feat sicabe-authz

2026-10-13 14:44:55 +07:00
parent 082de8e3b2
commit f534e8da54
6 changed files with 1030 additions and 17 deletions
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# =============================================================================
+# eBdesk SiCABE — sicabe-authz
+# -----------------------------------------------------------------------------
+# CLI pengelolaan AUTHORIZATION (OPA/Trino) berbasis model config/opa/authz.yml.
+#
+# Model authz.yml = SUMBER KEBENARAN. Perintah di sini mengedit model, lalu
+# merender data ACL OPA (config/opa/data.json) dan (opsional) memuat ulang OPA.
+# Logika model ada di lib/authz.py (Python + PyYAML).
+#
+# Pemakaian:
+#   ./scripts/sicabe-authz list roles
+#   ./scripts/sicabe-authz matrix [--schema bronze]
+#   ./scripts/sicabe-authz show role data-engineer
+#   ./scripts/sicabe-authz grant set data-analyst gold.orders_gold --caps select --columns id
+#   ./scripts/sicabe-authz role add data-scientist
+#   ./scripts/sicabe-authz user assign svc_dbt data-engineer
+#   ./scripts/sicabe-authz catalog rename iceberg lakehouse
+#   ./scripts/sicabe-authz render              # authz.yml -> data.json
+#   ./scripts/sicabe-authz check               # pastikan data.json sinkron
+#   ./scripts/sicabe-authz apply [--no-reload] # render + reload OPA
+#   ./scripts/sicabe-authz reload              # recreate container OPA
+#
+#   --dry-run  (posisi mana pun) -> jangan tulis apa pun, hanya cetak rencana.
+# =============================================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=../lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh" 2>/dev/null || true
+
+OPA_CONTAINER="${OPA_CONTAINER_NAME:-sicabe-opa}"
+
+usage() {
+  sed -n '3,27p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+}
+
+# ── Ambil --dry-run dari posisi mana pun ─────────────────────────────────────
+ARGS=()
+for a in "$@"; do
+  if [[ "${a}" == "--dry-run" ]]; then
+    export SICABE_AUTHZ_DRY_RUN=1
+  else
+    ARGS+=("${a}")
+  fi
+done
+set -- ${ARGS[@]+"${ARGS[@]}"}
+
+[[ $# -eq 0 || "${1}" == "-h" || "${1}" == "--help" || "${1}" == "help" ]] && { usage; exit 0; }
+
+PY="${SCRIPT_DIR}/lib/authz.py"
+
+# ── reload: recreate container OPA agar memuat policy+data terbaru ───────────
+reload_opa() {
+  if ! command -v docker >/dev/null 2>&1; then
+    echo -e "${WARN} docker tak tersedia — lewati reload OPA."
+    return 0
+  fi
+  if ! docker ps --format '{{.Names}}' | grep -qx "${OPA_CONTAINER}"; then
+    echo -e "${WARN} container ${OPA_CONTAINER} tidak berjalan di host ini."
+    echo -e "${INFO} Jalankan 'sicabe-authz reload' DI HOST OPA, atau sinkronkan dulu (--sync)."
+    return 0
+  fi
+  echo -e "${INFO} recreate container ${OPA_CONTAINER} (muat ulang policy + data)..."
+  ( cd "${SCRIPT_DIR}" && docker compose --profile all up -d --force-recreate opa >/dev/null )
+  echo -e "${OK} OPA dimuat ulang."
+}
+
+case "${1}" in
+  apply)
+    shift
+    NO_RELOAD=0
+    for a in "$@"; do [[ "${a}" == "--no-reload" ]] && NO_RELOAD=1; done
+    python3 "${PY}" render
+    [[ "${NO_RELOAD}" == "1" ]] || reload_opa
+    ;;
+  reload)
+    reload_opa
+    ;;
+  *)
+    python3 "${PY}" "$@"
+    ;;
+esac