kcenon::pacs::security::access_control_manager Class Reference

Manages permissions and access checks. More...

#include <access_control_manager.h>

Collaboration diagram for kcenon::pacs::security::access_control_manager:

Public Member Functions
	access_control_manager ()
bool	check_permission (const User &user, ResourceType resource, std::uint32_t action_mask) const
bool	has_role (const User &user, Role role) const
auto	validate_access (const user_context &ctx, ResourceType resource, std::uint32_t action_mask) -> kcenon::common::VoidResult
	Validate access for a user context.
AccessCheckResult	check_dicom_operation (const user_context &ctx, DicomOperation op) const
	Check if a DICOM operation is allowed.
std::optional< user_context >	get_context_for_ae (std::string_view ae_title, const std::string &session_id) const
	Get user context for an AE Title.
void	set_role_permissions (Role role, std::vector< Permission > permissions)
const std::vector< Permission > &	get_role_permissions (Role role) const
void	set_storage (std::shared_ptr< security_storage_interface > storage)
void	register_ae_title (std::string_view ae_title, std::string_view user_id)
void	unregister_ae_title (std::string_view ae_title)
void	set_audit_callback (AccessAuditCallback callback)
auto	create_user (const User &user) -> kcenon::common::VoidResult
auto	assign_role (std::string_view user_id, Role role) -> kcenon::common::VoidResult
auto	get_user (std::string_view id) -> kcenon::common::Result< User >
auto	get_user_by_ae_title (std::string_view ae_title) -> std::optional< User >
	Get user by AE Title.

Private Member Functions
void	initialize_default_permissions ()

Static Private Member Functions
static std::pair< ResourceType, std::uint32_t >	map_dicom_operation (DicomOperation op)
	Map DICOM operation to resource type and action.

Private Attributes
std::map< Role, std::vector< Permission > >	role_permissions_
std::shared_ptr< security_storage_interface >	storage_
std::map< std::string, std::string >	ae_to_user_id_
AccessAuditCallback	audit_callback_
std::mutex	mutex_

Detailed Description

Manages permissions and access checks.

Definition at line 71 of file access_control_manager.h.

Constructor & Destructor Documentation

access_control_manager()

kcenon::pacs::security::access_control_manager::access_control_manager

(

)

Definition at line 16 of file access_control_manager.cpp.

                                               {
  initialize_default_permissions();
}

References initialize_default_permissions().

Here is the call graph for this function:

Member Function Documentation

assign_role()

auto kcenon::pacs::security::access_control_manager::assign_role ( std::string_view user_id, Role role ) -> kcenon::common::VoidResult

nodiscard

Definition at line 108 of file access_control_manager.cpp.

                              {
  if (!storage_)
    return kcenon::common::make_error<std::monostate>(
        1, "Storage not configured", "access_control");
 
  // Get user, add role, update
  auto user_res = storage_->get_user(user_id);
  if (user_res.is_err())
    return kcenon::common::make_error<std::monostate>(2, "User not found",
                                                      "access_control");
 
  auto user = user_res.unwrap();
  if (!user.has_role(role)) {
    user.roles.push_back(role);
    return storage_->update_user(user);
  }
  return kcenon::common::ok();
}

check_dicom_operation()

AccessCheckResult kcenon::pacs::security::access_control_manager::check_dicom_operation ( const user_context & ctx, DicomOperation op ) const

nodiscard

Check if a DICOM operation is allowed.

Parameters

ctx	User context
op	DICOM operation to check

Returns

AccessCheckResult with allowed status and reason

Definition at line 188 of file access_control_manager.cpp.

                                                                       {
  if (!ctx.is_valid()) {
    auto result = AccessCheckResult::deny("User context is not valid");
    if (audit_callback_) {
      audit_callback_(ctx, op, result);
    }
    return result;
  }
 
  auto [resource, action] = map_dicom_operation(op);
  bool allowed = check_permission(ctx.user(), resource, action);
 
  AccessCheckResult result =
      allowed ? AccessCheckResult::allow()
              : AccessCheckResult::deny("Insufficient permissions for operation");
 
  if (audit_callback_) {
    audit_callback_(ctx, op, result);
  }
 
  return result;
}

References kcenon::pacs::security::AccessCheckResult::allow(), audit_callback_, check_permission(), kcenon::pacs::security::AccessCheckResult::deny(), kcenon::pacs::security::user_context::is_valid(), map_dicom_operation(), kcenon::pacs::security::resource, and kcenon::pacs::security::user_context::user().

