Access control

[mhasself]

Draft for inspection. Right now you can:

• Change agents to require different access levels (1,2,3) for a each op.
• Specify the level2 and level3 access passwords as cmdline args to the instance.
• Pass passwords through manually from clients (as in c1 below).
• Have clients try to figure out what password to use based on a password config file and a requested access level (as in c2 below).

To demo, set up FakeDataAgent with additional argument:

    'arguments': [['--access-policy', 'override:fake-pw-2,fake-pw-3']]},

Consider these clients:

  c0 = ocs_client.OCSClient('faker4')
  c1 = ocs_client.OCSClient('faker4', privs='fake-pw-2')
  c2 = ocs_client.OCSClient('faker4', privs=2)

Try to start or stop delay_task on each ... :

   r = c.delay_task.start(delay=1)

The c0 should fail; c1 should work; c2 will raise an error because it can't find your ~/ocs-passwords.yaml file. Create it with just this inside:

- agent-class: FakeDataAgent
  password-2: fake-pw-2

It doesn't have to be at ~/ocs-passwords.yaml ... override with envvar OCS_PASSWORDS_FILE=whatever.yaml