V1/features/entitlements/Access Metadata entitlements.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "56932f2c",
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "from lusidtools.jupyter_tools import toggle_code\n",
    "\n",
    "\"\"\"Portfolio look-through in LUSID\n",
    "\n",
    "Demonstrates the use of policies to grant access to portfolios based on their Access Metadata (AMD) in LUSID.\n",
    "\n",
    "Attributes\n",
    "----------\n",
    "entitlements\n",
    "access metadata\n",
    "amd\n",
    "\"\"\"\n",
    "\n",
    "toggle_code(\"Toggle Docstring\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c2c1325d",
   "metadata": {},
   "source": [
    "# Access Metadata entitlements\n",
    "\n",
    "This notebook demonstrates the use of policies to grant access to portfolios based on their Access Metadata in LUSID. There is an associated Knowledge Base article [here](https://support.lusid.com/knowledgebase/article/KA-01940/en-us).\n",
    "\n",
    "This notebook will rely on the following example. A system might have portfolios that are externally and internally managed. Only some portfolio managers are able to see both externally and internally managed portfolios, while the remaining portfolio managers can only see internally managed portfolios. To model this scenario we will do the following:\n",
    "- **User A**: a portfolio manager that can see both externally and internally managed portfolios.\n",
    "- **User B**: a portfolio manager that can only see internally managed portfolios.\n",
    "- **Portfolio A**: an externally managed portfolio.\n",
    "- **Portfolio B**: an internally managed portfolio.\n",
    "\n",
    "Table of contents:\n",
    "1. [Setup](#1.-Setup)\n",
    "2. [Prepare data](#2.-Prepare-data)    \n",
    "    2.1 [Create portfolios](#2.1-Create-portfolios)\n",
    "    2.2 [Create instruments](#2.2-Create-instruments)   \n",
    "    2.3 [Add transactions to the portfolios](#2.3-Add-transactions-to-the-portfolios)\n",
    "    2.4 [Add Access Metadata to the portfolios](#2.4-Add-Acces-Metadata-to-the-portfolios)\n",
    "3. [Demonstrate entitlements](#3.-Demonstrate-entitlements)    \n",
    "    3.1 [Create a role](#3.1-Create-a-role)\n",
    "    3.2 [Assigning the role to User B](#3.2-Assigning-the-role-to-User-B)\n",
    "    3.3 [Create a policy to deny access to externally managed portfolios](#3.3-Create-a-policy-to-deny-access-to-externally-managed-portfolios)\n",
    "    3.4 [Retrieve portfolios](#3.4-Retrieve-portfolios)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c1ab0605",
   "metadata": {},
   "source": [
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8de300ad",
   "metadata": {},
   "source": [
    "## 1. Setup\n",
    "\n",
    "To start, let's import the libraries and initialise the APIs we'll use in the notebook."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9596362c",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Import Libraries\n",
    "import os\n",
    "import random\n",
    "import math\n",
    "import json\n",
    "import pytz\n",
    "\n",
    "from datetime import datetime, timedelta\n",
    "from collections import namedtuple\n",
    "\n",
    "import finbourne_access\n",
    "import finbourne_identity\n",
    "import lusid\n",
    "import pandas as pd\n",
    "\n",
    "from finbourne_access.utilities import ApiClientFactory as AccessApiClientFactory\n",
    "from finbourne_access import models as access_models\n",
    "from finbourne_identity import models as identity_models\n",
    "from lusid import models as models\n",
    "from lusidjam import RefreshingToken\n",
    "from lusidtools.pandas_utils.lusid_pandas import lusid_response_to_data_frame\n",
    "from IPython.core.display import HTML\n",
    "\n",
    "# Set DataFrame display formats\n",
    "pd.set_option(\"display.max_columns\", None)\n",
    "pd.set_option(\"display.max_rows\", None)\n",
    "pd.options.display.float_format = \"{:,.2f}\".format\n",
    "display(HTML(\"<style>.container { width:90% !important; }</style>\"))\n",
    "\n",
