first commit

2026-10-09 02:35:14 +07:00
commit 4ca7a9a58e
108 changed files with 23035 additions and 0 deletions
@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+# =============================================================================
+# eBdesk SiCABE — StarRocks: terapkan DYNAMIC CONFIG (hilang saat FE restart)
+# =============================================================================
+# Mengapa terpisah dan BUKAN di fe.conf?
+#   `authentication_chain` harus memuat `sr_oidc`, tetapi integrasi `sr_oidc`
+#   baru dibuat lewat SQL (bootstrap step 5). Pada boot pertama FE, integrasi itu
+#   BELUM ada sehingga menaruhnya di fe.conf akan gagal. Nilainya karena itu
+#   bersifat runtime: harus diterapkan ULANG setiap kali FE restart.
+#
+# Yang diterapkan:
+#   1. authentication_chain = native,<sr_oidc>   → tanpa ini login OIDC mati
+#      (integrasi tetap "ada" di SHOW SECURITY INTEGRATIONS, jadi sulit terlihat).
+#   2. activate_all_roles_on_login = TRUE        → role otomatis aktif saat login.
+#
+# Skrip ini:
+#   - idempoten (aman dipanggil berkali-kali),
+#   - memverifikasi lebih dulu bahwa security integration ada (kalau tidak,
+#     berhenti dengan pesan agar menjalankan bootstrap step 5),
+#   - memverifikasi hasilnya setelah diterapkan (exit != 0 bila gagal).
+#
+# Usage:
+#   ./scripts/starrocks-reapply-dynamic-config.sh
+#   # StarRocks existing:
+#   STARROCKS_HOST=starrocks.corp STARROCKS_PORT=9030 \
+#     STARROCKS_ROOT_PASSWORD=... ./scripts/starrocks-reapply-dynamic-config.sh
+# =============================================================================
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=../lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+# shellcheck source=../config/environment.defaults.sh
+source "${SCRIPT_DIR}/config/environment.defaults.sh"
+sicabe_load_env "${SCRIPT_DIR}" "$@"
+
+STARROCKS_HOST="${STARROCKS_HOST:-localhost}"
+STARROCKS_PORT="${STARROCKS_PORT:-${STARROCKS_FE_PORT:-12930}}"
+# Multi-host: arahkan ke host pemilik StarRocks FE (single-host tetap localhost).
+STARROCKS_HOST="$(sicabe_local_host STARROCKS_FE_HOST STARROCKS_HOST)"
+SR_USER="${STARROCKS_USER:-root}"
+SR_PW="${STARROCKS_ROOT_PASSWORD:-}"
+OIDC_NAME="${STARROCKS_OIDC_INTEGRATION:-sr_oidc}"
+SR_MYSQL_IMAGE="${SR_MYSQL_IMAGE:-mysql:8}"
+
+if command -v mysql >/dev/null 2>&1; then
+  SR_MODE="host"
+elif docker image inspect "${SR_MYSQL_IMAGE}" >/dev/null 2>&1; then
+  SR_MODE="container"
+else
+  SR_MODE="none"
+fi
+
+# sr_sql <sql> → hasil; kode keluar bukan-0 bila koneksi/kliens gagal.
+sr_sql() {
+  case "${SR_MODE}" in
+    host)
+      MYSQL_PWD="${SR_PW}" mysql --protocol=TCP -h "${STARROCKS_HOST}" -P "${STARROCKS_PORT}" \
+        -u "${SR_USER}" -N -B -e "$1" 2>/dev/null
+      ;;
+    container)
+      docker run --rm -i --network "${SICABE_NETWORK:-sicabe-network}" \
+        -e MYSQL_PWD="${SR_PW}" "${SR_MYSQL_IMAGE}" \
+        mysql --protocol=TCP -h "${STARROCKS_HOST}" -P "${STARROCKS_PORT}" -u "${SR_USER}" \
+        -N -B -e "$1" 2>/dev/null
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+apply_dynamic_config() {
+  echo -e "${INFO} [1/2] authentication_chain = native,${OIDC_NAME}"
+  sr_sql "ADMIN SET FRONTEND CONFIG (\"authentication_chain\" = \"native,${OIDC_NAME}\");" >/dev/null
+
+  echo -e "${INFO} [2/2] activate_all_roles_on_login = TRUE"
+  sr_sql "SET GLOBAL activate_all_roles_on_login = TRUE;" >/dev/null
+}
+
+main() {
+  print_section "StarRocks — terapkan dynamic config (auth chain OIDC)"
+
+  if [[ "${SR_MODE}" == "none" ]]; then
+    echo -e "${ERR} Klien MySQL tidak tersedia di host dan image ${SR_MYSQL_IMAGE} belum ada."
+    echo "  Install klien: sudo apt-get install -y mysql-client   (atau tarik image mysql)"
+    exit 1
+  fi
+  if [[ -z "${SR_PW}" ]]; then
+    echo -e "${ERR} STARROCKS_ROOT_PASSWORD kosong (isi di .env)."
+    exit 1
+  fi
+  if [[ "$(sr_sql 'SELECT 1')" != "1" ]]; then
+    echo -e "${ERR} Tidak bisa terhubung ke StarRocks di ${STARROCKS_HOST}:${STARROCKS_PORT}."
+    exit 1
+  fi
+  echo -e "${OK} Terhubung ke ${STARROCKS_HOST}:${STARROCKS_PORT}"
+
+  # Prasyarat: integrasi harus sudah ada — kalau tidak, menyetel chain akan error.
+  if ! sr_sql "SHOW SECURITY INTEGRATIONS;" | grep -q "${OIDC_NAME}"; then
+    echo -e "${ERR} Security integration '${OIDC_NAME}' belum ada."
+    echo "  Jalankan dulu: ./bootstrap.sh --step 5"
+    exit 1
+  fi
+  echo -e "${OK} Security integration '${OIDC_NAME}' ada (prasyarat terpenuhi)"
+
+  apply_dynamic_config
+
+  # Verifikasi hasil — jangan lapor sukses tanpa bukti.
+  local chain roles
+  chain="$(sr_sql "ADMIN SHOW FRONTEND CONFIG LIKE 'authentication_chain';" | awk -F'\t' '{print $3}')"
+  roles="$(sr_sql "SHOW VARIABLES LIKE 'activate_all_roles_on_login';" | awk -F'\t' '{print $2}')"
+
+  local rc=0
+  if [[ "${chain}" == *"${OIDC_NAME}"* ]]; then
+    echo -e "${OK} authentication_chain = ${chain}"
+  else
+    echo -e "${ERR} authentication_chain = ${chain:-tak terbaca} — gagal memuat ${OIDC_NAME}"
+    rc=1
+  fi
+  if [[ "${roles}" == "true" ]]; then
+    echo -e "${OK} activate_all_roles_on_login = ${roles}"
+  else
+    echo -e "${ERR} activate_all_roles_on_login = ${roles:-tak terbaca} (diharapkan true)"
+    rc=1
+  fi
+
+  if [[ ${rc} -eq 0 ]]; then
+    echo -e "${OK} ${GREEN}Dynamic config diterapkan.${NC}"
+    echo -e "${INFO} Verifikasi menyeluruh: ./scripts/verify-phase4-serving.sh"
+  else
+    echo -e "${ERR} Sebagian dynamic config gagal diterapkan."
+  fi
+  exit ${rc}
+}
+
+main "$@"