# =============================================================================
# SiCABE — Model Authorization (SUMBER KEBENARAN) — OPA / Trino
# -----------------------------------------------------------------------------
# Berkas ini SATU-SATUNYA sumber kebenaran ACL. JANGAN mengedit
# config/opa/data.json manual — itu HASIL RENDER:
#     ./scripts/sicabe-authz render        # authz.yml -> data.json
#     ./scripts/sicabe-authz apply         # render + reload OPA
#     ./scripts/sicabe-authz fmt           # rapikan format berkas ini
# Policy Rego membaca data.authz.catalogs / data.authz.write_schemas — nama
# catalog/schema TIDAK di-hardcode di Rego. Ganti nama catalog = ubah `catalogs:`
# di sini -> render -> reload. Dokumentasi: docs/authorization-cli.md
# =============================================================================
version: 1
catalogs: [iceberg]
schemas: [bronze, silver, gold]
roles:
  data-admin: {superuser: true}
  data-engineer:
    grants:
    - table: bronze.orders
      caps: [select, write, ddl]
      columns: '*'
    - table: bronze.orders_incremental
      caps: [select, write, ddl]
      columns: '*'
    - table: silver.orders_silver
      caps: [select, write, ddl]
      columns: '*'
    - table: gold.orders_gold
      caps: [select, write, ddl]
      columns: '*'
  data-catalog:
    grants:
    - table: bronze.orders
      caps: [select]
      columns: '*'
    - table: bronze.orders_incremental
      caps: [select]
      columns: '*'
    - table: silver.orders_silver
      caps: [select]
      columns: '*'
    - table: silver.orders_clean
      caps: [select]
      columns: '*'
    - table: gold.orders_gold
      caps: [select]
      columns: '*'
  data-analyst:
    grants:
    - table: gold.orders_gold
      caps: [select]
      columns: '*'
    - table: silver.orders_silver
      caps: [select]
      columns: [id, total_value]
  data-viewer: {}
users: {svc_dbt: data-engineer, svc_airflow: data-engineer, svc_seed: data-engineer, svc_om: data-catalog}