    "# Authenticate our user and create our API client\n",
    "secrets_path = os.getenv(\"FBN_SECRETS_PATH\")\n",
    "\n",
    "lusid_api_factory = lusid.utilities.ApiClientFactory(\n",
    "    token=RefreshingToken(),\n",
    "    api_secrets_filename=secrets_path,\n",
    "    app_name=\"LusidJupyterNotebook\",\n",
    ")\n",
    "\n",
    "api_client = lusid_api_factory.api_client\n",
    "\n",
    "lusid_api_url = api_client.configuration.host\n",
    "access_api_url = lusid_api_url[: lusid_api_url.rfind(\"/\") + 1] + \"access\"\n",
    "identity_api_url = lusid_api_url[: lusid_api_url.rfind(\"/\") + 1] + \"identity\"\n",
    "\n",
    "access_api_factory = finbourne_access.utilities.ApiClientFactory(\n",
    "    token=api_client.configuration.access_token,\n",
    "    access_url=access_api_url,\n",
    "    app_name=\"LusidJupyterNotebook\",\n",
    ")\n",
    "\n",
    "identity_api_factory = finbourne_identity.utilities.ApiClientFactory(\n",
    "    token=api_client.configuration.access_token,\n",
    "    api_url=identity_api_url,\n",
    "    app_name=\"LusidJupyterNotebook\",\n",
    ")\n",
    "\n",
    "lusid_api_status = pd.DataFrame(\n",
    "    lusid_api_factory.build(lusid.api.ApplicationMetadataApi)\n",
    "    .get_lusid_versions()\n",
    "    .to_dict()\n",
    ")\n",
    "\n",
    "display(lusid_api_status)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "8a962bae",
   "metadata": {},
   "outputs": [],
   "source": [
    "scope = \"AccessMetadataEntitlementsNotebook\"\n",
    "portfolio_A_code = \"AccessMetadataEntitlementsPortfolioCodeA\"\n",
    "portfolio_B_code = \"AccessMetadataEntitlementsPortfolioCodeB\"\n",
    "portfolio_A_name = \"Access metadata entitlements portfolio A\"\n",
    "portfolio_B_name = \"Access metadata entitlements portfolio B\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "37c736ec",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Initialise all APIs used in the notebook\n",
    "transaction_portfolios_api = lusid_api_factory.build(lusid.TransactionPortfoliosApi)\n",
    "portfolios_api = lusid_api_factory.build(lusid.PortfoliosApi)\n",
    "instruments_api = lusid_api_factory.build(lusid.InstrumentsApi)\n",
    "properties_api = lusid_api_factory.build(lusid.PropertyDefinitionsApi)\n",
    "\n",
    "policies_api = access_api_factory.build(finbourne_access.PoliciesApi)\n",
    "access_roles_api = access_api_factory.build(finbourne_access.RolesApi)\n",
    "\n",
    "identity_roles_api = identity_api_factory.build(finbourne_identity.RolesApi)\n",
    "users_api = identity_api_factory.build(finbourne_identity.UsersApi)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7d142141",
   "metadata": {},
   "source": [
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5fc104b4",
   "metadata": {},
   "source": [
    "## 2. Prepare data\n",
    "\n",
    "To demonstrate the entitlements, let's first prepare the data. \n",
    "\n",
    "Below, we create two new TransactionPortfolio's denominated in GBP, as well as a set of five instruments identified by their FIGIs."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "fb89bdad",
   "metadata": {},
   "source": [
    "### 2.1 Create portfolios"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b2f47449",
   "metadata": {},
   "outputs": [],
   "source": [
    "def create_portfolio(portfolio_name, portfolio_code):\n",
    "    # Create the portfolio request.\n",
    "    create_portfolio_request = models.CreateTransactionPortfolioRequest(\n",
    "        display_name=portfolio_name,\n",
    "        code=portfolio_code,\n",
    "        base_currency=\"GBP\"\n",
    "    )\n",
    "\n",
    "    try:\n",
    "        # Make the call to the API.\n",
    "        transaction_portfolios_api.create_portfolio(scope, create_portfolio_request)\n",
    "    except lusid.ApiException as e:\n",
    "        detail = json.loads(e.body)\n",
    "        if detail[\"code\"] != 112:  # PortfolioWithIdAlreadyExists\n",
    "            raise e\n",
    "\n",
    "create_portfolio(portfolio_A_name, portfolio_A_code)\n",
