fix(imaging): keep Orthanc PACS credentials in sync

Author: sudoshi

backend/app/Services/Imaging/PacsConnectionService.php

@@ -179,7 +179,7 @@ public function resolveClient(PacsConnection $conn): PendingRequest
         $client = Http::timeout(15)
             ->accept('application/dicom+json');
 
-        $credentials = $conn->credentials ?? [];
+        $credentials = $this->credentialsForConnection($conn);
 
         return match ($conn->auth_type) {
             'basic' => $client->withBasicAuth(
@@ -302,7 +302,7 @@ private function orthancRestBase(PacsConnection $conn): string
     private function resolveOrthancRestClient(PacsConnection $conn): PendingRequest
     {
         $client = Http::timeout(30);
-        $credentials = $conn->credentials ?? [];
+        $credentials = $this->credentialsForConnection($conn);
 
         return match ($conn->auth_type) {
             'basic' => $client->withBasicAuth(
@@ -314,6 +314,24 @@ private function resolveOrthancRestClient(PacsConnection $conn): PendingRequest
         };
     }
 
+    /**
+     * Resolve connection credentials, using the runtime Orthanc secret for the
+     * built-in Orthanc service so encrypted DB rows do not drift after rotation.
+     *
+     * @return array<string, mixed>
+     */
+    private function credentialsForConnection(PacsConnection $conn): array
+    {
+        $credentials = $conn->credentials ?? [];
+
+        if ($conn->type === 'orthanc') {
+            $credentials['username'] = env('ORTHANC_USER', $credentials['username'] ?? '');
+            $credentials['password'] = env('ORTHANC_PASSWORD', $credentials['password'] ?? '');
+        }
+
+        return $credentials;
+    }
+
     /**
      * Refresh stats for a generic DICOMweb server via QIDO-RS count.
      *

backend/database/seeders/PacsConnectionSeeder.php

@@ -9,12 +9,19 @@ class PacsConnectionSeeder extends Seeder
 {
     public function run(): void
     {
+        $username = env('ORTHANC_USER', 'parthenon');
+        $password = env('ORTHANC_PASSWORD', '');
+
         PacsConnection::updateOrCreate(
             ['name' => 'Local Orthanc'],
             [
                 'type' => 'orthanc',
                 'base_url' => 'http://orthanc:8042/dicom-web',
-                'auth_type' => 'none',
+                'auth_type' => 'basic',
+                'credentials' => [
+                    'username' => $username,
+                    'password' => $password,
+                ],
                 'is_default' => true,
                 'is_active' => true,
             ],

backend/tests/Unit/Services/PacsConnectionServiceTest.php

@@ -0,0 +1,113 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Services;
+
+use App\Models\App\PacsConnection;
+use App\Services\Imaging\PacsConnectionService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\Request;
+use Illuminate\Support\Facades\Http;
+use Tests\TestCase;
+
+class PacsConnectionServiceTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function tearDown(): void
+    {
+        $this->unsetEnv('ORTHANC_USER');
+        $this->unsetEnv('ORTHANC_PASSWORD');
+
+        parent::tearDown();
+    }
+
+    public function test_orthanc_connection_test_uses_runtime_env_credentials(): void
+    {
+        $this->setEnv('ORTHANC_USER', 'env-user');
+        $this->setEnv('ORTHANC_PASSWORD', 'env-pass');
+
+        $connection = $this->createOrthancConnectionWithStaleCredentials();
+        $expectedAuth = 'Basic '.base64_encode('env-user:env-pass');
+
+        Http::fake(function (Request $request) use ($expectedAuth) {
+            $this->assertSame($expectedAuth, $request->header('Authorization')[0] ?? null);
+            $this->assertSame('http://orthanc:8042/dicom-web/studies?limit=1', $request->url());
+
+            return Http::response([], 200);
+        });
+
+        $result = app(PacsConnectionService::class)->testConnection($connection);
+
+        $this->assertTrue($result['success']);
+        $this->assertSame('ok', $connection->refresh()->last_health_status);
+    }
+
+    public function test_orthanc_stats_refresh_uses_runtime_env_credentials(): void
+    {
+        $this->setEnv('ORTHANC_USER', 'env-user');
+        $this->setEnv('ORTHANC_PASSWORD', 'env-pass');
+
+        $connection = $this->createOrthancConnectionWithStaleCredentials();
+        $expectedAuth = 'Basic '.base64_encode('env-user:env-pass');
+
+        Http::fake(function (Request $request) use ($expectedAuth) {
+            $this->assertSame($expectedAuth, $request->header('Authorization')[0] ?? null);
+
+            if (str_contains($request->url(), '/statistics')) {
+                return Http::response([
+                    'CountPatients' => 2,
+                    'CountStudies' => 3,
+                    'CountSeries' => 4,
+                    'CountInstances' => 5,
+                    'TotalDiskSizeMB' => 6,
+                ], 200);
+            }
+
+            if (str_contains($request->url(), '/series')) {
+                return Http::response([
+                    ['MainDicomTags' => ['Modality' => 'CT']],
+                    ['MainDicomTags' => ['Modality' => 'MR']],
+                ], 200);
+            }
+
+            return Http::response([], 404);
+        });
+
+        $result = app(PacsConnectionService::class)->refreshStats($connection);
+
+        $this->assertTrue($result['success']);
+        $this->assertSame(3, $connection->refresh()->metadata_cache['count_studies']);
+        $this->assertSame(['CT' => 1, 'MR' => 1], $connection->metadata_cache['modalities']);
+    }
+
+    private function createOrthancConnectionWithStaleCredentials(): PacsConnection
+    {
+        return PacsConnection::create([
+            'name' => 'Local Orthanc',
+            'type' => 'orthanc',
+            'base_url' => 'http://orthanc:8042/dicom-web',
+            'auth_type' => 'basic',
+            'credentials' => [
+                'username' => 'env-user',
+                'password' => 'stale-db-pass',
+            ],
+            'is_default' => true,
+            'is_active' => true,
+        ]);
+    }
+
+    private function setEnv(string $key, string $value): void
+    {
+        putenv("{$key}={$value}");
+        $_ENV[$key] = $value;
+        $_SERVER[$key] = $value;
+    }
+
+    private function unsetEnv(string $key): void
+    {
+        putenv($key);
+        unset($_ENV[$key], $_SERVER[$key]);
+    }
+}