#!/usr/bin/env bash
# =============================================================================
# eBdesk SiCABE — sicabe-authz
# -----------------------------------------------------------------------------
# CLI pengelolaan AUTHORIZATION: model OPA/Trino (config/opa/authz.yml) dan
# GRUP/USER OpenLDAP (sumber grup Trino & StarRocks). Logika: lib/authz.py +
# lib/authz_ldap.py (Python + PyYAML; ldap-utils).
#
# Pemakaian: ./scripts/sicabe-authz <perintah> [opsi] [--dry-run] [--env-file <f>]
#   --dry-run  (posisi mana pun) -> jangan tulis apa pun, cetak rencana.
# =============================================================================
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=../lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh" 2>/dev/null || true
# shellcheck source=../config/environment.defaults.sh
source "${SCRIPT_DIR}/config/environment.defaults.sh" 2>/dev/null || true

OPA_CONTAINER="${OPA_CONTAINER_NAME:-sicabe-opa}"
PY="${SCRIPT_DIR}/lib/authz.py"

usage() {
  cat <<'EOF'
sicabe-authz — kelola authorization (OPA/Trino) + grup/user OpenLDAP

MODEL OPA (authz.yml -> data.json):
  list catalogs|roles|users|tables      daftar isi model
  matrix [--schema <s>]                 matriks role x tabel (s=select w=write d=ddl)
  show role|user|table <nama>           detail satu objek
  grant add|set|remove <role> <schema.table> [--caps a,b] [--columns x,y|*]
  grant add <role> '<schema>.*' [--caps a,b]   # seluruh tabel di schema (mis. gold.*)
  role add|remove <nama> [--superuser] [--force]
  user assign|unassign <svc> <role>     service account -> role (model)
  catalog list|add|rename <baru>        kelola catalog (rename ikut berkas Trino)
  fmt | render | check                  rapikan / render / cek sinkron
  apply [--no-reload] | reload          render (+ reload OPA)

GRUP & USER LDAP (sumber grup Trino & StarRocks):
  group list [--members]                daftar grup (+ anggota)
  group add <cn> --member <uid>         buat grup (butuh >=1 member)
  group remove <cn>                     hapus grup
  group rename <lama> <baru>            rename LDAP + role OPA + permitted_groups StarRocks
  group add-member|remove-member <cn> <uid>
  group check                           cek roles == grup LDAP == permitted_groups
  group sync [--apply]                  selaraskan permitted_groups (+ saran grup hilang)
  user list [--service]                 daftar user LDAP (atau service account)
  user add <uid> [--cn <n>] [--mail <m>] [--password <p>] [--in <group>]
  user remove <uid>                     hapus user (ikut keluar dari semua grup)

Umum: --dry-run (di posisi mana pun) · --env-file <path> · -h/--help
EOF
}

# ── Ekstrak --dry-run dan --env-file dari posisi mana pun ────────────────────
ARGS=(); ENVFILE=""; prev=""
for a in "$@"; do
  if [[ "${prev}" == "--env-file" ]]; then ENVFILE="${a}"; prev=""; continue; fi
  case "${a}" in
    --dry-run)  export SICABE_AUTHZ_DRY_RUN=1 ;;
    --env-file) prev="--env-file" ;;
    *)          ARGS+=("${a}") ;;
  esac
done
[[ -n "${ENVFILE}" ]] && export SICABE_ENV_FILE="${ENVFILE}"
set -- ${ARGS[@]+"${ARGS[@]}"}

[[ $# -eq 0 || "${1}" == "-h" || "${1}" == "--help" || "${1}" == "help" ]] && { usage; exit 0; }

# Muat .env (LDAP_* dsb). --env-file sudah diteruskan via SICABE_ENV_FILE.
sicabe_load_env "${SCRIPT_DIR}"

# ── reload: recreate container OPA agar memuat policy+data terbaru ───────────
reload_opa() {
  if ! command -v docker >/dev/null 2>&1; then
    echo -e "${WARN} docker tak tersedia — lewati reload OPA."
    return 0
  fi
  if ! docker ps --format '{{.Names}}' | grep -qx "${OPA_CONTAINER}"; then
    echo -e "${WARN} container ${OPA_CONTAINER} tidak berjalan di host ini."
    echo -e "${INFO} Jalankan 'sicabe-authz reload' DI HOST OPA, atau sinkronkan dulu (--sync)."
    return 0
  fi
  echo -e "${INFO} recreate container ${OPA_CONTAINER} (muat ulang policy + data)..."
  ( cd "${SCRIPT_DIR}" && docker compose --profile all up -d --force-recreate opa >/dev/null )
  echo -e "${OK} OPA dimuat ulang."
}

case "${1}" in
  apply)
    shift
    NO_RELOAD=0
    for a in "$@"; do [[ "${a}" == "--no-reload" ]] && NO_RELOAD=1; done
    python3 "${PY}" render
    [[ "${NO_RELOAD}" == "1" ]] || reload_opa
    ;;
  reload)
    reload_opa
    ;;
  *)
    python3 "${PY}" "$@"
    ;;
esac