    "create_portfolio(portfolio_B_name, portfolio_B_code)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0c6616e3",
   "metadata": {},
   "source": [
    "### 2.2 Create instruments"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "772f7245",
   "metadata": {},
   "outputs": [],
   "source": [
    "InstrumentSpec = namedtuple(\"InstrumentSpec\", [\"Figi\", \"Name\"])\n",
    "\n",
    "instruments = [\n",
    "    InstrumentSpec(\"BBG000FD8G46\", \"HISCOX LTD\"),\n",
    "    InstrumentSpec(\"BBG000DW76R4\", \"ITV PLC\"),\n",
    "    InstrumentSpec(\"BBG000PQKVN8\", \"MONDI PLC\"),\n",
    "    InstrumentSpec(\"BBG000BDWPY0\", \"NEXT PLC\"),\n",
    "    InstrumentSpec(\"BBG000BF46Y8\", \"TESCO PLC\"),\n",
    "]\n",
    "\n",
    "instruments_to_create = {\n",
    "    i.Figi: models.InstrumentDefinition(\n",
    "        name=i.Name, identifiers={\"Figi\": models.InstrumentIdValue(value=i.Figi)}\n",
    "    )\n",
    "    for i in instruments\n",
    "}\n",
    "\n",
    "response = instruments_api.upsert_instruments(request_body=instruments_to_create)\n",
    "\n",
    "instrument_ids = sorted([i.lusid_instrument_id for i in response.values.values()])"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4608cade",
   "metadata": {},
   "source": [
    "### 2.3 Add transactions to the portfolios\n",
    "\n",
    "The amounts and considerations for the generated transactions are randomised but typically transactions can come from a number of sources if not generated within LUSID, for example from a .csv file or a 3rd party system."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a9c21bfa",
   "metadata": {},
   "outputs": [],
   "source": [
    "def load_transactions(portfolio_code):\n",
    "    # Prepare transaction requests\n",
    "    transactions = [\n",
    "        models.TransactionRequest(\n",
    "            transaction_id=f\"TransactionId_{_id}\",\n",
    "            type=\"Buy\",\n",
    "            instrument_identifiers={\"Instrument/default/LusidInstrumentId\": _id},\n",
    "            transaction_date=datetime.now(pytz.UTC).isoformat(),\n",
    "            settlement_date=(datetime.now(pytz.UTC) + timedelta(days=2)).isoformat(),\n",
    "            units=math.floor(random.random() * 100),\n",
    "            total_consideration=lusid.CurrencyAndAmount(\n",
    "                math.floor(random.random() * 1000), \"GBP\"\n",
    "            ),\n",
    "        )\n",
    "        for _id in instrument_ids\n",
    "    ]\n",
    "\n",
    "    transaction_portfolios_api.upsert_transactions(\n",
    "        scope, portfolio_code, transactions\n",
    "    )\n",
    "\n",
    "load_transactions(portfolio_A_code)\n",
    "load_transactions(portfolio_B_code)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d93845c8",
   "metadata": {},
   "source": [
    "### 2.4 Add Access Metadata to the portfolios\n",
    "\n",
    "The way to entitle entities based on their fields is to attach Access Metadata (AMD) to an entity and then entitle against that AMD. We want to add AMD to the portfolios and on top of this we want to add properties, mirroring the AMD, as properties are visible in the UI while AMD is not."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6fe7c479",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Add access metadata to the portfolios for key IsExternallyManaged\n",
    "metadata_key = \"IsExternallyManaged\"\n",
    "\n",
    "def add_access_metadata(value, portfolio_code):\n",
    "    upsert_portfolio_access_metadata_request = models.UpsertPortfolioAccessMetadataRequest(\n",
    "        metadata=[\n",
    "            models.AccessMetadataValue(\n",
    "                value=value,\n",
    "                provider=\"SampleNotebook\")\n",
    "        ])\n",
    "\n",
    "    portfolios_api.upsert_portfolio_access_metadata(\n",
    "        scope,\n",
    "        portfolio_code,\n",
    "        metadata_key,\n",
    "        upsert_portfolio_access_metadata_request)\n",
    "\n",
    "add_access_metadata(\"true\", portfolio_A_code)\n",
