_dicom_id = o.instances.get_tags(cls.no_label_instance_id)["SOPInstanceUID"] | |
122 | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
123 |
577 | 124 def assert_is_forbidden(self, api_call): |
125 with self.assertRaises(orthanc_exceptions.HttpError) as ctx: | |
126 api_call() | |
127 self.assertEqual(403, ctx.exception.http_status_code) | |
128 | |
129 | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
130 def test_admin_user(self): |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
131 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
132 o = OrthancApiClient(self.o._root_url, headers={"user-token-key": "token-admin"}) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
133 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
134 # make sure we can access all these urls (they would throw if not) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
135 system = o.get_system() |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
136 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
137 # make sure we can access all studies |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
138 o.studies.get_tags(self.no_label_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
139 o.studies.get_tags(self.label_a_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
140 o.studies.get_tags(self.label_b_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
141 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
142 # make sure we can access series and instances of these studies |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
143 series_ids = o.studies.get_series_ids(self.label_a_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
144 instances_ids = o.series.get_instances_ids(series_ids[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
145 o.instances.get_tags(instances_ids[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
146 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
147 # make sure labels filtering still works |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
148 self.assertEqual(3, len(o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
149 labels=[], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
150 labels_constraint='Any'))) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
151 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
152 self.assertEqual(2, len(o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
153 labels=['label_a', 'label_b'], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
154 labels_constraint='Any'))) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
155 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
156 self.assertEqual(2, len(o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
157 labels=['label_a'], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
158 labels_constraint='None'))) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
159 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
160 all_labels = o.get_all_labels() |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
161 self.assertEqual(2, len(all_labels)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
162 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
163 def test_user_a(self): |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
164 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
165 o = OrthancApiClient(self.o._root_url, headers={"user-token-key": "token-user-a"}) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
166 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
167 # # make sure we can access all these urls (they would throw if not) |
578 | 168 system = o.get_system() |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
169 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
170 all_labels = o.get_all_labels() |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
171 self.assertEqual(1, len(all_labels)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
172 self.assertEqual("label_a", all_labels[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
173 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
174 # make sure we can access only the label_a studies |
577 | 175 self.assert_is_forbidden(lambda: o.studies.get_tags(self.label_b_study_id)) |
176 self.assert_is_forbidden(lambda: o.studies.get_tags(self.no_label_study_id)) | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
177 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
178 # should not raise |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
179 o.studies.get_tags(self.label_a_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
180 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
181 # make sure we can access series and instances of the label_a studies |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
182 series_ids = o.studies.get_series_ids(self.label_a_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
183 instances_ids = o.series.get_instances_ids(series_ids[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
184 o.instances.get_tags(instances_ids[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
185 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
186 # make sure we can not access series and instances of the label_b studies |
577 | 187 self.assert_is_forbidden(lambda: o.studies.get_series_ids(self.label_b_study_id)) |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
188 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
189 # make sure tools/find only returns the label_a studies |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
190 studies = o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
191 labels=[], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
192 labels_constraint='Any') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
193 self.assertEqual(1, len(studies)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
194 self.assertEqual(self.label_a_study_id, studies[0].orthanc_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
195 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
196 # if searching Any of label_a & label_b, return only label_a |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
197 studies = o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
198 labels=['label_a', 'label_b'], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
199 labels_constraint='Any') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
200 self.assertEqual(1, len(studies)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
201 self.assertEqual(self.label_a_study_id, studies[0].orthanc_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
202 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
203 # if searching Any of label_b, expect a Forbidden access |
577 | 204 self.assert_is_forbidden(lambda: o.studies.find(query={}, |
205 labels=['label_b'], | |
206 labels_constraint='Any')) | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
207 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
208 # if searching None of label_b, expect a Forbidden access because we are not able to compute this filter |
577 | 209 self.assert_is_forbidden(lambda: o.studies.find(query={}, |
210 labels=['label_b'], | |
211 labels_constraint='None')) | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
212 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
213 # if searching All of label_b, expect a Forbidden access because we are not able to compute this filter |
577 | 214 self.assert_is_forbidden(lambda: o.studies.find(query={}, |
215 labels=['label_b'], | |
216 labels_constraint='All')) | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
217 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
218 studies = o.studies.find(query={"PatientName": "KNIX"}, # KNIX is label_a |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
