neuro-san==0.6.32 Now with an Authorizer interface for per-user permissions #738

First, a clarification:

Note that authorization - the ability to determine permission to access a resource (in
Neuro SAN's case an agent network) - is not to be confused with authentication -
the ability to determine a user's identity.

Authentication/user identity verification, while an important part of any trusted system,
is not a core responsibility for incoming requests to a Neuro SAN server.

Most often a Neuro SAN server is a single component in a larger cluster deployment where
authentication is handled upon any request entering the cluster.
Consider a chat with your friendly neighborhood dev-ops professional if what you are
really interested in is authentication for your server.

This all said, we now have a way to set via env var an AGENT_AUTHORIZER
When not set (the default) the server uses an implementation for the Authorizer
that effectively lets all requests for all users through, just like it has been doing all long.

We offer the following implementations:

• neuro_san.internals.authorization.null.always_yes_authorizer.AlwaysYesAuthorizer (default)
• neuro_san.internals.authorization.null.always_no_authorizer.AlwaysNoAuthorizer
• neuro_san.internals.authorization.openfga.open_fga_authorizer.OpenFgaAuthorizer

Feel free to make your own as long as it derives from this interface:

• neuro_san.internals.authorization.interfaces.authorizer.Authorizer

See more configurable env vars in the Dockerfile documentation here:
https://github.com/cognizant-ai-lab/neuro-san/blob/main/neuro_san/deploy/Dockerfile#L302

The Authorizer interface was put together from our team's experience with other large-scale projects.
We feel it should be enough to allow any ReBAC (Relations-Based Access Control), which tends to be
a superset of just about any other authorization scheme. We know, for instance, that the interface
supports what we need it to do with both OpenFGA and Oso.

Coming soon: an example for OpenFGA in neuro-san-studio.