async def list_permissions(app, username):
    """List the permissions for a user.

    Parameters
    ----------
    app : aiohttp.web.Application
        The aiohttp application instance
    username : str
        The username of the user
    Returns
    -------
    permissions : list
        The list of permissions user has
    """
    user = await app["db"].users.find_one(
        {"username": username}, {"permissions": 1, "_id": 0}
    )
    if user is not None:
        return user.get("permissions", [])
    return []