Users can't create ROI Collections on shared data

[Charlie Moore]

https://groups.google.com/g/xnat_discussion/c/5Zfw81cKBNU - This issue seems to be what’s going wrong on this post.

To recreate this issue, you can:

1. Create 2 projects, a source and a destination.
2. Upload an MR session to the source project.
3. Share the session into the destination project.
4. Add a user with standard permissions to the destination project as an owner.
5. Login as the user in the previous step.
6. Attempt to create and export a contour on the shared session. It fails, with the cause being a 403 to the API - PUT /xapi/roi/projects/$PROJECT/sessions/$SESSION/collections/$COLLECTION_ID

Seeing as the user has create/edit permissions on ROI Collections in the destination project, I can’t think of why they shouldn’t be allowed to export an ROI Collection like this. XNAT’s standard APIs would allow them to do so.

[amir]

Thanks Charlie for creating this issue. I wanted to follow up on this issue and see if we can add anything to fix it.

[Mo Alsad]

Issue has been fixed and will be included in XNAT OHIF Viewer v3.5.0 - estimated release date: end of January 2023.

The viewer previously presumed that the user has write access to the parent project where the new ROICollections are pushed back there rather than storing them inside the target project. We understand that this behaviour does not conform with the context of XNAT data sharing and it has now been rectified.