219 labels=[], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
220 labels_constraint='Any') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
221 self.assertEqual(1, len(studies)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
222 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
223 studies = o.studies.find(query={"PatientName": "KNIX"}, # KNIX is label_a |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
224 labels=['label_a'], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
225 labels_constraint='Any') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
226 self.assertEqual(1, len(studies)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
227 |
577 | 228 self.assert_is_forbidden(lambda: o.studies.find(query={"PatientName": "KNIX"}, # KNIX is label_a |
229 labels=['label_b'], | |
230 labels_constraint='Any')) | |
231 | |
232 # make sure some generic routes are not accessible | |
233 self.assert_is_forbidden(lambda: o.get_json('patients?expand')) | |
234 self.assert_is_forbidden(lambda: o.get_json('studies?expand')) | |
235 self.assert_is_forbidden(lambda: o.get_json('series?expand')) | |
236 self.assert_is_forbidden(lambda: o.get_json('instances?expand')) | |
237 self.assert_is_forbidden(lambda: o.get_json('studies')) | |
238 self.assert_is_forbidden(lambda: o.get_json('studies/')) | |
239 | |
578 | 240 # make sure the label_a study is accessible (it does not throw) |
241 o.studies.get_tags(self.label_a_study_id) | |
242 o.series.get_tags(self.label_a_series_id) | |
243 o.instances.get_tags(self.label_a_instance_id) | |
244 | |
625 | 245 # make sure you can access a resource route with a user token (it does not throw) |
246 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/metadata") | |
247 self.assert_is_forbidden(lambda: o.get_json(f"dicom-web/studies/{self.label_b_study_dicom_id}/metadata")) | |
578 | 248 |
577 | 249 |
250 | |
251 def test_resource_token(self): | |
252 | |
590
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
253 o = OrthancApiClient(self.o._root_url, headers={"resource-token-key": "token-a-study"}) |
577 | 254 |
255 # with a resource token, we can access only the given resource, not generic resources or resources from other studies | |
256 | |
257 # generic resources are forbidden | |
578 | 258 self.assert_is_forbidden(lambda: o.studies.find(query={"PatientName": "KNIX"}, # tools/find is forbidden with a resource token |
577 | 259 labels=['label_b'], |
260 labels_constraint='Any')) | |
261 self.assert_is_forbidden(lambda: o.get_all_labels()) | |
262 self.assert_is_forbidden(lambda: o.studies.get_all_ids()) | |
263 self.assert_is_forbidden(lambda: o.patients.get_all_ids()) | |
264 self.assert_is_forbidden(lambda: o.series.get_all_ids()) | |
265 self.assert_is_forbidden(lambda: o.instances.get_all_ids()) | |
266 self.assert_is_forbidden(lambda: o.get_json('patients?expand')) | |
267 self.assert_is_forbidden(lambda: o.get_json('studies?expand')) | |
268 self.assert_is_forbidden(lambda: o.get_json('series?expand')) | |
269 self.assert_is_forbidden(lambda: o.get_json('instances?expand')) | |
578 | 270 self.assert_is_forbidden(lambda: o.get_json('studies')) |
271 self.assert_is_forbidden(lambda: o.get_json('studies/')) | |
577 | 272 |
273 # some resources are still accessible to the 'anonymous' user -> does not throw | |
274 o.get_system() | |
275 o.lookup("1.2.3") # this route is still explicitely authorized because it is used by Stone | |
276 | |
277 # other studies are forbidden | |
278 self.assert_is_forbidden(lambda: o.studies.get_series_ids(self.label_b_study_id)) | |
621 | 279 if self.o.is_orthanc_version_at_least(1, 12, 2): |
590
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
280 self.assert_is_forbidden(lambda: o.get_binary(f"tools/create-archive?resources={self.label_b_study_id}")) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
281 self.assert_is_forbidden(lambda: o.get_binary(f"tools/create-archive?resources={self.label_b_series_id}")) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
282 # if one of the studies is forbidden, the resource is forbidden |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
283 self.assert_is_forbidden(lambda: o.get_binary(f"tools/create-archive?resources={self.label_b_study_id},{self.label_a_study_id}")) |
577 | 284 |
285 # the label_a study is allowed | |
286 o.studies.get_series_ids(self.label_a_study_id) | |
287 | |
578 | 288 # test with DicomWEB routes + sub-routes |
289 o.get_binary(f"dicom-web/studies/{self.label_a_study_dicom_id}") | |
290 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/metadata") | |
581 | 291 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/series") |
578 | 292 o.get_binary(f"dicom-web/studies/{self.label_a_study_dicom_id}/series/{self.label_a_series_dicom_id}") |
293 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/series/{self.label_a_series_dicom_id}/metadata") | |
294 o.get_binary(f"dicom-web/studies/{self.label_a_study_dicom_id}/series/{self.label_a_series_dicom_id}/instances/{self.label_a_instance_dicom_id}") | |
295 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/series/{self.label_a_series_dicom_id}/instances/{self.label_a_instance_dicom_id}/metadata") | |
581 | 296 o.get_json(f"dicom-web/studies?StudyInstanceUID={self.label_a_study_dicom_id}") |
297 o.get_json(f"dicom-web/studies?0020000D={self.label_a_study_dicom_id}") | |
298 o.get_json(f"dicom-web/series?0020000D={self.label_a_study_dicom_id}") | |
299 o.get_json(f"dicom-web/instances?0020000D={self.label_a_study_dicom_id}") | |
590
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
300 |
621 | 301 if self.o.is_orthanc_version_at_least(1, 12, 2): |
590
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
302 o.get_binary(f"tools/create-archive?resources={self.label_a_study_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
303 o.get_binary(f"tools/create-archive?resources={self.label_a_series_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
304 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
305 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
306 # now test with token-both |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
307 o = OrthancApiClient(self.o._root_url, headers={"resource-token-key": "token-both-studies"}) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
308 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
309 # other studies are forbidden |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
310 self.assert_is_forbidden(lambda: o.studies.get_series_ids(self.no_label_study_id)) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
311 self.assert_is_forbidden(lambda: o.get_binary(f"tools/create-archive?resources={self.no_label_study_id}")) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
312 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
313 # any of both or both studies together are allowed |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
314 o.get_binary(f"tools/create-archive?resources={self.label_a_study_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
315 o.get_binary(f"tools/create-archive?resources={self.label_b_series_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
316 o.get_binary(f"tools/create-archive?resources={self.label_b_study_id},{self.label_a_study_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
317 o.get_binary(f"tools/create-archive?resources={self.label_b_study_id},{self.label_a_series_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
318 o.get_binary(f"tools/create-archive?resources={self.label_b_study_id},{self.label_a_instance_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
319 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
320 |