grzctl 0.1.0__py3-none-any.whl

grzctl/__init__.py

@@ -0,0 +1,5 @@
+"""
+GRZ Control CLI for GRZ administrators.
+"""
+
+__version__ = "0.1.0"

grzctl/cli.py

@@ -0,0 +1,113 @@
+"""
+CLI module for handling command-line interface operations for GRZ administrators.
+"""
+
+PACKAGE_ROOT = "grzctl"
+
+import logging
+import logging.config
+from importlib.metadata import version
+
+import click
+import grz_pydantic_models.submission.metadata
+from grz_cli.commands.encrypt import encrypt
+from grz_cli.commands.submit import submit
+from grz_cli.commands.upload import upload
+from grz_cli.commands.validate import validate
+from grz_common.logging_setup import add_filelogger
+
+from .commands.archive import archive
+from .commands.clean import clean
+from .commands.consent import consent
+from .commands.db import db
+from .commands.decrypt import decrypt
+from .commands.download import download
+from .commands.list_submissions import list_submissions
+from .commands.pruefbericht import pruefbericht
+
+log = logging.getLogger(PACKAGE_ROOT + ".cli")
+
+
+class OrderedGroup(click.Group):
+    """
+    A click Group that keeps track of the order in which commands are added.
+    """
+
+    def list_commands(self, ctx):
+        """Return the list of commands in the order they were added."""
+        return list(self.commands.keys())
+
+
+def build_cli():
+    """
+    Factory for building the CLI application.
+    """
+
+    @click.group(
+        cls=OrderedGroup,
+        help="GRZ Control CLI for GRZ administrators.",
+    )
+    @click.version_option(
+        version=version("grzctl"),
+        prog_name="grzctl",
+        message=f"%(prog)s v%(version)s (metadata schema versions: {', '.join(grz_pydantic_models.submission.metadata.get_supported_versions())})",
+    )
+    @click.option("--log-file", metavar="FILE", type=str, help="Path to log file")
+    @click.option(
+        "--log-level",
+        default="INFO",
+        type=click.Choice(["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"]),
+        help="Set the log level (default: INFO)",
+    )
+    def cli(log_file: str | None = None, log_level: str = "INFO"):
+        """
+        Command-line interface function for setting up logging.
+
+        :param log_file: Path to the log file. If provided, a file logger will be added.
+        :param log_level: Log level for the logger. It should be one of the following:
+                           DEBUG, INFO, WARNING, ERROR, CRITICAL.
+        """
+        if log_file:
+            add_filelogger(
+                log_file,
+                log_level.upper(),
+            )  # Add file logger
+
+        # show only time and log level in STDOUT
+        logging.basicConfig(
+            format="%(asctime)s - %(levelname)s - %(message)s",
+        )
+
+        # set the log level for this package
+        logging.getLogger(PACKAGE_ROOT).setLevel(log_level.upper())
+
+        log.debug("Logging setup complete.")
+
+    # For convenience, include grz-cli commands as well.
+    cli.add_command(validate)
+    cli.add_command(encrypt)
+    cli.add_command(upload)
+    cli.add_command(submit)
+
+    cli.add_command(list_submissions, name="list")
+    cli.add_command(download)
+    cli.add_command(decrypt)
+    cli.add_command(archive)
+    cli.add_command(clean)
+    cli.add_command(consent)
+    cli.add_command(pruefbericht)
+    cli.add_command(db)
+
+    return cli
+
+
+def main():
+    """
+    Main entry point for the CLI application.
+    """
+    cli = build_cli()
+    cli()
+
+
+if __name__ == "__main__":
+    main()

grzctl/commands/__init__.py

@@ -0,0 +1,3 @@
+"""
+Command modules for the grzctl package.
+"""

grzctl/commands/archive.py

@@ -0,0 +1,43 @@
+"""Command for archiving a submission."""
+
+import logging
+from pathlib import Path
+
+import click
+from grz_common.workers.worker import Worker
+
+from ..models.config import ArchiveConfig
+
+log = logging.getLogger(__name__)
+
+from grz_common.cli import config_file, submission_dir, threads
+
+
+@click.command()
+@submission_dir
+@config_file
+@threads
+def archive(
+    submission_dir,
+    config_file,
+    threads,
+):
+    """
+    Archive a submission within a GRZ/GDC.
+    """
+    config = ArchiveConfig.from_path(config_file)
+
+    log.info("Starting archival...")
+
+    submission_dir = Path(submission_dir)
+
+    worker_inst = Worker(
+        metadata_dir=submission_dir / "metadata",
+        files_dir=submission_dir / "files",
+        log_dir=submission_dir / "logs",
+        encrypted_files_dir=submission_dir / "encrypted_files",
+        threads=threads,
+    )
+    worker_inst.archive(config.s3)
+
+    log.info("Archival finished!")