Here is the call graph for this function:

check_permission()

bool kcenon::pacs::security::access_control_manager::check_permission ( const User & user, ResourceType resource, std::uint32_t action_mask ) const

nodiscard

Definition at line 128 of file access_control_manager.cpp.

                                                                             {
  if (!user.active)
    return false;
 
  for (const auto &role : user.roles) {
    auto it = role_permissions_.find(role);
    if (it != role_permissions_.end()) {
      for (const auto &perm : it->second) {
        if (perm.resource == resource && perm.has_action(action_mask)) {
          return true;
        }
      }
    }
  }
  return false;
}

References kcenon::pacs::security::resource, and role_permissions_.

Referenced by check_dicom_operation().

Here is the caller graph for this function:

create_user()

auto kcenon::pacs::security::access_control_manager::create_user ( const User & user ) -> kcenon::common::VoidResult

nodiscard

Definition at line 92 of file access_control_manager.cpp.

                              {
  if (!storage_)
    return kcenon::common::make_error<std::monostate>(
        1, "Storage not configured", "access_control");
  return storage_->create_user(user);
}

get_context_for_ae()

std::optional< user_context > kcenon::pacs::security::access_control_manager::get_context_for_ae ( std::string_view ae_title, const std::string & session_id ) const

nodiscard

Get user context for an AE Title.

Parameters

ae_title	The AE Title to look up
session_id	Session identifier for the context

Returns

User context if found, std::nullopt for unregistered AE titles

Definition at line 212 of file access_control_manager.cpp.

                                                                {
  std::lock_guard<std::mutex> lock(mutex_);
 
  // Look up AE Title to user mapping
  auto it = ae_to_user_id_.find(std::string(ae_title));
  if (it == ae_to_user_id_.end()) {
    // Reject unregistered AE titles
    return std::nullopt;
  }
 
  // Get user from storage
  if (!storage_) {
    return std::nullopt;
  }
 
  auto user_result = storage_->get_user(it->second);
  if (user_result.is_err()) {
    return std::nullopt;
  }
 
  auto ctx = user_context(user_result.unwrap(), session_id);
  ctx.set_source_ae_title(std::string(ae_title));
  return ctx;
}

References ae_to_user_id_, mutex_, and storage_.

get_role_permissions()

const std::vector< Permission > & kcenon::pacs::security::access_control_manager::get_role_permissions ( Role role ) const

nodiscard

Definition at line 157 of file access_control_manager.cpp.

                                                            {
  static const std::vector<Permission> empty;
  auto it = role_permissions_.find(role);
  if (it != role_permissions_.end()) {
    return it->second;
  }
  return empty;
}

References kcenon::pacs::security::empty, and role_permissions_.

get_user()

auto kcenon::pacs::security::access_control_manager::get_user ( std::string_view id ) -> kcenon::common::Result<User>

nodiscard

Definition at line 100 of file access_control_manager.cpp.

                                {
  if (!storage_)
    return kcenon::common::make_error<User>(1, "Storage not configured",
                                            "access_control");
  return storage_->get_user(id);
}

get_user_by_ae_title()

auto kcenon::pacs::security::access_control_manager::get_user_by_ae_title ( std::string_view ae_title ) -> std::optional<User>

nodiscard

Get user by AE Title.

Parameters

ae_title

The AE Title to look up

Returns

User if found

Definition at line 253 of file access_control_manager.cpp.

                         {
  std::lock_guard<std::mutex> lock(mutex_);
 
  auto it = ae_to_user_id_.find(std::string(ae_title));
  if (it == ae_to_user_id_.end()) {
    return std::nullopt;
  }
 
  if (!storage_) {
    return std::nullopt;
  }
 
  auto user_result = storage_->get_user(it->second);
  if (user_result.is_err()) {
    return std::nullopt;
  }
 
  return user_result.unwrap();
}

has_role()

bool kcenon::pacs::security::access_control_manager::has_role ( const User & user, Role role ) const

nodiscard

Definition at line 147 of file access_control_manager.cpp.

