[Imaging and Brain Browser] - All sites permission not working

[charliehenrib]

Describe the bug
A clear and concise description of what the bug is
If you have the permission "Imaging Browser: View Imaging Scans - All Sites" you can access the imaging browser for other site, but you cannot see the image and you get the error below (screenshot) when using brainbrowser. This error disappear if you are granted permission to the site using the site multi select.

To Reproduce
Steps to reproduce the behavior (attach screenshots if applicable):

1. Go to user account and make sure you only have access to one site and have the all sites imaging browser permission
2. Click on imaging browser and access a candidate that you don't have the site permission for
3. Scroll down to all type of images and see error # 1, the image does not load.
4. See error # 2 when clicking on the missing image and going to brainbrowser.

What did you expect to happen?
A clear and concise description of what you expected to happen.
you should be able to access the images from both imaging browser and brainbrowser.

Additional context
Add any other context about the problem here.

[maximemulder]

Ahok, thanks for finding that. I briefly had this issue during my testing but it disappeared and I did not manage to find back the reproduction conditions so I kind of forgot it (which I probably shouldn't have). I can look into it if needed.

[driusan]

the problem is already on the agenda for the next imaging meeting, it's because BrainBrowser uses the API (which requires access to the candidate) while the imaging_browser has its own maze of permissions.

[cmadjar]

@charliehenrib can you download the files using the download buttons when this issue happen in BB? Can you also see the picture/screenshot displayed in the view Session page?

[charliehenrib]

@cmadjar This is what I get when I try to download the file

I cannot see the image on the imaging browser or the brainbrowser.

[driusan]

The workaround (for now) is to give the user access to the sites, instead of the all_sites permission.