grzctl/commands/clean.py

@@ -0,0 +1,77 @@
+"""Command for cleaning a submission from the S3 inbox."""
+
+import logging
+import sys
+
+import click
+from grz_common.cli import config_file, submission_id
+from grz_common.transfer import init_s3_resource
+
+from ..models.config import CleanConfig
+
+log = logging.getLogger(__name__)
+
+
+@click.command()
+@submission_id
+@config_file
+@click.option("--yes-i-really-mean-it", is_flag=True)
+def clean(submission_id, config_file, yes_i_really_mean_it: bool):
+    """
+    Remove all files of a submission from the S3 inbox.
+    """
+    config = CleanConfig.from_path(config_file)
+    bucket_name = config.s3.bucket
+
+    if yes_i_really_mean_it or click.confirm(
+        f"Are you SURE you want to delete the submission from the inbox bucket ({bucket_name})?",
+        default=False,
+        show_default=True,
+    ):
+        prefix = submission_id
+        prefix = prefix + "/" if not prefix.endswith("/") else prefix
+
+        resource = init_s3_resource(config.s3)
+        bucket = resource.Bucket(bucket_name)
+        log.info(f"Deleting {prefix} from {bucket_name} …")
+
+        responses = bucket.objects.filter(Prefix=prefix).delete()
+        if not responses:
+            sys.exit(f"No objects with prefix '{prefix}' in bucket '{bucket_name}' found for deletion.")
+
+        successfully_deleted_keys = []
+        errors_encountered = []
+        objects_found = 0
+
+        # responses is a list of dicts reporting the result of the deletion API call
+        # because the API does things in batches
+        for response in responses:
+            deleted_batch = response.get("Deleted", [])
+            for deleted_obj in deleted_batch:
+                key = deleted_obj.get("Key")
+                if key:
+                    successfully_deleted_keys.append(key)
+
+            errors_batch = response.get("Errors", [])
+            for error_obj in errors_batch:
+                errors_encountered.append(
+                    {
+                        "Key": error_obj.get("Key", "N/A"),
+                        "Code": error_obj.get("Code", "N/A"),
+                        "Message": error_obj.get("Message", "N/A"),
+                    }
+                )
+
+            objects_found += len(deleted_batch) + len(errors_batch)
+
+        log.info(f"Total objects attempted to delete: {objects_found}")
+        log.info(f"Successfully deleted: {len(successfully_deleted_keys)} objects.")
+        log.info(f"Failed to delete: {len(errors_encountered)} objects.")
+
+        for error in errors_encountered:
+            log.error(f"  - Key: {error['Key']}, Code: {error['Code']}, Message: {error['Message']}")
+
+        if errors_encountered:
+            sys.exit(f"Errors encountered while deleting objects from bucket '{bucket_name}'. See log for details.")
+
+        log.info(f"Deleted '{prefix}' from '{bucket_name}'.")

grzctl/commands/consent.py

@@ -0,0 +1,116 @@
+"""Command for determining whether a submission is consented for research."""
+
+import enum
+import json
+import logging
+import sys
+import typing
+from pathlib import Path
+from typing import Any
+
+import click
+import rich.console
+import rich.table
+import rich.text
+from grz_common.cli import output_json, show_details, submission_dir
+from grz_common.workers.submission import GrzSubmissionMetadata, SubmissionMetadata
+
+log = logging.getLogger(__name__)
+
+MDAT_WISSENSCHAFTLICH_NUTZEN_EU_DSGVO_NIVEAU = "2.16.840.1.113883.3.1937.777.24.5.3.8"
+
+
+class FhirProvision(enum.StrEnum):
+    """Possible FHIR Provision options."""
+
+    PERMIT = "permit"
+    DENY = "deny"
+
+
+@click.command()
+@submission_dir
+@output_json
+@show_details
+def consent(submission_dir, output_json, show_details):
+    """
+    Check if a submission is consented for research.
+
+    Returns 'true' if consented, 'false' if not.
+    A submission is considered consented if all donors have consented for research, that is
+    the FHIR MII IG Consent profiles all have a "permit" provision for code 2.16.840.1.113883.3.1937.777.24.5.3.8
+    """
+    metadata = SubmissionMetadata(Path(submission_dir) / "metadata" / "metadata.json").content
+
+    consents = _gather_consent_information(metadata)
+    overall_consent = _submission_has_research_consent(consents)
+
+    match output_json, show_details:
+        case True, True:
+            json.dump(consents, sys.stdout)
+        case True, False:
+            json.dump(overall_consent, sys.stdout)
+        case False, True:
+            _print_rich_table(consents)
+        case False, False:
+            click.echo(str(overall_consent).lower())
+
+
+def _submission_has_research_consent(consents):
+    return all(consents.values())
+
+
+def _print_rich_table(consents: dict[str, bool]):
+    console = rich.console.Console()
+    table = rich.table.Table()
+    table.add_column("Donor", no_wrap=True)
+    table.add_column("Research Consent", no_wrap=True)
+    for donor_pseudonym, consent_value in consents.items():
+        research_consent = rich.text.Text(
+            "True" if consent_value else "False",
+            style="green" if consent_value else "red",
+        )
+        table.add_row(
+            donor_pseudonym,
+            research_consent,
+        )
+    console.print(table)
+
+
+def _gather_consent_information(metadata: GrzSubmissionMetadata) -> dict[str, bool]:
+    consents = {donor.donor_pseudonym: False for donor in metadata.donors}
+    for donor in metadata.donors:
+        for research_consent in donor.research_consents:
+            mii_consent = research_consent.scope
+            if isinstance(mii_consent, str):
+                mii_consent = json.loads(mii_consent)
+            mii_consent = typing.cast(dict[str, Any], mii_consent)
+
+            if top_level_provision := mii_consent.get("provision"):
+                if top_level_provision.get("type") != FhirProvision.DENY:
+                    sys.exit(
+                        f"The root provision type must be deny, not {top_level_provision.get('type')}, "
+                        f"since the profile follows an opt-in consent scheme. "
+                        f"Explicit opt-in consents must be made via nested provisions."
+                    )
+                else:
+                    nested_provisions = top_level_provision.get("provision")
+                    consents[donor.donor_pseudonym] = _check_nested_provisions(nested_provisions)
+
+    return consents
+
+
+def _check_nested_provisions(provisions: list[dict[str, Any]]) -> bool:
+    for provision in provisions:
+        if provision.get("type") == FhirProvision.PERMIT:
+            for codeable_concept in provision.get("code", []):
+                for coding in codeable_concept.get("coding", []):
+                    code = coding.get("code")
+                    if isinstance(code, str):
+                        if code == MDAT_WISSENSCHAFTLICH_NUTZEN_EU_DSGVO_NIVEAU:
+                            return True
+                    elif isinstance(code, dict):
+                        if (value := code.get("value")) and value == MDAT_WISSENSCHAFTLICH_NUTZEN_EU_DSGVO_NIVEAU:
+                            return True
+                    else:
+                        raise ValueError(code, f"Expected str or dict, got {type(code)}")
+    return False

