Store.get_resource ignores agent settings and always uses public

[AlexMikhalev]

It's not possible to replicate even a basic rust example without enabling public read access to all resources. Details with secrets in DM.

[joepio]

You can use client::fetch_resource to retrieve a resource with authentication.

If I use authentication for get_resource I need to carefully consider some of the security implications:

Since AtomicServer caches all received / fetched resources, there is a potential for data leakage when multiple users share the same store and one of them uses AtomicServer authorized. Imagine server A and B. Server A has private resources that server B tries to access. User X has the rights to resources on B, so X tries to do this through server B, and is granted access. User Y does not have read rights on B but can access A. Now we need to make sure that when user Y tries to access resources from A through server B, that B still refuses access. In principe, this should work just fine, because server B will perform the same authorization checks as A. However, if authorization data changes on server A, server B will need to update as well. We don't have a mechanism for this yet.

We could add a for_agent argument to get_resource, similar to how we have that in get_resource_extended.

We should change how Storelike::fetch_resource behaves. It currently defaults to using default_agent.

[joepio]

Store::get_resource should default to using the default_agent in client requests, thus authenticated.

So not sure what's going on here... But I do know that I want more refactoring and tests for fetching stuff with atomic_lib.