                                                                       {
  return user.has_role(role);
}

initialize_default_permissions()

void kcenon::pacs::security::access_control_manager::initialize_default_permissions ( )

private

Definition at line 53 of file access_control_manager.cpp.

                                                            {
  // Viewer: Read-only access to Studies
  role_permissions_[Role::Viewer] = {{ResourceType::Study, Action::Read},
                                     {ResourceType::Metadata, Action::Read}};
 
  // Technologist: Read access, Create/Update studies (but not delete)
  role_permissions_[Role::Technologist] = {
      {ResourceType::Study, Action::Read | Action::Write},
      {ResourceType::Metadata, Action::Read | Action::Write}};
 
  // Radiologist: Same as Technologist + Verification (represented as Write in
  // this simple model or could be separate) Giving Full study access for now
  // (Delete/Export)
  role_permissions_[Role::Radiologist] = {
      {ResourceType::Study, Action::Full},
      {ResourceType::Metadata, Action::Read | Action::Write}};
 
  // Administrator: User management, System config
  role_permissions_[Role::Administrator] = {
      {ResourceType::System, Action::Full},
      {ResourceType::Role, Action::Full},
      {ResourceType::Audit, Action::Full},
      {ResourceType::Study, Action::Full},
      {ResourceType::Series, Action::Full},
      {ResourceType::Image, Action::Full}};
 
  // System: Internal superuser
  role_permissions_[Role::System] = {{ResourceType::Study, Action::Full},
                                     {ResourceType::Metadata, Action::Full},
                                     {ResourceType::System, Action::Full},
                                     {ResourceType::User, Action::Full},
                                     {ResourceType::Audit, Action::Full}};
}

References kcenon::pacs::security::Administrator, kcenon::pacs::security::Audit, kcenon::pacs::security::Action::Full, kcenon::pacs::security::Image, kcenon::pacs::security::Metadata, kcenon::pacs::security::Radiologist, kcenon::pacs::security::Action::Read, kcenon::pacs::security::Role, role_permissions_, kcenon::pacs::security::Series, kcenon::pacs::security::Study, kcenon::pacs::security::System, kcenon::pacs::security::Technologist, kcenon::pacs::security::User, kcenon::pacs::security::Viewer, and kcenon::pacs::security::Action::Write.

Referenced by access_control_manager().

Here is the caller graph for this function:

map_dicom_operation()

std::pair< ResourceType, std::uint32_t > kcenon::pacs::security::access_control_manager::map_dicom_operation ( DicomOperation op )

staticprivate

Map DICOM operation to resource type and action.

Definition at line 25 of file access_control_manager.cpp.

                                                             {
  switch (op) {
  case DicomOperation::CStore:
    return {ResourceType::Study, Action::Write};
  case DicomOperation::CFind:
    return {ResourceType::Metadata, Action::Read};
  case DicomOperation::CMove:
    return {ResourceType::Study, Action::Export};
  case DicomOperation::CGet:
    return {ResourceType::Study, Action::Read | Action::Export};
  case DicomOperation::CEcho:
    return {ResourceType::System, Action::Execute};
  case DicomOperation::NCreate:
    return {ResourceType::Study, Action::Write};
  case DicomOperation::NSet:
    return {ResourceType::Study, Action::Write};
  case DicomOperation::NGet:
    return {ResourceType::Study, Action::Read};
  case DicomOperation::NDelete:
    return {ResourceType::Study, Action::Delete};
  case DicomOperation::NAction:
    return {ResourceType::Study, Action::Execute};
  case DicomOperation::NEventReport:
    return {ResourceType::Study, Action::Read};
  }
  return {ResourceType::System, Action::None};
}

References kcenon::pacs::security::CEcho, kcenon::pacs::security::CFind, kcenon::pacs::security::CGet, kcenon::pacs::security::CMove, kcenon::pacs::security::CStore, kcenon::pacs::security::Action::Delete, kcenon::pacs::security::Action::Execute, kcenon::pacs::security::Action::Export, kcenon::pacs::security::Metadata, kcenon::pacs::security::NAction, kcenon::pacs::security::NCreate, kcenon::pacs::security::NDelete, kcenon::pacs::security::NEventReport, kcenon::pacs::security::NGet, kcenon::pacs::security::Action::None, kcenon::pacs::security::NSet, kcenon::pacs::security::Action::Read, kcenon::pacs::security::Study, kcenon::pacs::security::System, and kcenon::pacs::security::Action::Write.