    "add_access_metadata(\"false\", portfolio_B_code)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4bc03ee7",
   "metadata": {},
   "source": [
    "To add a property, we first create a property definition (the `PropertyDefinition` schema in the [API](https://www.lusid.com/api/swagger/index.html)). This gives LUSID information about the property type.\n",
    "\n",
    "We then add a value to this new property for the portfolios."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "78b5ced3",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Create a property definition for key Portfolio/AccessMetadataEntitlements/IsExternallyManaged\n",
    "property_domain = \"Portfolio\"\n",
    "property_code = \"IsExternallyManaged\"\n",
    "\n",
    "try:\n",
    "    properties_api.create_property_definition(\n",
    "        create_property_definition_request=models.CreatePropertyDefinitionRequest(\n",
    "            domain=property_domain,\n",
    "            scope=scope,\n",
    "            code=property_code,\n",
    "            display_name=property_code,\n",
    "            life_time=\"Perpetual\",\n",
    "            value_required=False,\n",
    "            data_type_id=models.resource_id.ResourceId(\n",
    "                scope=\"system\",\n",
    "                code=\"string\",\n",
    "            )\n",
    "        )\n",
    "    )\n",
    "except lusid.ApiException as e:\n",
    "    detail = json.loads(e.body)\n",
    "    if detail[\"code\"] != 124:  # \"PropertyAlreadyExists\"\n",
    "        raise e\n",
    "\n",
    "def add_property_value(value, portfolio_code):\n",
    "    perpetual_property = models.PerpetualProperty(\n",
    "        f\"{property_domain}/{scope}/{property_code}\",\n",
    "        models.PropertyValue(label_value=value)\n",
    "    )\n",
    "\n",
    "    # Add the property to the portfolios.\n",
    "    portfolios_api.upsert_portfolio_properties(\n",
    "            scope=scope,\n",
    "            code=portfolio_code,\n",
    "            request_body={f\"{property_domain}/{scope}/{property_code}\": perpetual_property},\n",
    "        )\n",
    "\n",
    "# Add the property to the portfolios.\n",
    "add_property_value(\"true\", portfolio_A_code)\n",
    "add_property_value(\"false\", portfolio_B_code)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d5baf4aa",
   "metadata": {},
   "source": [
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4b0775a7",
   "metadata": {},
   "source": [
    "## 3. Demonstrate entitlements\n",
    "\n",
    "To demonstrate entitlements, we'll need to have access to two users as described in the introduction:\n",
    "- User A has admin rights and can see both portfolios regardless of whether they are externally managed. We will need this user to grant policies.\n",
    "- User B has the minimum required rights to see portfolios. Originally user B can see both portfolio A and B.\n",
    "\n",
    "The process is as follows:\n",
    "- as User B, try to retrieve the portfolios in the `AccessMetadaEntitlements` scope. This should return two portfolios, `AccessMetadataEntitlementsPortfolioCodeA` and `AccessMetadataEntitlementsPortfolioCodeB`.\n",
    "- as User A, deny User B access to externally managed portfolios by applying a policy to their role.\n",
    "- as User B, try retrieving the portfolios in the `AccessMetadaEntitlements` scope again. This should return only the non externally managed portfolios, `AccessMetadataEntitlementsPortfolioCodeB` in this case."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "372f4a31",
   "metadata": {},
   "source": [
    "### 3.1 Create a role\n",
    "\n",
    "Here we create a role that we will assign to User B. The role will contain two policies:\n",
    "- `allow-standard-lusid-features-access`, which gives a user access to standard LUSID features. This policy ships with LUSID out of the box.\n",
    "- `allow-scope-access-AccessMetadaEntitlements`, which gives a user access to the scope in which our portfolios sit. Without this, the user would not be able to see anything in the `AccessMetadaEntitlements` scope. We'll have to create this using the API.\n",
