feat sicabe-authz

2026-10-13 14:44:55 +07:00
parent 082de8e3b2
commit f534e8da54
6 changed files with 1030 additions and 17 deletions
@@ -0,0 +1,58 @@
+# =============================================================================
+# SiCABE — Model Authorization (SUMBER KEBENARAN) — OPA / Trino
+# -----------------------------------------------------------------------------
+# Berkas ini SATU-SATUNYA sumber kebenaran ACL. JANGAN mengedit
+# config/opa/data.json manual — itu HASIL RENDER:
+#     ./scripts/sicabe-authz render        # authz.yml -> data.json
+#     ./scripts/sicabe-authz apply         # render + reload OPA
+#     ./scripts/sicabe-authz fmt           # rapikan format berkas ini
+# Policy Rego membaca data.authz.catalogs / data.authz.write_schemas — nama
+# catalog/schema TIDAK di-hardcode di Rego. Ganti nama catalog = ubah `catalogs:`
+# di sini -> render -> reload. Dokumentasi: docs/authorization-cli.md
+# =============================================================================
+version: 1
+catalogs: [iceberg]
+schemas: [bronze, silver, gold]
+roles:
+  data-admin: {superuser: true}
+  data-engineer:
+    grants:
+    - table: bronze.orders
+      caps: [select, write, ddl]
+      columns: '*'
+    - table: bronze.orders_incremental
+      caps: [select, write, ddl]
+      columns: '*'
+    - table: silver.orders_silver
+      caps: [select, write, ddl]
+      columns: '*'
+    - table: gold.orders_gold
+      caps: [select, write, ddl]
+      columns: '*'
+  data-catalog:
+    grants:
+    - table: bronze.orders
+      caps: [select]
+      columns: '*'
+    - table: bronze.orders_incremental
+      caps: [select]
+      columns: '*'
+    - table: silver.orders_silver
+      caps: [select]
+      columns: '*'
+    - table: silver.orders_clean
+      caps: [select]
+      columns: '*'
+    - table: gold.orders_gold
+      caps: [select]
+      columns: '*'
+  data-analyst:
+    grants:
+    - table: gold.orders_gold
+      caps: [select]
+      columns: '*'
+    - table: silver.orders_silver
+      caps: [select]
+      columns: [id, total_value]
+  data-viewer: {}
+users: {svc_dbt: data-engineer, svc_airflow: data-engineer, svc_seed: data-engineer, svc_om: data-catalog}