@sjcrh/proteinpaint-server 2.191.3-1 → 2.191.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjcrh/proteinpaint-server",
-  "version": "2.191.3-1",
+  "version": "2.191.3",
   "type": "module",
   "description": "a genomics visualization tool for exploring a cohort's genotype and phenotype data",
   "main": "src/app.js",
@@ -63,7 +63,7 @@
     "@sjcrh/proteinpaint-r": "2.190.0",
     "@sjcrh/proteinpaint-rust": "2.191.1",
     "@sjcrh/proteinpaint-shared": "2.191.2",
-    "@sjcrh/proteinpaint-types": "2.191.3-0",
+    "@sjcrh/proteinpaint-types": "2.191.3",
     "@types/express": "^5.0.0",
     "@types/express-session": "^1.18.1",
     "better-sqlite3": "^12.4.1",

package/routes/aiProjectAdmin.js

@@ -11,13 +11,23 @@ function init({ genomes }) {
       const ds = g.datasets[query.dslabel];
       if (!ds.queries?.WSImages?.db) throw new Error("WSImages database not found.");
       const connection = getDbConnection(ds);
+      const aiHalAuth = ds.queries?.AIHalAuth;
+      if (!aiHalAuth) throw new Error("AIHalAuth queries not found in dataset.");
+      const userEmail = req.query.__protected__.clientAuthResult?.email || "";
       if (query.for === "list") {
-        const projects = getProjects(connection);
+        let projects = getProjects(connection);
+        if (!aiHalAuth.checkAuthorization(req, "listAllProjects")) {
+          projects = projects.filter((p) => aiHalAuth.getUsers(connection, p.id).includes(userEmail));
+        }
         res.send(projects);
       } else if (query.for === "admin") {
-        if (req.method === "PUT" || query.project.type === "new") addProject(connection, query.project);
-        else if (req.method === "POST") editProject(connection, query.project);
-        else if (req.method === "DELETE") deleteProject(connection, query.project.id);
+        if (req.method === "PUT" || query.project.type === "new" && aiHalAuth.checkAuthorization(req, "addProject"))
+          addProject(connection, query.project);
+        else if (req.method === "POST" && aiHalAuth.checkAuthorization(req, "editProject")) {
+          editProject(connection, query.project);
+          aiHalAuth.setUser(connection, query.project.id, userEmail || "admin", 12);
+        } else if (req.method === "DELETE" && aiHalAuth.checkAuthorization(req, "deleteProject"))
+          deleteProject(connection, query.project.id);
         else throw new Error('Invalid request method for="admin" in aiProjectAdmin route.');
         let projectId = query.project.id;
         if (!projectId) {
@@ -33,6 +43,8 @@ function init({ genomes }) {
           message: `Project ${query.project.name} processed successfully`
         });
       } else if (query.for === "filterImages") {
+        const parsedLogin = aiHalAuth.parseLogin(req, connection);
+        if (parsedLogin.status === "error") throw new Error("Authentication failed: " + parsedLogin.error);
         const q = ds.cohort.termdb.q;
         const data = await q.getFilteredImages(query.project.filter);
         data.selectedImages = await ds.queries?.WSImages?.selectWSIImages();
@@ -41,8 +53,23 @@ function init({ genomes }) {
           data
         });
       } else if (query.for === "images") {
+        const parsedLogin = aiHalAuth.parseLogin(req, connection);
+        if (parsedLogin.status === "error") throw new Error("Authentication failed: " + parsedLogin.error);
         const images = getImages(connection, query.project);
-        res.send({ images });
+        res.send({ images, status: "ok" });
+      } else if (query.for === "logout") {
+        aiHalAuth.setUser(connection, query.project.id, null);
+        res.status(200).send({
+          status: "ok",
+          message: "User logged out successfully"
+        });
+      } else if (query.for === "auth") {
+        const authorizations = {};
+        const actions = query.auth || [];
+        for (const action of actions) {
+          authorizations[action] = aiHalAuth.checkAuthorization(req, action);
+        }
+        res.status(200).send(authorizations);
       } else {
         res.send({
           status: "error",
@@ -59,7 +86,7 @@ function init({ genomes }) {
   };
 }
 function getProjects(connection) {
-  const sql = "SELECT name, id FROM project";
+  const sql = "SELECT name, id, current_user FROM project";
   return runSQL(connection, sql);
 }
 function getImages(connection, project) {

package/routes/deleteWSITileSelection.js

@@ -14,7 +14,7 @@ function init({ genomes }) {
       const ds = g.datasets[query.dslabel];
       if (!ds) throw new Error("invalid dataset name");
       if (typeof ds.queries?.WSImages?.deleteAnnotation === "function") {
-        const result = await ds.queries.WSImages.deleteAnnotation(query);
+        const result = await ds.queries.WSImages.deleteAnnotation(query, req);
         if (result?.status === "error") {
           return res.status(500).send(result);
         }
@@ -38,8 +38,16 @@ async function validate_query_deleteWSIAnnotation(ds) {
   validateQuery(ds, connection);
 }
 function validateQuery(ds, connection) {
-  ds.queries.WSImages.deleteAnnotation = async (query) => {
+  ds.queries.WSImages.deleteAnnotation = async (query, req) => {
     const zoomCoordinates = JSON.stringify(query.tileSelection.zoomCoordinates);
+    const { current_user: currentUser } = connection.prepare("SELECT current_user FROM project WHERE id = ?").get(query.projectId);
+    if (!await ds.queries?.AIHalAuth?.checkAuthorization(req, "annotate", currentUser)) {
+      return {
+        status: "error",
+        error: "logout"
+      };
+    }
+    const email = req.query.__protected__.clientAuthResult?.email || "";
     if (checkSelectionType(query.tileSelection, SelectionPrefixes.Prediction) && query.tileSelection.flag !== FlagStatus.Normal) {
       try {
         const projectId = query.projectId;
@@ -80,10 +88,10 @@ function validateQuery(ds, connection) {
         connection.prepare(
           `
 				INSERT INTO project_flagged_predictions 
-				(project_id, prediction_class_id, coordinates, flag_type, timestamp, image_id)
-				VALUES (?, ?, ?, ?, ?, ?)
+				(project_id, user_email, prediction_class_id, coordinates, flag_type, timestamp, image_id)
+				VALUES (?, ?, ?, ?, ?, ?, ?)
 			    `
-        ).run(projectId, predictionId, zoomCoordinates, flagType, (/* @__PURE__ */ new Date()).toISOString(), imageId);
+        ).run(projectId, email, predictionId, zoomCoordinates, flagType, (/* @__PURE__ */ new Date()).toISOString(), imageId);
         return { status: "ok" };
       } catch (error) {
         console.error("Error inserting flagged prediction:", error);