    "Note that the role does not contain a policy that acts on AMD of portfolios, this will be added later on."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b0019d3f",
   "metadata": {},
   "source": [
    "When creating new policies via the API a `WhenSpec` needs to be provided which specifies the period over which the policy should act. For the purpose of this notebook we want our policies to act straight away till the end of time. To ensure that policies act straight away we give them an activation of two days ago."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a99f839b",
   "metadata": {},
   "outputs": [],
   "source": [
    "activation_date = datetime.now(tz=pytz.utc) - timedelta(days=2)\n",
    "deactivation_date = datetime(9999, 12, 31, tzinfo=pytz.utc)\n",
    "when_spec = access_models.WhenSpec(\n",
    "    activate=activation_date,\n",
    "    deactivate=deactivation_date\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4fc81965",
   "metadata": {},
   "source": [
    "Here we create a policy to grant access to the scope containing the TransactionPortfolio's, this will give User B the ability to see all portfolios in the `AccessMetadataEntitlements` scope."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a42bce63",
   "metadata": {},
   "outputs": [],
   "source": [
    "allow_scope_policy_code = f\"allow-scope-access-{scope}\"\n",
    "\n",
    "# Get access path where to apply the policy.\n",
    "portfolio_selector_definition = access_models.IdSelectorDefinition(\n",
    "    identifier={\"scope\": scope, \"code\": \"*\"},\n",
    "    actions=[\n",
    "        access_models.ActionId(scope=\"default\", activity=\"Any\", entity=\"Portfolio\")\n",
    "    ],\n",
    ")\n",
    "\n",
    "allow_portfolio_path = access_models.SelectorDefinition(\n",
    "    id_selector_definition=portfolio_selector_definition\n",
    ")\n",
    "allow_portfolio_policy_request = access_models.PolicyCreationRequest(\n",
    "    code=allow_scope_policy_code,\n",
    "    applications=[\"LUSID\"],\n",
    "    grant=access_models.Grant.ALLOW,\n",
    "    selectors=[allow_portfolio_path],\n",
    "    when=when_spec,\n",
    ")\n",
    "\n",
    "try:\n",
    "    # Create the policy.\n",
    "    policies_api.create_policy(allow_portfolio_policy_request)\n",
    "except finbourne_access.ApiException as e:\n",
    "    detail = json.loads(e.body)\n",
    "    if detail[\"code\"] not in [612,613,615]:  # PolicyWithCodeAlreadyExists\n",
    "        raise e"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "373c6d90",
   "metadata": {},
   "source": [
    "One implementation detail for LUSID roles is that we'll have to create the same role twice: once using the identity API and once using the access API. This is such that the access module, which handles applying policies to a role, can communicate with the identity module, which handles applying roles to users."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d7147559",
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "role_code = \"AccessMetadataEntitlementsRole\"\n",
    "allow_features_policy_code = \"allow-standard-lusid-features-access\"\n",
    "\n",
    "# Create the role using the access API.\n",
    "role_creation_request = access_models.RoleCreationRequest(\n",
    "    code=role_code,\n",
    "    description=role_code,\n",
    "    resource=access_models.RoleResourceRequest(\n",
    "        policy_id_role_resource=access_models.PolicyIdRoleResource(\n",
    "            # Here, we apply the two default policies when creating the role.\n",
    "            policies=[\n",
    "                access_models.PolicyId(scope=\"default\", code=allow_features_policy_code),\n",
    "                access_models.PolicyId(\n",
    "                    scope=\"default\",\n",
    "                    code=allow_scope_policy_code,\n",
    "                ),\n",
    "            ]\n",
    "        )\n",
    "    ),\n",
    "    when=when_spec,\n",
    ")\n",
    "\n",
    "\n",
    "try:\n",
