#!/usr/bin/env bash
# =============================================================================
# eBdesk SiCABE — sicabe-authz
# -----------------------------------------------------------------------------
# CLI pengelolaan AUTHORIZATION (OPA/Trino) berbasis model config/opa/authz.yml.
#
# Model authz.yml = SUMBER KEBENARAN. Perintah di sini mengedit model, lalu
# merender data ACL OPA (config/opa/data.json) dan (opsional) memuat ulang OPA.
# Logika model ada di lib/authz.py (Python + PyYAML).
#
# Pemakaian:
#   ./scripts/sicabe-authz list roles
#   ./scripts/sicabe-authz matrix [--schema bronze]
#   ./scripts/sicabe-authz show role data-engineer
#   ./scripts/sicabe-authz grant set data-analyst gold.orders_gold --caps select --columns id
#   ./scripts/sicabe-authz role add data-scientist
#   ./scripts/sicabe-authz user assign svc_dbt data-engineer
#   ./scripts/sicabe-authz catalog rename iceberg lakehouse
#   ./scripts/sicabe-authz render              # authz.yml -> data.json
#   ./scripts/sicabe-authz check               # pastikan data.json sinkron
#   ./scripts/sicabe-authz apply [--no-reload] # render + reload OPA
#   ./scripts/sicabe-authz reload              # recreate container OPA
#
#   --dry-run  (posisi mana pun) -> jangan tulis apa pun, hanya cetak rencana.
# =============================================================================
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=../lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh" 2>/dev/null || true

OPA_CONTAINER="${OPA_CONTAINER_NAME:-sicabe-opa}"

usage() {
  sed -n '3,27p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
}

# ── Ambil --dry-run dari posisi mana pun ─────────────────────────────────────
ARGS=()
for a in "$@"; do
  if [[ "${a}" == "--dry-run" ]]; then
    export SICABE_AUTHZ_DRY_RUN=1
  else
    ARGS+=("${a}")
  fi
done
set -- ${ARGS[@]+"${ARGS[@]}"}

[[ $# -eq 0 || "${1}" == "-h" || "${1}" == "--help" || "${1}" == "help" ]] && { usage; exit 0; }

PY="${SCRIPT_DIR}/lib/authz.py"

# ── reload: recreate container OPA agar memuat policy+data terbaru ───────────
reload_opa() {
  if ! command -v docker >/dev/null 2>&1; then
    echo -e "${WARN} docker tak tersedia — lewati reload OPA."
    return 0
  fi
  if ! docker ps --format '{{.Names}}' | grep -qx "${OPA_CONTAINER}"; then
    echo -e "${WARN} container ${OPA_CONTAINER} tidak berjalan di host ini."
    echo -e "${INFO} Jalankan 'sicabe-authz reload' DI HOST OPA, atau sinkronkan dulu (--sync)."
    return 0
  fi
  echo -e "${INFO} recreate container ${OPA_CONTAINER} (muat ulang policy + data)..."
  ( cd "${SCRIPT_DIR}" && docker compose --profile all up -d --force-recreate opa >/dev/null )
  echo -e "${OK} OPA dimuat ulang."
}

case "${1}" in
  apply)
    shift
    NO_RELOAD=0
    for a in "$@"; do [[ "${a}" == "--no-reload" ]] && NO_RELOAD=1; done
    python3 "${PY}" render
    [[ "${NO_RELOAD}" == "1" ]] || reload_opa
    ;;
  reload)
    reload_opa
    ;;
  *)
    python3 "${PY}" "$@"
    ;;
esac