access_control_manager.h

Go to the documentation of this file.

// BSD 3-Clause License
// Copyright (c) 2021-2025, 🍀☀🌕🌥 🌊
// See the LICENSE file in the project root for full license information.
 
#pragma once
 
#include "permission.h"
#include "security_storage_interface.h"
#include "user.h"
#include "user_context.h"
#include <functional>
#include <map>
#include <memory>
#include <mutex>
#include <optional>
#include <vector>
 
namespace kcenon::pacs::security {
 
enum class DicomOperation {
  CStore,   
  CFind,    
  CMove,    
  CGet,     
  CEcho,    
  NCreate,  
  NSet,     
  NGet,     
  NDelete,  
  NAction,  
  NEventReport 
};
 
struct AccessCheckResult {
  bool allowed{false};
  std::string reason;
 
  static AccessCheckResult allow() { return {true, ""}; }
  static AccessCheckResult deny(std::string reason) {
    return {false, std::move(reason)};
  }
 
  explicit operator bool() const { return allowed; }
};
 
using AccessAuditCallback =
    std::function<void(const user_context &ctx, DicomOperation op,
                       const AccessCheckResult &result)>;
 
class access_control_manager {
public:
  access_control_manager();
 
  // Permission Checks
  [[nodiscard]] bool check_permission(const User &user, ResourceType resource,
                                      std::uint32_t action_mask) const;
  [[nodiscard]] bool has_role(const User &user, Role role) const;
 
  [[nodiscard]] auto validate_access(const user_context &ctx,
                                     ResourceType resource,
                                     std::uint32_t action_mask)
      -> kcenon::common::VoidResult;
 
  [[nodiscard]] AccessCheckResult check_dicom_operation(const user_context &ctx,
                                                        DicomOperation op) const;
 
  [[nodiscard]] std::optional<user_context> get_context_for_ae(
      std::string_view ae_title, const std::string &session_id) const;
 
  // Configuration
  void set_role_permissions(Role role, std::vector<Permission> permissions);
  [[nodiscard]] const std::vector<Permission> &
  get_role_permissions(Role role) const;
 
  // Storage Integration
  void set_storage(std::shared_ptr<security_storage_interface> storage);
 
  // AE Title to User mapping
  void register_ae_title(std::string_view ae_title, std::string_view user_id);
  void unregister_ae_title(std::string_view ae_title);
 
  // Audit callback
  void set_audit_callback(AccessAuditCallback callback);
 
  // User Management Facade
  [[nodiscard]] auto create_user(const User &user)
      -> kcenon::common::VoidResult;
  [[nodiscard]] auto assign_role(std::string_view user_id, Role role)
      -> kcenon::common::VoidResult;
  [[nodiscard]] auto get_user(std::string_view id)
      -> kcenon::common::Result<User>;
 
  [[nodiscard]] auto get_user_by_ae_title(std::string_view ae_title)
      -> std::optional<User>;
 
private:
  std::map<Role, std::vector<Permission>> role_permissions_;
  std::shared_ptr<security_storage_interface> storage_;
  std::map<std::string, std::string> ae_to_user_id_;
  AccessAuditCallback audit_callback_;
  mutable std::mutex mutex_;
 
  void initialize_default_permissions();
 
  static std::pair<ResourceType, std::uint32_t>
  map_dicom_operation(DicomOperation op);
};
 
} // namespace kcenon::pacs::security