From 419063fdebd7e5ac639107e30914e94a8a52cec7 Mon Sep 17 00:00:00 2001 From: Ross Date: Mon, 23 Feb 2026 12:52:55 +0000 Subject: [PATCH] Enhance BearerAuth to set request.user from api_token and improve series author assignment in import_dicoms_helper --- atlas/api.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/atlas/api.py b/atlas/api.py index 933db77b..edf00440 100644 --- a/atlas/api.py +++ b/atlas/api.py @@ -67,6 +67,14 @@ class BearerAuth(HttpBearer): # Attach for downstream handlers request.api_token = api_token + # Also set `request.user` so code that expects Django's user works + try: + request.user = api_token.user + # Some middleware caches the user on `_cached_user` + setattr(request, "_cached_user", api_token.user) + except Exception: + pass + return api_token.user @@ -92,6 +100,7 @@ class SessionOrBearer: bearer = BearerAuth() return bearer.authenticate(request, token) + # Backwards-compatible alias used in existing decorators TokenAuth = SessionOrBearer @@ -243,6 +252,7 @@ def import_dicoms_helper(request, case_id: int | None = None): series = Series.objects.get(series_instance_uid=series_uid) # Add author and case if needed + # Attach author to the series series.author.add(request.user) if case_id is not None: case_object = get_object_or_404(Case, pk=case_id) @@ -589,7 +599,6 @@ def view_dicom_tags(request, hash: str): @router.get("/series_split_by_dicom_tag/{series_id}/{dicom_tag}", auth=BearerAuth()) def series_split_by_tag(request, series_id: int, dicom_tag: str): series = get_object_or_404(Series, pk=series_id) - if not series.check_user_can_edit(request.user): return {"status": "permission denied"}