import collections


def pool_permission_list_for_service(service):
    """Build the permission string for Ceph for a given service"""
    permissions = []
    permission_types = collections.OrderedDict()
    for permission, group in sorted(service["group_names"].items()):
        if permission not in permission_types:
            permission_types[permission] = []
        for item in group:
            permission_types[permission].append(item)
    for permission, groups in permission_types.items():
        permission = "allow {}".format(permission)
        for group in groups:
            for pool in service['groups'][group].get('pools', []):
                permissions.append("{} pool={}".format(permission, pool))
    for permission, prefixes in sorted(
            service.get("object_prefix_perms", {}).items()):
        for prefix in prefixes:
            permissions.append("allow {} object_prefix {}".format(permission,
                                                                  prefix))
    return ['mon', 'allow r, allow command "osd blacklist"',
            'osd', ', '.join(permissions)]