PT-079: XNAT set-password invite link (no emailed password) + enclave branding

[atriaybagur]

Summary

Addresses FLIP-PT-079 (High — plaintext XNAT passwords emailed via SES) and, alongside it, brands the mocked enclave XNAT so users can tell which trust they are on.

Two logical commits:

1. security(pt-079) — email a set-password invite link instead of a password.
2. feat(xnat) — trust-named site description + FLIP logo on the XNAT login page.

PT-079 — invite link, never a password

Previously the hub decrypted the generated XNAT account password and emailed it in cleartext via SES, so anyone able to read the mailbox held standing PACS access to a trust's imaging archive.

Now:

• imaging-api creates the XNAT user with a throwaway random password that is never disclosed, mints a single-use XNAT alias token on the user's behalf (the flipServiceAccount already holds the Administrator role this needs), and returns a host-less …/XDATScreen_UpdateUser.vm?a=…&s=… path.
• the hub emails that path via the new flip-xnat-invite SES template (renamed from flip-xnat-credentials), with a note that the link only works from inside the trust's XNAT network — XNAT is not reachable over the public internet. No standing credential is ever transmitted.
• Retest passes: git grep "password=decrypted" -- 'flip-api/**/*.py' → 0 hits.

The account is created with a password (not passwordless) on purpose: XNAT's password-change path raises on a user that has no existing password. Existing users added to a further project still receive the existing added-to-project notification.

XNAT enclave branding

configure-xnat.sh now sets the login-page site description to "Welcome to FLIP's XNAT at <trust>" (from TRUST_NAME, passed through to the xnat-web container; XNAT_SITE_DESCRIPTION overrides) and points siteLogoPath at a FLIP logo baked into the XNAT webapp image.

Testing

• imaging-api: 276 passed · flip-api unit: 1484 passed · SES template validator: 5/5
• ruff + mypy clean on changed files; terraform fmt clean
• Verified live on the dev GSTT XNAT: invite token authenticates the new user and shows a set-password form; branded login page renders the FLIP logo + welcome line.

Deploy notes

• Ordering: terraform apply the SES module so the flip-xnat-invite template exists before the hub is redeployed, otherwise send_email fails on a missing template.
• Site description + logo land on the next XNAT image rebuild + stack redeploy (they are applied by configure-xnat.sh on fresh bring-up).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!