grzctl/commands/db.py

@@ -0,0 +1,371 @@
+"""Command for managing a submission database"""
+
+import enum
+import json
+import logging
+import sys
+import traceback
+from collections import namedtuple
+from typing import Any
+
+import click
+import rich.console
+import rich.table
+from grz_common.cli import config_file, output_json
+from grz_db import (
+    Author,
+    DatabaseConfigurationError,
+    DuplicateSubmissionError,
+    DuplicateTanGError,
+    Submission,
+    SubmissionDb,
+    SubmissionNotFoundError,
+    SubmissionStateEnum,
+    SubmissionStateLog,
+)
+
+from ..models.config import DbConfig
+
+console = rich.console.Console()
+log = logging.getLogger(__name__)
+
+DATABASE_URL = "sqlite:///test.sqlite"
+
+
+def get_submission_db_instance(db_url: str | None, author: Author | None = None) -> SubmissionDb:
+    """Creates and returns an instance of SubmissionDb."""
+    db_url = db_url or DATABASE_URL
+    return SubmissionDb(db_url=db_url, author=author)
+
+
+@click.group(help="Database operations")
+@config_file
+@click.pass_context
+def db(ctx: click.Context, config_file: str):
+    """Database operations"""
+    config = DbConfig.from_path(config_file)
+    db_config = config.db
+    if not db_config:
+        raise ValueError("DB config not found")
+    author_name = db_config.author.name
+
+    if path := db_config.author.private_key_path:
+        with open(path, "rb") as f:
+            private_key_bytes = f.read()
+    elif key := db_config.author.private_key:
+        private_key_bytes = key.encode("utf-8")
+    else:
+        raise ValueError("Either private_key or private_key_path must be provided.")
+
+    from cryptography.hazmat.primitives.serialization import load_ssh_public_key
+
+    log.info("Reading known public keys")
+    KnownKeyEntry = namedtuple("KnownKeyEntry", ["key_format", "public_key_base64", "author_name"])
+    with open(db_config.known_public_keys) as f:
+        public_key_list = list(map(lambda v: KnownKeyEntry(*v), map(lambda s: s.strip().split(), f.readlines())))
+        public_keys = {
+            author: load_ssh_public_key(f"{fmt}\t{key}\t{author}".encode()) for fmt, key, author in public_key_list
+        }
+        for author in public_keys:
+            log.debug(f"Found public key for {author}")
+
+    author = Author(name=author_name, private_key_bytes=private_key_bytes)
+    ctx.obj = {"author": author, "public_keys": public_keys, "db_url": db_config.database_url}
+
+
+@db.group()
+@click.pass_context
+def submission(ctx: click.Context):
+    """Submission operations"""
+    pass
+
+
+@db.command()
+@click.pass_context
+def init(ctx: click.Context):
+    """Initializes or upgrades the database schema using Alembic."""
+    db = ctx.obj["db_url"]
+    submission_db = get_submission_db_instance(db, author=ctx.obj["author"])
+    console.print(f"[cyan]Initializing database {db}[/cyan]")
+    submission_db.initialize_schema()
+
+
+@db.command()
+@click.option("--revision", default="head", help="Alembic revision to upgrade to (default: 'head').")
+@click.option(
+    "--alembic-ini",
+    type=click.Path(exists=True, dir_okay=False, resolve_path=True),
+    default="alembic.ini",
+    help="Override path to alembic.ini file.",
+)
+@click.pass_context
+def upgrade(
+    ctx: click.Context,
+    revision: str,
+    alembic_ini: str,
+):
+    """
+    Upgrades the database schema using Alembic.
+    """
+    db = ctx.obj["db_url"]
+    submission_db = get_submission_db_instance(db, author=ctx.obj["author"])
+
+    console.print(f"[cyan]Using alembic configuration: {alembic_ini}[/cyan]")
+
+    try:
+        console.print(f"[cyan]Attempting to upgrade database to revision: {revision}...[/cyan]")
+        _ = submission_db.upgrade_schema(
+            alembic_ini_path=alembic_ini,
+            revision=revision,
+        )
+
+    except (DatabaseConfigurationError, RuntimeError) as e:
+        console.print(f"[red]Error during schema initialization: {e}[/red]")
+        if isinstance(e, RuntimeError):
+            console.print(
+                "[yellow]Ensure your database is running and accessible, and alembic.ini is configured correctly.[/yellow]"
+            )
+            console.print(
+                "[yellow]You might need to create an initial migration if this is the first time: 'alembic revision -m \"initial\" --autogenerate'[/yellow]"
+            )
+        raise click.ClickException(str(e)) from e
+    except Exception as e:
+        console.print(f"[red]An unexpected error occurred during 'db init': {type(e).__name__} - {e}[/red]")
+        raise click.ClickException(str(e)) from e
+
+
+@db.command("list")
+@output_json
+@click.pass_context
+def list_submissions(ctx: click.Context, output_json: bool = False):
+    """Lists all submissions in the database with their latest state."""
+    db = ctx.obj["db_url"]
+    db_service = get_submission_db_instance(db)
+    submissions = db_service.list_submissions()
+
+    if not submissions:
+        console.print("[yellow]No submissions found in the database.[/yellow]")
+        return
+
+    table = rich.table.Table(title="All Submissions")
+    table.add_column("ID", style="dim", width=12)
+    table.add_column("tanG", style="cyan")
+    table.add_column("Pseudonym", style="magenta")
+    table.add_column("Latest State", style="green")
+    table.add_column("Last State Timestamp (UTC)", style="yellow")
+    table.add_column("Data Steward")
+    table.add_column("Signature Status")
+
+    submission_dicts = []
+
+    for submission in submissions:
+        latest_state_obj: SubmissionStateLog | None = None
+        if submission.states:
+            latest_state_obj = max(submission.states, key=lambda s: s.timestamp)
+
+        latest_state_str = "N/A"
+        latest_timestamp_str = "N/A"
+        author_name_str = "N/A"
+        signature_status = SignatureStatus.UNKNOWN
+
+        if latest_state_obj:
+            latest_state_str = latest_state_obj.state.value
+            latest_state_str = (
+                f"[red]{latest_state_str}[/red]" if latest_state_str == SubmissionStateEnum.ERROR else latest_state_str
+            )
+            latest_timestamp_str = latest_state_obj.timestamp.isoformat()
+            author_name_str = latest_state_obj.author_name
+
+            author_public_key = ctx.obj["public_keys"].get(author_name_str)
+            signature_status = _verify_signature(author_public_key, latest_state_obj)
+
+        if output_json:
+            submission_dict = _build_submission_dict_from(latest_state_obj, submission, signature_status)
+            submission_dicts.append(submission_dict)
+        else:
+            table.add_row(
+                submission.id,
+                submission.tan_g if submission.tan_g is not None else "N/A",
+                submission.pseudonym if submission.pseudonym is not None else "N/A",
+                latest_state_str,
+                latest_timestamp_str,
+                author_name_str,
+                signature_status.rich_display(),
+            )
+
+    if output_json:
+        json.dump(submission_dicts, sys.stdout)
+    else:
+        console.print(table)
+
+
+class SignatureStatus(enum.StrEnum):
+    """Enum for signature status."""
+
+    VERIFIED = "Verified"