    "    response = access_roles_api.create_role(role_creation_request)\n",
    "except finbourne_access.ApiException as e:\n",
    "    detail = json.loads(e.body)\n",
    "    if detail['code'] not in [612,613,615]:  # RoleWithCodeAlreadyExists\n",
    "        raise e"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "80b4023a",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Create the same role using the identity API.\n",
    "try:\n",
    "    response = identity_roles_api.create_role(\n",
    "        create_role_request=identity_models.CreateRoleRequest(role_code)\n",
    "    )\n",
    "except finbourne_identity.ApiException as e:\n",
    "    detail = json.loads(e.body)\n",
    "    if detail[\"code\"] != 157:  # RoleWithCodeAlreadyExists\n",
    "        raise e"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "eb116731",
   "metadata": {},
   "source": [
    "### 3.2 Assigning the role to User B"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "id": "78946c1e",
   "metadata": {},
   "source": [
    "NB: The following cells will create a user in your environment. If the cell is run to create a user, the user will need to be activated by following the instructions sent via email to the `email_address` email address."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c51c1546",
   "metadata": {},
   "outputs": [],
   "source": [
    "first_name = \"John\"\n",
    "last_name = \"Doe\"\n",
    "email_address = \"John.Doe@example.com\"\n",
    "login = \"AccessMetadataEntitlements@example.com\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5933aac8",
   "metadata": {},
   "outputs": [],
   "source": [
    "create_user_request = identity_models.CreateUserRequest(\n",
    "    first_name=first_name,\n",
    "    last_name=last_name,\n",
    "    email_address=email_address,\n",
    "    login=login,\n",
    "    type=\"Personal\"\n",
    ")\n",
    "\n",
    "try:\n",
    "    # Here we create the user\n",
    "    users_api.create_user(create_user_request)\n",
    "except Exception as err:\n",
    "    if json.loads(err.body)[\"name\"] == \"UserAlreadyExists\":\n",
    "        print(\"A user with these credentials already exists, please try again with different details.\")\n",
    "    else:\n",
    "        raise err"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "bd882619",
   "metadata": {},
   "source": [
    "To assign the role to the user, we need to call two endpoints of the identity API:\n",
    "- `UpdateUsers` in the Users API\n",
    "- `AddUserToRole` in the Roles API"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "90a28c14",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Find the user id for this user.\n",
    "user_id = [user.id for user in users_api.list_users() if user.login == login][0]\n",
    "\n",
    "# Find the role id for this role.\n",
    "role_id = [role.id for role in identity_roles_api.list_roles() if role.role_id.code == role_code][0]\n",
    "\n",
    "response = users_api.update_user(\n",
    "    id=user_id,\n",
    "    update_user_request=identity_models.UpdateUserRequest(\n",
    "        first_name=first_name,\n",
    "        last_name=last_name,\n",
    "        email_address=email_address,\n",
    "        login=login,\n",
    "        roles=[\n",
    "            identity_models.RoleId(scope=\"default\", code=role_code),\n",
    "        ]\n",
    "    ),\n",
    ")\n",
    "\n",
    "identity_roles_api.add_user_to_role(role_id, user_id)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "668a896a",
   "metadata": {},
   "source": [
    "### 3.3 Create a policy to deny access to externally managed portfolios\n",
    "\n",
    "Here we create a policy that when assigned to a user, will deny access to portfolios if they have Access Metadata with a key of `IsExternallyManaged` and a value of `\"true\"`. This policy will be assigned to User B and will deny access to externally managed portfolios."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d0cfd5cd",
   "metadata": {},
   "outputs": [],
   "source": [
    "access_metadata_policy_code = f\"deny-externally-managed-portfolios-access-in-{scope}\"\n",