package/routes/saveWSIAnnotation.js

@@ -11,7 +11,7 @@ function init({ genomes }) {
       const ds = g.datasets[query.dslabel];
       if (!ds) throw new Error("invalid dataset name");
       if (typeof ds.queries?.WSImages?.saveWSIAnnotation === "function") {
-        const result = await ds.queries.WSImages.saveWSIAnnotation(query);
+        const result = await ds.queries.WSImages.saveWSIAnnotation(query, req);
         if (result?.status === "error") {
           return res.status(500).send(result);
         }
@@ -35,8 +35,9 @@ async function validate_query_saveWSIAnnotation(ds) {
   validateQuery(ds, connection);
 }
 function validateQuery(ds, connection) {
-  ds.queries.WSImages.saveWSIAnnotation = async (annotation) => {
+  ds.queries.WSImages.saveWSIAnnotation = async (annotation, req) => {
     try {
+      const { email = "" } = req.query.__protected__.clientAuthResult ?? {};
       const tileSelection = annotation.tileSelection;
       const timestamp = (/* @__PURE__ */ new Date()).toISOString();
       const projectId = annotation.projectId;
@@ -46,6 +47,13 @@ function validateQuery(ds, connection) {
       const classId = annotation.classId;
       const isAnnotation = checkSelectionType(tileSelection, SelectionPrefixes.Annotation);
       const isPrediction = checkSelectionType(tileSelection, SelectionPrefixes.Prediction);
+      const currentUser = connection.prepare("SELECT current_user FROM project WHERE id = ?").get(projectId);
+      if (!await ds.queries?.AIHalAuth?.checkAuthorization(req, "annotate", currentUser?.current_user ?? null)) {
+        return {
+          status: "error",
+          error: "logout"
+        };
+      }
       if (!isAnnotation && !isPrediction) {
         return {
           status: "error",
@@ -65,8 +73,7 @@ function validateQuery(ds, connection) {
 				  AND image_path = ?
 				LIMIT 1
 			`;
-      const getImageStmt = connection.prepare(getImageIdSql);
-      const imageRow = getImageStmt.get(projectId, wsimageFilename);
+      const imageRow = connection.prepare(getImageIdSql).get(projectId, wsimageFilename);
       if (!imageRow?.id) {
         return {
           status: "error",
@@ -93,19 +100,6 @@ function validateQuery(ds, connection) {
 					   AND coordinates = ?`
       ).run(projectId, imageId, coords);
       if (isAnnotation) {
-        const userRow = connection.prepare(
-          `SELECT id
-						  FROM project_users
-						  ORDER BY id
-						  LIMIT 1`
-        ).get();
-        const userId = userRow?.id;
-        if (userId === void 0) {
-          return {
-            status: "error",
-            error: "No users found in project_users table."
-          };
-        }
         if (tileSelection.flag === FlagStatus.Normal) {
           connection.prepare(
             `
@@ -113,7 +107,7 @@ function validateQuery(ds, connection) {
 							project_id, user_id, coordinates, timestamp,class_id, image_id
 						) VALUES (?, ?, ?, ?, ?, ?)
 					`
-          ).run(projectId, userId, coords, timestamp, classId, imageId);
+          ).run(projectId, email, coords, timestamp, classId, imageId);
         } else {
           connection.prepare(
             `
@@ -121,17 +115,18 @@ function validateQuery(ds, connection) {
 					project_id, user_id, coordinates, timestamp, flagged,class_id, image_id
 				) VALUES (?, ?, ?, ?, ?, ?, ?)
 				`
-          ).run(projectId, userId, coords, timestamp, flag, classId, imageId);
+          ).run(projectId, email, coords, timestamp, flag, classId, imageId);
         }
       } else if (isPrediction) {
         if (tileSelection.flag !== FlagStatus.Normal) {
           const insertSql = `
-                    INSERT INTO project_flagged_predictions (project_id, prediction_class_id, coordinates, flag_type,image_id,timestamp)
-                    VALUES (?, ?, ?, ?,?,?)
+                    INSERT INTO project_flagged_predictions (project_id, user_email, prediction_class_id, coordinates, flag_type,image_id,timestamp)
+                    VALUES (?, ?, ?, ?, ?, ?, ?)
                 `;
           const insertStmt = connection.prepare(insertSql);
           insertStmt.run(
             annotation.projectId,
+            email,
             annotation.classId,
             JSON.stringify(tileSelection.zoomCoordinates),
             tileSelection.flag,