+    FAILED = "Failed"
+    ERROR = "Error"
+    UNKNOWN = "Unknown"
+
+    def rich_display(self) -> str:
+        """Displays the signature status in rich format."""
+        match self:
+            case "Verified":
+                return "[green]Verified[/green]"
+            case "Failed":
+                return "[red]Failed[/red]"
+            case "Error":
+                return "[red]Error[/red]"
+            case "Unknown" | _:
+                return "[yellow]Unknown[/yellow]"
+
+
+def _verify_signature(author_public_key, latest_state_obj: SubmissionStateLog) -> SignatureStatus:
+    signature_status = SignatureStatus.UNKNOWN
+    if author_public_key:
+        try:
+            if latest_state_obj.verify(author_public_key):
+                signature_status = SignatureStatus.VERIFIED
+            else:
+                signature_status = SignatureStatus.FAILED
+        except Exception as e:
+            signature_status = SignatureStatus.ERROR
+            log.error(e)
+    return signature_status
+
+
+def _build_submission_dict_from(
+    latest_state_obj: SubmissionStateLog | None, submission: Submission, signature_status: SignatureStatus
+) -> dict[str, Any]:
+    submission_dict: dict[str, Any] = {
+        "id": submission.id,
+        "tan_g": submission.tan_g,
+        "pseudonym": submission.pseudonym,
+        "latest_state": None,
+    }
+    if latest_state_obj:
+        submission_dict["latest_state"] = {
+            "state": latest_state_obj.state.value,
+            "timestamp": latest_state_obj.timestamp.isoformat(),
+            "data": latest_state_obj.data,
+            "data_steward": latest_state_obj.author_name,
+            "data_steward_signature": signature_status,
+        }
+    return submission_dict
+
+
+@submission.command()
+@click.argument("submission_id", type=str)
+@click.option("--tan-g", "tan_g", type=str, default=None, help="The tanG for the submission.")
+@click.option("--pseudonym", type=str, default=None, help="The pseudonym for the submission.")
+@click.pass_context
+def add(ctx: click.Context, submission_id: str, tan_g: str | None, pseudonym: str | None):
+    """
+    Add a submission to the database.
+    """
+    db = ctx.obj["db_url"]
+    db_service = get_submission_db_instance(db)
+    try:
+        db_submission = db_service.add_submission(submission_id, tan_g, pseudonym)
+        console.print(f"[green]Submission '{db_submission.id}' added successfully.[/green]")
+        console.print(f"  tanG: {db_submission.tan_g}, Pseudonym: {db_submission.pseudonym}")
+    except (DuplicateSubmissionError, DuplicateTanGError) as e:
+        console.print(f"[red]Error: {e}[/red]")
+        raise click.Abort() from e
+    except Exception as e:
+        console.print(f"[red]An unexpected error occurred: {e}[/red]")
+        raise click.ClickException(f"Failed to add submission: {e}") from e
+
+
+@submission.command()
+@click.argument("submission_id", type=str)
+@click.argument("state_str", metavar="STATE", type=click.Choice(SubmissionStateEnum.list(), case_sensitive=False))
+@click.option("--data", "data_json", type=str, default=None, help='Additional JSON data (e.g., \'{"k":"v"}\').')
+@click.pass_context
+def update(ctx: click.Context, submission_id: str, state_str: str, data_json: str | None):
+    """Update a submission to the given state. Optionally accepts additional JSON data to associate with the log entry."""
+    db = ctx.obj["db_url"]
+    db_service = get_submission_db_instance(db, author=ctx.obj["author"])
+    try:
+        state_enum = SubmissionStateEnum(state_str)
+    except ValueError as e:
+        console.print(f"[red]Error: Invalid state value '{state_str}'.[/red]")
+        raise click.Abort() from e
+
+    parsed_data = None
+    if data_json:
+        try:
+            parsed_data = json.loads(data_json)
+        except json.JSONDecodeError as e:
+            console.print(f"[red]Error: Invalid JSON string for --data: {data_json}[/red]")
+            raise click.Abort() from e
+    try:
+        new_state_log = db_service.update_submission_state(submission_id, state_enum, parsed_data)
+        console.print(
+            f"[green]Submission '{submission_id}' updated to state '{new_state_log.state.value}'. Log ID: {new_state_log.id}[/green]"
+        )
+        if new_state_log.data:
+            console.print(f"  Data: {new_state_log.data}")
+
+        if state_enum == SubmissionStateEnum.REPORTED:
+            updated_submission = db_service.get_submission(submission_id)
+            if updated_submission:
+                console.print(f"  Submission tanG is now: {updated_submission.tan_g}")
+
+    except SubmissionNotFoundError as e:
+        console.print(f"[red]Error: {e}[/red]")
+        console.print(f"You might need to add it first: grz-cli db add-submission {submission_id}")
+        raise click.Abort() from e
+    except Exception as e:
+        console.print(f"[red]An unexpected error occurred: {e}[/red]")
+        traceback.print_exc()
+        raise click.ClickException(f"Failed to update submission state: {e}") from e
+
+
+@submission.command("show")
+@click.argument("submission_id", type=str)
+@click.pass_context
+def show(ctx: click.Context, submission_id: str):
+    """
+    Show details of a submission.
+    """
+    db = ctx.obj["db_url"]
+    db_service = get_submission_db_instance(db)
+    submission = db_service.get_submission(submission_id)
+    if not submission:
+        console.print(f"[red]Error: Submission with ID '{submission_id}' not found.[/red]")
+        raise click.Abort()
+
+    console.print(f"\n[bold blue]Submission Details for ID: {submission.id}[/bold blue]")
+    console.print(f"  tanG: {submission.tan_g if submission.tan_g is not None else 'N/A'}")
+    console.print(f"  Pseudonym: {submission.pseudonym if submission.pseudonym is not None else 'N/A'}")
+
+    if submission.states:
+        table = rich.table.Table(title=f"State History for Submission {submission.id}")
+        table.add_column("Log ID", style="dim", width=12)
+        table.add_column("Timestamp (UTC)", style="yellow")
+        table.add_column("State", style="green")
+        table.add_column("Data", style="cyan", overflow="ellipsis")
+        table.add_column("Data Steward", style="magenta")
+        table.add_column("Signature Status")
+
+        sorted_states = sorted(submission.states, key=lambda s: s.timestamp)
+        for state_log in sorted_states:
+            data_str = json.dumps(state_log.data) if state_log.data else ""
+            state = state_log.state.value
+            state_str = f"[red]{state}[/red]" if state == SubmissionStateEnum.ERROR else state
+            data_steward_str = state_log.author_name
+            author_public_key = ctx.obj["public_keys"].get(data_steward_str)
+            signature_status_str = _verify_signature(author_public_key, state_log).rich_display()
+
+            table.add_row(
+                str(state_log.id),
+                state_log.timestamp.isoformat(),
+                state_str,
+                data_str,
+                data_steward_str,
+                signature_status_str,
+            )
+        console.print(table)
+    else:
+        console.print("[yellow]No state history found for this submission.[/yellow]")