    "\n",
    "metadata_selector_definition = access_models.MetadataSelectorDefinition(\n",
    "    expressions=[\n",
    "        access_models.MetadataExpression(\n",
    "            metadata_key=metadata_key,\n",
    "            operator=access_models.Operator.EQUALS,\n",
    "            text_value=\"true\")\n",
    "    ],\n",
    "    actions=[\n",
    "        access_models.ActionId(scope=\"default\", activity=\"Any\", entity=\"Portfolio\")\n",
    "    ],\n",
    "    name=\"Access Metadata selector\",\n",
    "    description=\"Access Metadata selector\"\n",
    ")\n",
    "\n",
    "allow_property_path = access_models.SelectorDefinition(\n",
    "    metadata_selector_definition=metadata_selector_definition\n",
    ")\n",
    "\n",
    "allow_property_policy_request = access_models.PolicyCreationRequest(\n",
    "    code=access_metadata_policy_code,\n",
    "    description=f\"Denies access to externally managed portfolios in {scope} scope\",\n",
    "    applications=[\"LUSID\"],\n",
    "    grant=access_models.Grant.DENY,\n",
    "    selectors=[allow_property_path],\n",
    "    when=when_spec\n",
    ")\n",
    "\n",
    "try:\n",
    "    # Create the policy.\n",
    "    policies_api.create_policy(allow_property_policy_request)\n",
    "except finbourne_access.ApiException as e:\n",
    "    detail = json.loads(e.body)\n",
    "    if detail['code'] not in [612,613,615]:  # PolicyWithCodeAlreadyExists\n",
    "        raise e"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3178d46d",
   "metadata": {},
   "source": [
    "### 3.4 Retrieve portfolios\n",
    "\n",
    "First, let's try to retrieve the portfolios with User B's current entitlements. To do so, run the following statement as User B."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "dfee07a7",
   "metadata": {},
   "outputs": [],
   "source": [
    "def fetch_portfolios():\n",
    "    df = lusid_response_to_data_frame(portfolios_api.list_portfolios_for_scope(scope))\n",
    "    df_renamed = df.rename({\"id.code\": \"Code\", \"display_name\": \"Name\"}, axis=1)\n",
    "    display(df_renamed[[\"Code\", \"Name\"]])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d7652911",
   "metadata": {},
   "outputs": [],
   "source": [
    "fetch_portfolios()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b0ea6090",
   "metadata": {},
   "source": [
    "To apply the desired restrictions to User B, apply the Access Metadata policy we created above to their role by running the below statement as User A."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0609c1c7",
   "metadata": {},
   "outputs": [],
   "source": [
    "role_update_request = access_models.RoleUpdateRequest(\n",
    "    description=\"Add new Access Metadata policy\",\n",
    "    resource=access_models.RoleResourceRequest(\n",
    "        policy_id_role_resource=access_models.PolicyIdRoleResource(\n",
    "            policies=[\n",
    "                access_models.PolicyId(scope=\"default\", code=allow_features_policy_code),\n",
    "                access_models.PolicyId(scope=\"default\", code=allow_scope_policy_code),\n",
    "                access_models.PolicyId(scope=\"default\", code=access_metadata_policy_code),\n",
    "            ]\n",
    "        )\n",
    "    ),\n",
    "    when=when_spec,\n",
    ")\n",
    "\n",
    "response = access_roles_api.update_role(\n",
    "    code=role_code, scope=\"default\", role_update_request=role_update_request\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d542e172",
   "metadata": {},
   "source": [
    "Finally, let's try retrieving the portfolios as User B. The results now only contain portfolio B."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0c8f6828",
   "metadata": {},
   "outputs": [],
   "source": [
    "fetch_portfolios()"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.8"
  },
  "vscode": {
   "interpreter": {
    "hash": "b0fa6594d8f4cbf19f97940f81e996739fb7646882a419484c72d19e05852a7e"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}