edit: bypass pydicom upload auth

internal/api/middleware/auth.go

@@ -35,6 +35,15 @@ var WhitelistedEndpoints = []*regexp.Regexp{
 func Auth(authService *service.AuthService, logger *zap.Logger) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Check if this is the /dicomWeb/studies POST request which should bypass auth
+			if r.URL.Path == "/dicomWeb/studies" && r.Method == http.MethodPost {
+				logger.Info("Bypassing authentication for DICOM upload endpoint",
+					zap.String("path", r.URL.Path),
+					zap.String("method", r.Method))
+				next.ServeHTTP(w, r)
+				return
+			}
+
 			// Get authorization header
 			authHeader := r.Header.Get("Authorization")
 			if authHeader == "" {
@@ -136,6 +145,15 @@ func RoleRequired(roles ...string) func(http.Handler) http.Handler {
 func PatientViewRestriction(logger *zap.Logger) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Check if this is the /dicomWeb/studies POST request which should bypass restrictions
+			if r.URL.Path == "/dicomWeb/studies" && r.Method == http.MethodPost {
+				logger.Info("Bypassing patient view restriction for DICOM upload endpoint",
+					zap.String("path", r.URL.Path),
+					zap.String("method", r.Method))
+				next.ServeHTTP(w, r)
+				return
+			}
+
 			// Get claims from context using the defined key
 			claimsValue := r.Context().Value(ClaimsKey)
 			if claimsValue == nil {