grzctl/commands/decrypt.py

@@ -0,0 +1,45 @@
+"""Command for decrypting a submission."""
+
+import logging
+import sys
+from pathlib import Path
+
+import click
+from grz_common.cli import config_file, force, submission_dir
+from grz_common.workers.worker import Worker
+
+from ..models.config import DecryptConfig
+
+log = logging.getLogger(__name__)
+
+
+@click.command()
+@submission_dir
+@config_file
+@force
+def decrypt(submission_dir, config_file, force):
+    """
+    Decrypt a submission.
+
+    Decrypting a submission requires the _private_ key of the original recipient.
+    """
+    config = DecryptConfig.from_path(config_file)
+
+    grz_privkey_path = config.keys.grz_private_key_path
+    if not grz_privkey_path:
+        log.error("GRZ private key path is required for decryption.")
+        sys.exit(1)
+
+    log.info("Starting decryption...")
+
+    submission_dir = Path(submission_dir)
+
+    worker_inst = Worker(
+        metadata_dir=submission_dir / "metadata",
+        files_dir=submission_dir / "files",
+        log_dir=submission_dir / "logs",
+        encrypted_files_dir=submission_dir / "encrypted_files",
+    )
+    worker_inst.decrypt(grz_privkey_path, force=force)
+
+    log.info("Decryption successful!")

grzctl/commands/download.py

@@ -0,0 +1,46 @@
+"""Command for downloading a submission."""
+
+import logging
+from pathlib import Path
+
+import click
+from grz_common.cli import config_file, force, output_dir, submission_id, threads
+from grz_common.workers.worker import Worker
+
+from ..models.config import DownloadConfig
+
+log = logging.getLogger(__name__)
+
+
+@click.command()
+@submission_id
+@output_dir
+@config_file
+@threads
+@force
+def download(submission_id, output_dir, config_file, threads, force):
+    """
+    Download a submission from a GRZ.
+
+    Downloaded metadata is stored within the `metadata` sub-folder of the submission output directory.
+    Downloaded files are stored within the `encrypted_files` sub-folder of the submission output directory.
+    """
+    config = DownloadConfig.from_path(config_file)
+
+    log.info("Starting download...")
+
+    submission_dir_path = Path(output_dir)
+    if not submission_dir_path.is_dir():
+        log.debug("Creating submission directory %s", submission_dir_path)
+        submission_dir_path.mkdir(mode=0o770, parents=False, exist_ok=False)
+
+    worker_inst = Worker(
+        metadata_dir=submission_dir_path / "metadata",
+        files_dir=submission_dir_path / "files",
+        log_dir=submission_dir_path / "logs",
+        encrypted_files_dir=submission_dir_path / "encrypted_files",
+        threads=threads,
+    )
+    worker_inst.download(config.s3, submission_id, force=force)
+
+    log.info("Download finished!")

