[Imaging] Sites/Project/subproject filters and permission

[laemtl]

This PR:

1. modifies the way project/subproject/site filters are populated. Now those filters are displayed with values the current user has permission for.
2. fixed the MRI violations data table to remove entries for Projects and Sites the user does not have access to.
3. add some integration tests

Note:
The permission imaging_browser_qc was removed from imaging_qc.class.inc. This permission is not documented for this module and permission's description refers to the imaging_browser module. Can a senior developer confirm if documentation needs to be updated instead?

To test

• Visit all the modules and check that all data entries belong to sites and projects the user has access to.
• Visit all the modules and check that the site/project/subproject menu filters contain entries the user has access to.
• Modified modules:
  • imaging_browser
  • imaging_qc
  • mri_violations
  • imaging_uploader

Resolves #6691
Related to #6829
Replace #6729

[laemtl]

@nicolasbrossard Do you have time to review? This PR regroups the imaging modules from #6836 (and is therefore easier to test 😊).

[cmadjar]

@laemtl I did not test this yet as it needs to be rebased. I can test it once this is rebased. Just let me know when ready :).

I just looked at the code. See attached comment in my review.

[cmadjar]

Why is the array of getSiteOptions empty here? Or is it using access_all_profiles by default?

Is there no module permissions for imaging_qc? I don't know very well that module or what should be its behaviour in terms of permissions. @ridz1208, do you know?

[laemtl]

@cmadjar Rebased !

[laemtl]

And yes, getOptions have default values:

public function getSiteOptions(
        bool $numeric_keys = true,
        array $allsitesPermission = ['access_all_profiles'],
        bool $study_site = true
)

$allsitesPermission is empty here because there is no allsitesPermission for this module (see my comment in the description of the PR about permission imaging_browser_qc).

[cmadjar]

@laemtl Thank you for the rebase!

Tests done:

• imaging browser: all good 👍
• imaging uploader: on RB data, if my user belongs to project Rye and site Ottawa, I should not have any entries displayed in the table. If I click on the link that redirects to the imaging browser, it tells me (rightfully) that I do not have the permission to access this data so I should not be able to see entries in imaging upload for project Rye, site Ottawa.
• MRI violations: for the site, I see several options: All (including unknown), All (excluding unknown), Unknown and site belonging to user. Shouldn't it be the same for Project?
• imaging QC: in the data table, I can see entries that do not belong to my user's project. For example: my user belongs to site Ottawa and Project Rye but it can see in the data table entries for project Pumpernickel as well.

[cmadjar]

@laemtl I think the ball is in your court on this one. Let me know when ready for another review. Thanks!

[laemtl]

@cmadjar Your comments are addressed except this one:

MRI violations: for the site, I see several options: All (including unknown), All (excluding unknown), Unknown and site belonging to user. Shouldn't it be the same for Project?

Can you add a discussion point for next Loris meeting?