NRL-2099 Show all new v2 perm types for a given app or organisation

anjalitrace2-nhs · anjalitrace2-nhs · commit 78b9c5b51850 · 2026-04-01T17:37:18.000+01:00
diff --git a/scripts/manage_permissions.py b/scripts/manage_permissions.py
@@ -2,6 +2,7 @@
 """
 Manage app ans organisation v2 permissions for NRLF apps in a given environment ENV
 """
+import json
 import os
 from enum import Enum
 
@@ -63,6 +64,22 @@ def _list_s3_keys(file_key_prefix: str) -> list[str]:
     return keys
 
 
+def _get_perms_from_s3(file_key: str) -> str | None:
+    s3 = _get_s3_client()
+
+    try:
+        item = s3.get_object(Bucket=nrl_auth_bucket_name, Key=file_key)
+    except s3.exceptions.NoSuchKey:
+        print(f"Permissions file {file_key} does not exist in the bucket.")
+        return None
+
+    if "Body" not in item:
+        print(f"No body found for permissions file {file_key}.")
+        return None
+
+    return item["Body"].read().decode("utf-8")
+
+
 def list_apps(supplier_type: SupplierType) -> None:
     """
     List all consumer or producer applications in the NRL environment.
@@ -103,7 +120,6 @@ def list_orgs(supplier_type: SupplierType, app_id: str) -> None:
     """
     List all organizations for a specific consumer or producer application.
     """
-
     if supplier_type.lower() not in SupplierType.list():
         print("Usage: list organisations for a given app and supplier type")
         print("  list_orgs consumer <app_id>")
@@ -150,14 +166,85 @@ def list_available_access_controls() -> None:
         print(f"- {control}")
 
 
+def _print_perm(
+    perms_pretty: dict, lookup_path: str, perm_pretty_name: str, perm_key: str
+):
+    print()
+    access_controls = perms_pretty.get(perm_key, [])
+    if access_controls:
+        print(f"{lookup_path} has these {perm_pretty_name}s:")
+        for control in access_controls:
+            print(f"- {control}")
+    else:
+        print(f"{lookup_path} has no {perm_pretty_name}s")
+
+
+def show_perms(supplier_type: SupplierType, app_id: str, org_ods=None) -> None:
+    """
+    Show the permissions for a given application or organization.
+    """
+    if supplier_type.lower() not in SupplierType.list() or not app_id:
+        print("Usage: show permissions for a given organisation or app")
+        print("  show_perms consumer <app_id> <org_ods>")
+        print("  show_perms producer <app_id> <org_ods>")
+        print("  show_perms consumer <app_id>")
+        print("  show_perms producer <app_id>")
+        return
+
+    if org_ods:
+        lookup_path = f"{supplier_type}/{app_id}/{org_ods}.json"
+    else:
+        lookup_path = f"{supplier_type}/{app_id}.json"
+
+    perms_ugly = _get_perms_from_s3(lookup_path)
+
+    if not perms_ugly:
+        print(f"No permissions file found for {lookup_path}.")
+        return
+
+    perms_pretty = json.loads(perms_ugly)
+    if not perms_pretty:
+        print(f"No pointer-types found in permission file for {lookup_path}.")
+        return
+
+    pretty_type_data = {
+        pointertype_perm: TYPE_ATTRIBUTES.get(
+            pointertype_perm, {"display": "Unknown type"}
+        )
+        for pointertype_perm in perms_pretty.get("types")
+    }
+    types = [
+        "%-45s (%s)"
+        % (pretty_type_data[pointertype_perm]["display"][:44], pointertype_perm)
+        for pointertype_perm in perms_pretty.get("types")
+    ]
+    print(f"{lookup_path} is allowed to access these pointer-types:")
+    for type_display in types:
+        print(f"- {type_display}")
+
+    _print_perm(
+        perms_pretty,
+        lookup_path,
+        perm_pretty_name="access control",
+        perm_key="access_controls",
+    )
+
+    # _print_perm(
+    #     perms_pretty,
+    #     lookup_path,
+    #     perm_pretty_name="API interaction",
+    #     perm_key="interaction",
+    # )
+
+
 if __name__ == "__main__":
     fire.Fire(
         {
             "list_apps": list_apps,
             "list_orgs": list_orgs,
             "list_available_pointer_types": list_available_pointer_types,
             "list_available_access_controls": list_available_access_controls,
-            # "show_perms": show_perms,
+            "show_perms": show_perms,
             # "set_perms": set_perms,
             # "clear_perms": clear_perms,
         }