grzctl/commands/list_submissions.py

@@ -0,0 +1,50 @@
+"""Command for listing submissions."""
+
+import json
+import logging
+import sys
+
+import click
+import rich.console
+import rich.table
+import rich.text
+from grz_common.cli import config_file, output_json
+from grz_common.workers.download import query_submissions
+from pydantic_core import to_jsonable_python
+
+from ..models.config import ListConfig
+
+log = logging.getLogger(__name__)
+
+
+@click.command()
+@config_file
+@output_json
+def list_submissions(config_file, output_json):
+    """
+    List submissions within an inbox from oldest to newest.
+    """
+    config = ListConfig.from_path(config_file)
+    submissions = query_submissions(config.s3)
+
+    if output_json:
+        json.dump(to_jsonable_python(submissions), sys.stdout)
+    else:
+        console = rich.console.Console()
+        table = rich.table.Table()
+        table.add_column("ID", no_wrap=True)
+        table.add_column("Status", no_wrap=True)
+        table.add_column("Oldest Upload", overflow="fold")
+        table.add_column("Newest Upload", overflow="fold")
+        for submission in submissions:
+            status_text = rich.text.Text(
+                "Complete" if submission.complete else "Incomplete",
+                style="green" if submission.complete else "yellow",
+            )
+            table.add_row(
+                submission.submission_id,
+                status_text,
+                submission.oldest_upload.astimezone().strftime("%Y-%m-%d %H:%M:%S"),
+                submission.newest_upload.astimezone().strftime("%Y-%m-%d %H:%M:%S"),
+            )
+        console.print(table)

grzctl/commands/pruefbericht.py

@@ -0,0 +1,181 @@
+"""Command for submitting Prüfberichte."""
+
+import datetime
+import json
+import logging
+import sys
+
+import click
+import requests
+from grz_common.cli import config_file, output_json, submission_dir
+from grz_common.workers.submission import Submission
+
+# pyrefly: ignore
+from grz_pydantic_models.pruefbericht import LibraryType, Pruefbericht, SubmittedCase
+
+# pyrefly: ignore
+from grz_pydantic_models.submission.metadata.v1 import (
+    GenomicStudySubtype,
+    GrzSubmissionMetadata,
+    Relation,
+    SequenceSubtype,
+)
+from pydantic_core import to_jsonable_python
+
+from ..models.config import PruefberichtConfig
+
+log = logging.getLogger(__name__)
+
+
+def _get_new_token(auth_url: str, client_id: str, client_secret: str) -> tuple[str, datetime.datetime]:
+    log.info("Refreshing access token...")
+
+    response = requests.post(
+        auth_url,
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        data={"grant_type": "client_credentials", "client_id": client_id, "client_secret": client_secret},
+        timeout=60,
+    )
+
+    if response.status_code != requests.codes.ok:
+        log.error("There was a problem refreshing the access token")
+        response.raise_for_status()
+
+    response_json = response.json()
+    token = response_json["access_token"]
+    expires_in = response_json["expires_in"]
+    # take off a second to provide at least a minimal safety margin
+    expires_at = datetime.datetime.now() + datetime.timedelta(seconds=expires_in - 1)
+
+    log.info("Successfully obtained a new access token.")
+    return token, expires_at
+
+
+def _submit_pruefbericht(base_url: str, token: str, pruefbericht: Pruefbericht):
+    log.info("Submitting Prüfbericht...")
+
+    response = requests.post(
+        base_url.rstrip("/") + "/upload",
+        headers={"Authorization": f"bearer {token}"},
+        json=to_jsonable_python(pruefbericht),
+        timeout=60,
+    )
+
+    if response.status_code != requests.codes.ok:
+        log.warning("There was a problem submitting the Prüfbericht.")
+        response.raise_for_status()
+
+
+def _get_library_type(metadata: GrzSubmissionMetadata) -> LibraryType:
+    index_patients = [donor for donor in metadata.donors if donor.relation == Relation.index_]
+    if len(index_patients) != 1:
+        # TODO handle in grz-pydantic-model validation?
+        raise ValueError("Multiple index patients in one submission")
+    index_patient = index_patients[0]
+
+    # assume somatic is tumor in context of genomDE
+    data_tumor = filter(lambda datum: datum.sequence_subtype == SequenceSubtype.somatic, index_patient.lab_data)
+    data_germline = filter(lambda datum: datum.sequence_subtype == SequenceSubtype.germline, index_patient.lab_data)
+
+    unique_tumor_library_types = {datum.library_type for datum in data_tumor}
+    if len(unique_tumor_library_types) > 1:
+        raise ValueError("Multiple different library types detected for tumor data")
+
+    unique_germline_library_types = {datum.library_type for datum in data_germline}
+    if len(unique_germline_library_types) > 1:
+        raise ValueError("Multiple different library types detected for germline data")
+
+    match metadata.submission.genomic_study_subtype:
+        case GenomicStudySubtype.tumor_only:
+            if not unique_tumor_library_types:
+                raise ValueError("No somatic library types detected in tumor submission")
+            library_type = LibraryType(str(next(iter(unique_tumor_library_types))))
+        case GenomicStudySubtype.germline_only:
+            if not unique_germline_library_types:
+                raise ValueError("No germline library types detected in germline submission")
+            library_type = LibraryType(str(next(iter(unique_germline_library_types))))
+        case GenomicStudySubtype.tumor_germline:
+            unique_library_types = unique_tumor_library_types | unique_germline_library_types
+            if len(unique_library_types) != 1:
+                # TODO: is there a better solution to this?
+                raise ValueError("None or multiple different library types detected for tumor+germline sample")
+            library_type = LibraryType(str(next(iter(unique_library_types))))
+        case _:
+            raise ValueError(f"Unknown genomic study subtype: {metadata.submission.genomic_study_subtype}")
+
+    return library_type
+
+
+@click.command()
+@config_file
+@submission_dir
+@output_json
+@click.option("--fail/--pass", "failed", help="Fail an otherwise valid submission (e.g. failed internal QC)")
+@click.option(
+    "--token", help="Access token to try instead of requesting a new one.", envvar="GRZ_PRUEFBERICHT_ACCESS_TOKEN"
+)
+def pruefbericht(config_file, submission_dir, output_json, failed, token):
+    """
+    Submit a Prüfbericht to BfArM.
+    """
+    config = PruefberichtConfig.from_path(config_file)
+
+    if config.pruefbericht.authorization_url is None:
+        raise ValueError("pruefbericht.auth_url must be provided to submit Prüfberichte")
+    if config.pruefbericht.client_id is None:
+        raise ValueError("pruefbericht.client_id must be provided to submit Prüfberichte")
+    if config.pruefbericht.client_secret is None:
+        raise ValueError("pruefbericht.client_secret must be provided to submit Prüfberichte")
+
+    submission = Submission(metadata_dir=f"{submission_dir}/metadata", files_dir=f"{submission_dir}/files")
+
+    metadata = submission.metadata.content
+    pruefbericht = Pruefbericht(
+        SubmittedCase=SubmittedCase(
+            submissionDate=metadata.submission.submission_date,
+            submissionType=metadata.submission.submission_type,
+            tan=metadata.submission.tan_g,
+            submitterId=metadata.submission.submitter_id,
+            dataNodeId=metadata.submission.genomic_data_center_id,
+            diseaseType=metadata.submission.disease_type,
+            dataCategory="genomic",
+            libraryType=_get_library_type(metadata),
+            coverageType=metadata.submission.coverage_type,
+            dataQualityCheckPassed=not failed,
+        )
+    )
+
+    if token:
+        # replace newlines in token if accidentally present from pasting
+        token = token.replace("\n", "")
+        expiry = None
+    else:
+        token, expiry = _get_new_token(
+            auth_url=str(config.pruefbericht.authorization_url),
+            client_id=config.pruefbericht.client_id,
+            client_secret=config.pruefbericht.client_secret,
+        )
+
+    try:
+        _submit_pruefbericht(base_url=str(config.pruefbericht.api_base_url), token=token, pruefbericht=pruefbericht)
+    except requests.HTTPError as error:
+        if error.response.status_code == requests.codes.unauthorized:
+            # get a new token and try again
+            log.warning("Provided token has expired. Attempting to refresh.")
+            token, expiry = _get_new_token(
+                auth_url=str(config.pruefbericht.authorization_url),
+                client_id=config.pruefbericht.client_id,
+                client_secret=config.pruefbericht.client_secret,
+            )
+            _submit_pruefbericht(base_url=str(config.pruefbericht.api_base_url), token=token, pruefbericht=pruefbericht)
+        else:
+            log.error("Encountered an irrecoverable error while submitting the Prüfbericht!")
+            raise error
+
+    log.info("Prüfbericht submitted successfully.")
+
+    if output_json and expiry:
+        json.dump({"token": token, "expires": expiry.isoformat()}, sys.stdout)
+    elif expiry:
+        log.info(f"New token expires at {expiry.isoformat()}")
+        print(token)