Referenced by check_dicom_operation().

Here is the caller graph for this function:

register_ae_title()

void kcenon::pacs::security::access_control_manager::register_ae_title	(	std::string_view	ae_title,
		std::string_view	user_id )

Definition at line 242 of file access_control_manager.cpp.

                                                                       {
  std::lock_guard<std::mutex> lock(mutex_);
  ae_to_user_id_[std::string(ae_title)] = std::string(user_id);
}

References ae_to_user_id_, and mutex_.

set_audit_callback()

void kcenon::pacs::security::access_control_manager::set_audit_callback

(

AccessAuditCallback

callback

)

Definition at line 278 of file access_control_manager.cpp.

                                                                            {
  std::lock_guard<std::mutex> lock(mutex_);
  audit_callback_ = std::move(callback);
}

References audit_callback_, and mutex_.

set_role_permissions()

void kcenon::pacs::security::access_control_manager::set_role_permissions	(	Role	role,
		std::vector< Permission >	permissions )

Definition at line 151 of file access_control_manager.cpp.

                                                  {
  role_permissions_[role] = std::move(permissions);
}

References role_permissions_.

set_storage()

void kcenon::pacs::security::access_control_manager::set_storage

(

std::shared_ptr< security_storage_interface >

storage

)

Definition at line 87 of file access_control_manager.cpp.

                                                       {
  storage_ = std::move(storage);
}

References storage_.

unregister_ae_title()

void kcenon::pacs::security::access_control_manager::unregister_ae_title

(

std::string_view

ae_title

)

Definition at line 248 of file access_control_manager.cpp.

                                                                        {
  std::lock_guard<std::mutex> lock(mutex_);
  ae_to_user_id_.erase(std::string(ae_title));
}

References ae_to_user_id_, and mutex_.

validate_access()

auto kcenon::pacs::security::access_control_manager::validate_access ( const user_context & ctx, ResourceType resource, std::uint32_t action_mask ) -> kcenon::common::VoidResult

nodiscard

Validate access for a user context.

Parameters

ctx	User context to validate
resource	Resource being accessed
action_mask	Actions being performed

Returns

Result with void on success, error on denial

Definition at line 170 of file access_control_manager.cpp.

                              {
  if (!ctx.is_valid()) {
    return kcenon::common::make_error<std::monostate>(
        1, "User context is not valid (inactive user)", "access_control");
  }
 
  if (!check_permission(ctx.user(), resource, action_mask)) {
    return kcenon::common::make_error<std::monostate>(
        2, "Access denied: insufficient permissions", "access_control");
  }
 
  return kcenon::common::ok();
}

References kcenon::pacs::security::resource.

Member Data Documentation

ae_to_user_id_

std::map<std::string, std::string> kcenon::pacs::security::access_control_manager::ae_to_user_id_

private

Definition at line 144 of file access_control_manager.h.

Referenced by get_context_for_ae(), register_ae_title(), and unregister_ae_title().

audit_callback_

AccessAuditCallback kcenon::pacs::security::access_control_manager::audit_callback_

private

Definition at line 145 of file access_control_manager.h.

Referenced by check_dicom_operation(), and set_audit_callback().

mutex_

std::mutex kcenon::pacs::security::access_control_manager::mutex_

mutableprivate

Definition at line 146 of file access_control_manager.h.

Referenced by get_context_for_ae(), register_ae_title(), set_audit_callback(), and unregister_ae_title().

role_permissions_

std::map<Role, std::vector<Permission> > kcenon::pacs::security::access_control_manager::role_permissions_

private

Definition at line 142 of file access_control_manager.h.

Referenced by check_permission(), get_role_permissions(), initialize_default_permissions(), and set_role_permissions().

storage_

std::shared_ptr<security_storage_interface> kcenon::pacs::security::access_control_manager::storage_

private

Definition at line 143 of file access_control_manager.h.

Referenced by get_context_for_ae(), and set_storage().

---

The documentation for this class was generated from the following files:

• include/kcenon/pacs/security/access_control_manager.h
• src/security/access_control_manager.cpp