[golharam]

Two read-only admin scripts that answer the questions RBAC raises day to day, without joining users, api_keys, user_role, role, role_permission and project_member by hand.

scripts/list_service_accounts.py

The read-only counterpart to create_service_account.py. For each machine identity it shows its roles, effective permissions, project memberships and API keys, with each key's last_used_at, so an idle account or key is easy to spot. A service account is one that cannot log in interactively (no password and no SSO link), or that holds the service_account role.

• --username NAME: one account in full (works on human accounts too)
• --all: include every account in the inventory
• --json: machine-readable output for review tickets or comparing tiers

scripts/list_roles.py

The companion question: what does a role actually grant, and who holds it.

• Inventory of every role, or --role NAME for one in full
• --diff OTHER: what changing a role to OTHER would add or remove
• Reports drift, where a builtin role in the database disagrees with api/rbac/roles.py
• --json, as above

Notes

• Neither script writes to the database.
• Application logs go to stderr, so --json output on stdout can be piped straight to jq.
• Both have been used against live tiers during the RBAC rollout.
• flake8 is clean. There are no new tests; the scripts only read data and print it.

🤖 Generated with Claude Code