grzctl/models/config.py

@@ -0,0 +1,34 @@
+from grz_common.models.base import IgnoringBaseSettings
+from grz_common.models.keys import KeyConfigModel
+from grz_common.models.s3 import S3ConfigModel
+
+from .db import DbModel
+from .pruefbericht import PruefberichtModel
+
+
+class ArchiveConfig(S3ConfigModel):
+    pass
+
+
+class DownloadConfig(S3ConfigModel):
+    pass
+
+
+class DecryptConfig(KeyConfigModel):
+    pass
+
+
+class CleanConfig(S3ConfigModel, KeyConfigModel):
+    pass
+
+
+class PruefberichtConfig(IgnoringBaseSettings):
+    pruefbericht: PruefberichtModel
+
+
+class DbConfig(IgnoringBaseSettings):
+    db: DbModel
+
+
+class ListConfig(S3ConfigModel):
+    pass

grzctl/models/db.py

@@ -0,0 +1,37 @@
+from typing import Annotated, Self
+
+from grz_common.models.base import IgnoringBaseSettings
+from pydantic import Field, FilePath, model_validator
+
+
+class Author(IgnoringBaseSettings):
+    name: str
+    """Name of the author"""
+
+    private_key: str | None = None
+    """Author's private key (needed to sign DB modifications)."""
+
+    private_key_path: FilePath | None = None
+    """Path to the author's private key (needed to sign DB modifications)."""
+
+    @model_validator(mode="after")
+    def validate_private_key(self) -> Self:
+        if self.private_key is not None and self.private_key_path is not None:
+            raise ValueError("Only one of private_key or private_key_path must be set.")
+        return self
+
+
+class DbModel(IgnoringBaseSettings):
+    """Submission database related configuration."""
+
+    database_url: Annotated[str, Field(examples=["sqlite:///submission.sqlite"])]
+    """URL to a database."""
+
+    author: Author
+    """Author information for submission database."""
+
+    known_public_keys: FilePath | str = "~/.config/grz-cli/known_public_keys"
+    """
+    File listing public keys. Used for DB verification.
+
+    Format: key_format public_key_base64 author_name"""

