feat: Add OpenID AuthZEN integration for fine-grained authorization (v1)

[RazcoDev]

AuthZEN Integration v1 - Fine-Grained Authorization for SLIM

📖 Proposal

This PR implements iteration 1 of OpenID AuthZEN integration into SLIM, providing standards-based policy enforcement for agent operations beyond simple JWT claims.

🎯 Problem Statement

SLIM currently uses JWT-based authentication but lacks fine-grained authorization capabilities for:

• Cross-organization communication policies
• Message size limits and content filtering
• Dynamic permission management
• Centralized policy administration
• Standards-based policy decision points (PDPs)

🚀 Solution Overview

Complete AuthZEN v1 implementation providing policy-driven authorization for all SLIM operations:

Core Components Added

1. AuthZEN Client (data-plane/core/auth/src/authzen.rs)

• ✅ Full OpenID AuthZEN v1 API compliance
• ✅ HTTP client for PDP communication
• ✅ Authorization decision caching (TTL-based)
• ✅ Fallback policies for PDP unavailability
• ✅ Retry logic and error handling
• ✅ Batch evaluation foundation

2. SLIM Service Integration (data-plane/core/service/src/authzen_integration.rs)

• ✅ AuthZenService wrapper for seamless integration
• ✅ SLIM → AuthZEN entity conversions:
  • Agent → AuthZenSubject
  • AgentType → AuthZenResource
• ✅ Authorization methods:
  • authorize_route() - Agent-to-agent route establishment
  • authorize_publish() - Message publishing with metadata
  • authorize_subscribe() - Subscription permissions
• ✅ Configurable PDP endpoints and policies
• ✅ Graceful degradation when AuthZEN unavailable

3. Comprehensive Demo (data-plane/examples/src/authzen-demo/)

• ✅ Complete working example with CLI options
• ✅ Real-world authorization scenarios:
  • Same-org vs cross-org communication
  • Message size limit enforcement
  • Route creation permissions
  • Subscription access controls
• ✅ Performance testing with caching
• ✅ Detailed logging and error scenarios

📊 Technical Details

Dependencies Added:

chrono = "0.4"        # Timestamp generation
reqwest = "0.12"      # HTTP client for PDP  
serde_json = "1.0"    # AuthZEN serialization
tokio = { sync }      # Async cache management

Error Handling:

pub enum AuthError {
    NetworkError(String),
    AuthorizationError(String), 
    ParseError(String),
    FallbackAllow,  // Graceful degradation
}

Configuration:

pub struct AuthZenServiceConfig {
    pub enabled: bool,
    pub pdp_endpoint: String,
    pub timeout: Duration,
    pub cache_ttl: Duration,
    pub fallback_allow: bool,
    pub max_retries: u32,
}

🔧 Usage Example

// Configure AuthZEN integration
let authzen_service = AuthZenService::new(Some(AuthZenServiceConfig {
    enabled: true,
    pdp_endpoint: "http://pdp:8080".to_string(),
    fallback_allow: false,  // fail-closed
    timeout: Duration::from_secs(5),
    cache_ttl: Duration::from_secs(300),
    max_retries: 3,
}))?;

// Authorize operations
let route_allowed = authzen_service.authorize_route(
    &agent, &target_type, Some(connection_id)
).await?;

let publish_allowed = authzen_service.authorize_publish(
    &source_agent, &target_type, Some(target_id), Some(message_size)
).await?;

let subscribe_allowed = authzen_service.authorize_subscribe(
    &subscriber_agent, &source_type, Some(source_id)  
).await?;

🧪 Demo Application

Run the comprehensive demo:

# Basic demo with mock PDP
cargo run --bin authzen-demo

# With real AuthZEN PDP
cargo run --bin authzen-demo --pdp-endpoint http://your-pdp:8080

# Enable fallback policies
cargo run --bin authzen-demo --fallback-allow

# Disable AuthZEN (JWT-only mode)  
cargo run --bin authzen-demo --authzen-enabled false

Expected demo output: