feat: vaults, scopes and files show their details: a vault's settings, who has a scope, a file's keys and git status

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/databricks/databricks_test.go

@@ -140,6 +140,13 @@ func workspaceAPI(t *testing.T, status int) *httptest.Server {
 				map[string]any{"key": "storage-key", "last_updated_timestamp": 1767225600000},
 				map[string]any{"key": "client-secret"},
 			}})
+		case r.URL.Path == "/api/2.0/secrets/acls/list" && q.Get("scope") == "app":
+			write(w, 200, map[string]any{"items": []any{
+				map[string]any{"principal": "users", "permission": "READ"},
+				map[string]any{"principal": "admins", "permission": "MANAGE"},
+			}})
+		case r.URL.Path == "/api/2.0/secrets/acls/list" && q.Get("scope") == "locked":
+			write(w, 403, map[string]any{"error_code": "PERMISSION_DENIED", "message": "User does not have MANAGE permission"})
 		case r.URL.Path == "/api/2.0/secrets/get" && q.Get("scope") == "app":
 			write(w, 200, map[string]any{"key": q.Get("key"),
 				"value": base64.StdEncoding.EncodeToString([]byte("value-of-" + q.Get("key")))})
@@ -291,3 +298,20 @@ func TestClassify(t *testing.T) {
 		t.Error("cancellation classified as auth")
 	}
 }
+
+func TestScopeDetails(t *testing.T) {
+	p := newTestProvider(t, workspaceAPI(t, 0), nil)
+	src := provider.Source{ID: "prod"}
+	attrs, err := p.Details(context.Background(), provider.Container{Source: src, Name: "app"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []provider.Attr{{Label: "access", Value: "admins · manage"}, {Value: "users · read"}}
+	if !reflect.DeepEqual(attrs, want) {
+		t.Errorf("app: %+v", attrs)
+	}
+	attrs, err = p.Details(context.Background(), provider.Container{Source: src, Name: "locked"})
+	if err != nil || len(attrs) != 1 || !strings.Contains(attrs[0].Value, "managers") {
+		t.Errorf("locked: %+v, %v", attrs, err)
+	}
+}

internal/provider/databricks/details.go

@@ -0,0 +1,43 @@
+package databricks
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"slices"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+// Details are who has access to a scope, and how much. Only the scope's
+// managers may see that; to others it says so.
+func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provider.Attr, error) {
+	w, pr, err := p.client(c.Source.ID)
+	if err != nil {
+		return nil, err
+	}
+	acls, err := w.ListAclsAll(ctx, workspace.ListAclsRequest{Scope: c.Name})
+	var api *apierr.APIError
+	switch {
+	case errors.As(err, &api) && api.StatusCode == 403:
+		return []provider.Attr{{Label: "access", Value: "only the scope's managers can see who has it"}}, nil
+	case err != nil:
+		return nil, classify(pr, err)
+	case len(acls) == 0:
+		return []provider.Attr{{Label: "access", Value: "workspace admins only"}}, nil
+	}
+	rank := map[workspace.AclPermission]int{workspace.AclPermissionManage: 0, workspace.AclPermissionWrite: 1, workspace.AclPermissionRead: 2}
+	slices.SortFunc(acls, func(a, b workspace.AclItem) int {
+		return cmp.Or(cmp.Compare(rank[a.Permission], rank[b.Permission]), cmp.Compare(a.Principal, b.Principal))
+	})
+	out := make([]provider.Attr, len(acls))
+	for i, a := range acls {
+		out[i] = provider.Attr{Value: a.Principal + " · " + strings.ToLower(string(a.Permission))}
+	}
+	out[0].Label = "access"
+	return out, nil
+}