grzctl/models/pruefbericht.py

@@ -0,0 +1,28 @@
+from typing import Annotated
+
+from grz_common.models.base import IgnoringBaseModel
+from pydantic import AnyHttpUrl, UrlConstraints
+
+
+class PruefberichtModel(IgnoringBaseModel):
+    authorization_url: Annotated[AnyHttpUrl, UrlConstraints(allowed_schemes=["https"], host_required=True)] | None = (
+        None
+    )
+    """
+    URL from which to request a new Prüfbericht submission token
+    """
+
+    client_id: str | None = None
+    """
+    Client ID used to obtain new Prüfbericht submission tokens
+    """
+
+    client_secret: str | None = None
+    """
+    Client secret used to obtain new Prüfbericht submission tokens
+    """
+
+    api_base_url: Annotated[AnyHttpUrl, UrlConstraints(allowed_schemes=["https"], host_required=True)] | None = None
+    """
+    Base URL to BfArM Submission (Prüfbericht) API
+    """

grzctl-0.1.0.dist-info/METADATA

@@ -0,0 +1,32 @@
+Metadata-Version: 2.4
+Name: grzctl
+Version: 0.1.0
+Summary: Control CLI for GRZ administrators.
+Project-URL: Homepage, https://github.com/BfArM-MVH/grz-tools
+Project-URL: Repository, https://github.com/BfArM-MVH/grz-tools
+Project-URL: Documentation, https://github.com/BfArM-MVH/grz-tools/tree/main/packages/grzctl
+Project-URL: Issues, https://github.com/BfArM-MVH/grz-tools/issues
+Author-email: Koray Kirli <koraykirli@gmail.com>, Mathias Lesche <mathias.lesche@tu-dresden.de>, "Florian R. Hölzlwimmer" <git.ich@frhoelzlwimmer.de>, Till Hartmann <till.hartmann@bih-charite.de>, Thomas Sell <thomas.sell@bih-charite.de>, Travis Wrightsman <travis.wrightsman@uni-tuebingen.de>
+License-Expression: MIT
+Keywords: GDC,GRZ,S3
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.12
+Requires-Dist: boto3<2,>=1.36
+Requires-Dist: click<9,>=8.1.7
+Requires-Dist: crypt4gh<2,>=1.7
+Requires-Dist: grz-common
+Requires-Dist: grz-db
+Requires-Dist: grz-pydantic-models>=1.3.0
+Requires-Dist: jsonschema<5,>=4.23.0
+Requires-Dist: platformdirs<5,>=4.3.6
+Requires-Dist: pydantic-settings<2.10,>=2.9.0
+Requires-Dist: pydantic<2.10,>=2.9.2
+Requires-Dist: pysam==0.23.*
+Requires-Dist: pyyaml<7,>=6.0.2
+Requires-Dist: requests<3,>=2.32.3
+Requires-Dist: rich==13.*
+Requires-Dist: tqdm<5,>=4.66.5
+Description-Content-Type: text/markdown
+
+GRZ internal tooling.

grzctl-0.1.0.dist-info/RECORD

@@ -0,0 +1,20 @@
+grzctl/__init__.py,sha256=XdIBbKjf_hXVHi3q1dIdbAdTpDaheUuEzFnIQYn3G3Q,71
+grzctl/cli.py,sha256=qX5EcQbVMn9SMADVnQWoNPKOJtJKbw09mFqtU9d_Y1A,3289
+grzctl/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+grzctl/commands/__init__.py,sha256=_ZczLaPd0w1uEgRbSNe1J7w1zW1ct424pM9fp6qTw0g,48
+grzctl/commands/archive.py,sha256=MT8XUHPWdRtniRzdgJPpEP2ja1OBevvKNf-w3oJuRz4,926
+grzctl/commands/clean.py,sha256=3TMYc2p8O6INMFi0-2g_oJ-kjSCe5nIAX48LD6OUzq8,2806
+grzctl/commands/consent.py,sha256=z9TirrWVmKzbcX0ONyPKU8ZNT5aznA1JmABN2TSGXxQ,4280
+grzctl/commands/db.py,sha256=e947DKbwA-oVCzd_Jh9hC_kJF2vO7Ba1SAibSBnzUy8,14166
+grzctl/commands/decrypt.py,sha256=dK6FhR_06JLdrkBfq11U2eBzbeJrUGjpC9wCNF4c9d8,1159
+grzctl/commands/download.py,sha256=J7x1fx4zzXLtKv65oEmliCap5SlvU_gXEW_1AtVQcso,1419
+grzctl/commands/list_submissions.py,sha256=bbTOza6ij8tOAw-sWv-lHBfDN-nS_8IaIdl7eZiNUFw,1565
+grzctl/commands/pruefbericht.py,sha256=ksN-MSAQxbPPrTOxK5UkyZZi7M59iaotAcW-la8n56k,7542
+grzctl/models/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+grzctl/models/config.py,sha256=aK5vIA_lREy9t6nTBiyPtqV4oj55HB8zJsw5AQXKXKo,612
+grzctl/models/db.py,sha256=DCImTKjxIjzOCR38EDePO73GTNsrTGrIL8bh5RySYGc,1199
+grzctl/models/pruefbericht.py,sha256=qeOlqxlehFV7QS23byQGOJc6sNFLkOtT_yKLC9PYmr4,819
+grzctl-0.1.0.dist-info/METADATA,sha256=gUfUokVthxJZNPHarmoCJ2GYPWkQdncZBWffoInzIBo,1396
+grzctl-0.1.0.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+grzctl-0.1.0.dist-info/entry_points.txt,sha256=jL-UHdg_9PxXMA_g_B4atB3XSw62-H3qZsjV-HNHV5g,43
+grzctl-0.1.0.dist-info/RECORD,,

grzctl-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.27.0
+Root-Is-Purelib: true
+Tag: py3-none-any

grzctl-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+grzctl = grzctl.cli:main