add authz group

deploy/lib/authz.py

@@ -25,6 +25,8 @@ from pathlib import Path
 
 import yaml
 
+import authz_ldap as L
+
 CAPS = ("select", "write", "ddl")
 DEPLOY_DIR = Path(__file__).resolve().parent.parent
 DEFAULT_MODEL = DEPLOY_DIR / "config" / "opa" / "authz.yml"
@@ -425,21 +427,54 @@ def cmd_role(args, model_path: Path) -> int:
 
 def cmd_user(args, model_path: Path) -> int:
     model = load_model(model_path)
-    users = model.setdefault("users", {})
+    users_ = model.setdefault("users", {})
     if args.action == "assign":
         if args.role not in model.get("roles", {}):
             raise ModelError(f"role {args.role!r} tidak ada")
-        users[args.user] = args.role
+        users_[args.user] = args.role
         _say(f"assign {args.user} -> {args.role}")
     else:
-        if args.user not in users:
+        if args.user not in users_:
             raise ModelError(f"service account {args.user!r} tidak terdaftar")
-        del users[args.user]
+        del users_[args.user]
         _say(f"unassign {args.user}")
     save_model(model_path, model)
     return 0
 
 
+def cmd_user_ldap(args) -> int:
+    conf = L.config()
+    if args.action == "list":
+        return L.user_list(conf, args.service)
+    if not args.user:
+        raise ModelError(f"user {args.action}: butuh <uid>")
+    if args.action == "add":
+        return L.user_add(conf, args.user, args.cn, args.mail, args.password, args.group)
+    return L.user_remove(conf, args.user)
+
+
+def cmd_group(args, model_path: Path) -> int:
+    conf = L.config()
+    a = args.action
+    if a == "list":
+        return L.group_list(conf, args.members)
+    if a == "check":
+        return L.group_check(conf, model_path)
+    if a == "sync":
+        return L.group_sync(conf, model_path, args.apply)
+    if not args.a:
+        raise ModelError(f"group {a}: butuh <cn>")
+    if a == "add":
+        return L.group_add(conf, args.a, args.member)
+    if a == "remove":
+        return L.group_remove(conf, args.a)
+    if not args.b:
+        raise ModelError(f"group {a}: butuh dua argumen")
+    if a == "rename":
+        return L.group_rename(conf, model_path, args.a, args.b)
+    return L.group_member(conf, args.a, args.b, a == "add-member")
+
+
 CATALOG_SCAN_PATTERNS = ("deploy/scripts", "deploy/lib", "deploy/config", "docs")
 
 
@@ -562,9 +597,23 @@ def build_parser() -> argparse.ArgumentParser:
     pr.add_argument("--force", action="store_true")
 
     pu = sub.add_parser("user")
-    pu.add_argument("action", choices=["assign", "unassign"])
-    pu.add_argument("user")
+    pu.add_argument("action", choices=["assign", "unassign", "list", "add", "remove"])
+    pu.add_argument("user", nargs="?")
     pu.add_argument("role", nargs="?")
+    pu.add_argument("--service", action="store_true", help="user list: tampilkan service account (model)")
+    pu.add_argument("--cn")
+    pu.add_argument("--mail")
+    pu.add_argument("--password")
+    pu.add_argument("--in", dest="group")
+
+    pgr = sub.add_parser("group")
+    pgr.add_argument("action", choices=["list", "add", "remove", "rename",
+                                        "add-member", "remove-member", "check", "sync"])
+    pgr.add_argument("a", nargs="?", help="cn (atau cn lama untuk rename)")
+    pgr.add_argument("b", nargs="?", help="uid (atau cn baru)")
+    pgr.add_argument("--members", action="store_true", help="list: tampilkan anggota")
+    pgr.add_argument("--member", action="append", default=[], help="add: uid anggota (boleh berulang)")
+    pgr.add_argument("--apply", action="store_true", help="sync: tulis perubahan")
 
     pc = sub.add_parser("catalog")
     pc.add_argument("action", choices=["list", "add", "rename"])
@@ -591,7 +640,11 @@ def dispatch(args) -> int:
     if args.cmd == "role":
         return cmd_role(args, args.model)
     if args.cmd == "user":
-        return cmd_user(args, args.model)
+        if args.action in ("assign", "unassign"):
+            return cmd_user(args, args.model)
+        return cmd_user_ldap(args)
+    if args.cmd == "group":
+        return cmd_group(args, args.model)
     if args.cmd == "catalog":
         return cmd_catalog(args, args.model)
     raise ModelError(f"perintah tak dikenal: {args.cmd}")
@@ -601,7 +654,7 @@ def main(argv: list | None = None) -> int:
     args = build_parser().parse_args(argv)
     try:
         return dispatch(args)
-    except ModelError as exc:
+    except (ModelError, L.LdapError) as exc:
         print(f"ERROR: {exc}", file=sys.stderr)
         return 2