add authz group

deploy/scripts/test-authz.sh

@@ -103,8 +103,27 @@ fi
 "${CLI}" --dry-run --model "${M}" role add data-ghost >/dev/null 2>&1
 grep -q 'data-ghost' "${M}" && bad "--dry-run MENULIS berkas" || ok "--dry-run tidak menulis"
 
-# ─── D. Policy OPA (OPA asli via docker) ────────────────────────────────────
-echo; echo -e "${BLD}D. Evaluasi policy OPA (docker)${NC}"
+# ─── D. Grup/user LDAP (read-only; dilewati bila LDAP tak terjangkau) ────────
+echo; echo -e "${BLD}D. Grup & user LDAP${NC}"
+if python3 - "${DEPLOY_DIR}/lib/authz_ldap.py" <<'PY'
+import importlib.util, sys
+spec = importlib.util.spec_from_file_location("authz_ldap", sys.argv[1])
+m = importlib.util.module_from_spec(spec); spec.loader.exec_module(m)
+e = m.parse_ldif("dn: cn=x,dc=a\ncn: x\nmember: uid=1\nmember: uid=2\n\ndn: cn=y,dc=a\ncn: y\n")
+assert e[0]["cn"] == "x" and e[0]["member"] == ["uid=1", "uid=2"] and e[1]["cn"] == "y", e
+PY
+then ok "parser LDIF benar (parse_ldif)"; else bad "parser LDIF salah"; fi
+svc_out="$("${CLI}" user list --service 2>/dev/null)"
+case "${svc_out}" in *svc_dbt*) ok "user list --service (model) bekerja" ;; *) bad "user list --service keliru" ;; esac
+grp_out="$("${CLI}" group list 2>/dev/null)"
+if [[ -n "${grp_out}" ]]; then
+  ok "group list mengembalikan grup dari LDAP (${grp_out//$'\n'/,})"
+else
+  skip "LDAP tak terjangkau — lewati uji grup live"
+fi
+
+# ─── E. Policy OPA (OPA asli via docker) ────────────────────────────────────
+echo; echo -e "${BLD}E. Evaluasi policy OPA (docker)${NC}"
 if docker info >/dev/null 2>&1; then
   if python3 - "${DEPLOY_DIR}" <<'PY'
 import json, os, shutil, subprocess, sys, tempfile