84 lines
3.1 KiB
Bash
84 lines
3.1 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# =============================================================================
|
||
|
|
# eBdesk SiCABE — sicabe-authz
|
||
|
|
# -----------------------------------------------------------------------------
|
||
|
|
# CLI pengelolaan AUTHORIZATION (OPA/Trino) berbasis model config/opa/authz.yml.
|
||
|
|
#
|
||
|
|
# Model authz.yml = SUMBER KEBENARAN. Perintah di sini mengedit model, lalu
|
||
|
|
# merender data ACL OPA (config/opa/data.json) dan (opsional) memuat ulang OPA.
|
||
|
|
# Logika model ada di lib/authz.py (Python + PyYAML).
|
||
|
|
#
|
||
|
|
# Pemakaian:
|
||
|
|
# ./scripts/sicabe-authz list roles
|
||
|
|
# ./scripts/sicabe-authz matrix [--schema bronze]
|
||
|
|
# ./scripts/sicabe-authz show role data-engineer
|
||
|
|
# ./scripts/sicabe-authz grant set data-analyst gold.orders_gold --caps select --columns id
|
||
|
|
# ./scripts/sicabe-authz role add data-scientist
|
||
|
|
# ./scripts/sicabe-authz user assign svc_dbt data-engineer
|
||
|
|
# ./scripts/sicabe-authz catalog rename iceberg lakehouse
|
||
|
|
# ./scripts/sicabe-authz render # authz.yml -> data.json
|
||
|
|
# ./scripts/sicabe-authz check # pastikan data.json sinkron
|
||
|
|
# ./scripts/sicabe-authz apply [--no-reload] # render + reload OPA
|
||
|
|
# ./scripts/sicabe-authz reload # recreate container OPA
|
||
|
|
#
|
||
|
|
# --dry-run (posisi mana pun) -> jangan tulis apa pun, hanya cetak rencana.
|
||
|
|
# =============================================================================
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
|
|
# shellcheck source=../lib/common.sh
|
||
|
|
source "${SCRIPT_DIR}/lib/common.sh" 2>/dev/null || true
|
||
|
|
|
||
|
|
OPA_CONTAINER="${OPA_CONTAINER_NAME:-sicabe-opa}"
|
||
|
|
|
||
|
|
usage() {
|
||
|
|
sed -n '3,27p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
|
||
|
|
}
|
||
|
|
|
||
|
|
# ── Ambil --dry-run dari posisi mana pun ─────────────────────────────────────
|
||
|
|
ARGS=()
|
||
|
|
for a in "$@"; do
|
||
|
|
if [[ "${a}" == "--dry-run" ]]; then
|
||
|
|
export SICABE_AUTHZ_DRY_RUN=1
|
||
|
|
else
|
||
|
|
ARGS+=("${a}")
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
set -- ${ARGS[@]+"${ARGS[@]}"}
|
||
|
|
|
||
|
|
[[ $# -eq 0 || "${1}" == "-h" || "${1}" == "--help" || "${1}" == "help" ]] && { usage; exit 0; }
|
||
|
|
|
||
|
|
PY="${SCRIPT_DIR}/lib/authz.py"
|
||
|
|
|
||
|
|
# ── reload: recreate container OPA agar memuat policy+data terbaru ───────────
|
||
|
|
reload_opa() {
|
||
|
|
if ! command -v docker >/dev/null 2>&1; then
|
||
|
|
echo -e "${WARN} docker tak tersedia — lewati reload OPA."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
if ! docker ps --format '{{.Names}}' | grep -qx "${OPA_CONTAINER}"; then
|
||
|
|
echo -e "${WARN} container ${OPA_CONTAINER} tidak berjalan di host ini."
|
||
|
|
echo -e "${INFO} Jalankan 'sicabe-authz reload' DI HOST OPA, atau sinkronkan dulu (--sync)."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
echo -e "${INFO} recreate container ${OPA_CONTAINER} (muat ulang policy + data)..."
|
||
|
|
( cd "${SCRIPT_DIR}" && docker compose --profile all up -d --force-recreate opa >/dev/null )
|
||
|
|
echo -e "${OK} OPA dimuat ulang."
|
||
|
|
}
|
||
|
|
|
||
|
|
case "${1}" in
|
||
|
|
apply)
|
||
|
|
shift
|
||
|
|
NO_RELOAD=0
|
||
|
|
for a in "$@"; do [[ "${a}" == "--no-reload" ]] && NO_RELOAD=1; done
|
||
|
|
python3 "${PY}" render
|
||
|
|
[[ "${NO_RELOAD}" == "1" ]] || reload_opa
|
||
|
|
;;
|
||
|
|
reload)
|
||
|
|
reload_opa
|
||
|
|
;;
|
||
|
|
*)
|
||
|
|
python3 "${PY}" "$@"
|
||
|
|
;;
|
||
|
|
esac
|