# OZI-RIS native DIMSE gateway

This isolated gateway exposes MWL C-FIND and MPPS N-CREATE/N-SET and forwards
the normalized events to OZI-RIS. Deploy it only on the protected modality
network; do not expose the administrator-configured DIMSE port or the Laravel
integration endpoints publicly.

## Setup

```powershell
python -m venv .venv
.\.venv\Scripts\pip install --require-hashes -r requirements.lock
$env:OZI_RIS_URL='https://ris.example.my'
$env:DICOM_GATEWAY_TOKEN='<same random secret as Laravel>'
.\.venv\Scripts\python gateway.py
```

On the Windows RIS host, `start-gateway.ps1` loads the shared gateway token
from the project `.env`, starts the checked-in virtual environment hidden, and
writes its launcher PID under `storage/app`:

```powershell
.\start-gateway.ps1
```

Before starting the process, add exactly one active **Gateway** node in
Administration > DICOM Integration. Its AE Title, host/bind address and port
are loaded from the database at startup. Workstation AE Titles, addresses and
ports are entered separately on the Worklist & MPPS page. No site-specific
DICOM endpoint value is supplied by the gateway process.

## MWL identity and requester mapping

- `PatientID (0010,0020)` receives the RIS Patient ID/MRN.
- `OtherPatientIDsSequence (0010,1002)` receives the Citizen/National ID when recorded.
- `RequestingPhysician (0032,1032)` receives the requesting doctor.
- `RequestingService (0032,1033)` receives the requesting ward or department.

Restart the gateway process after deploying mapping changes because the Python
service remains resident between C-FIND requests.

Generate `requirements.lock` in the controlled build environment after package
review. The checked-in `requirements.txt` pins versions but is not a substitute
for a hash-locked production dependency file.

Storage Commitment remains assigned to the PACS/Orthanc gateway and requires a
separate N-ACTION/N-EVENT-REPORT site validation. Never infer commitment merely
from successful C-STORE.
