support open policy agent

[ripienaar]

We should spike supporting OPA, the userlist might embed a rego policy into the JWT and the actionlist would evaluate the policy.

A sample policy might look like this:

package choria.aaa.policy

default allow = false

# user can deploy only frontend of myco into production but only in malta
allow {
	input.action == "deploy"
	input.agent == "myco"
	input.data.component == "frontend"
	requires_fact_filter("country=mt")
	input.collective == "production"
}

# can ask status anywhere in any environment but not unfiltered
allow {
	input.action == "status"
	input.agent == "myco"
        count(input.filter.fact) > 0
}

# user can do anything myco related in development
allow {
	input.agent == "myco"
	input.collective == "development"
}

this shows the user having access to all the various parts of a request - nothing about nodes as this is in the context of the signer - so just what is in the request.

Things we couldnt do before:

• authz on collective
• authz on filters being supplied or not
• authz on very specific filters
• authz on the inputs sent to the agent