Set up access policies and a system client

🧠 Overview
This notebook sets up access policies and a system client (sdk-client) to securely interact with the Aidbox FHIR server via the Aidbox NodeJS SDK.

It uses the matcho engine, a powerful pattern-based access control system that evaluates each request context (e.g., user, client, resource, method) and allows or denies access based on logical conditions.

🔍 What is matcho?
The matcho engine in Aidbox is a declarative access policy engine that matches conditions like:

Who is making the request (user or client)

What resource they’re trying to access (resource)

What operation is being requested (request-method)

If all conditions match, access is granted.

✅ Access Policy: Allow admin to Manage Client Resources

This request creates an `AccessPolicy` using the `matcho` engine that allows the user `admin` to perform full CRUD operations on `Client` resources. This is required to let the admin create new clients such as the SDK client from within the Aidbox UI or REST API.

PUT /AccessPolicy/allow-admin-client-management
accept: application/json
content-type: application/json

{
  "resourceType": "AccessPolicy",
  "id": "allow-admin-client-management",
  "description": "Allow admin user to manage Client resources for SDK use",
  "engine": "matcho",
  "matcho": {
    "user": {
      "id": "admin"
    },
    "resource": {
      "resourceType": "Client"
    }
  }
}

{
  "engine": "matcho",
  "matcho": {
    "user": {
      "id": "admin"
    },
    "resource": {
      "resourceType": "Client"
    }
  },
  "description": "Allow admin user to manage Client resources for SDK use",
  "id": "allow-admin-client-management",
  "resourceType": "AccessPolicy",
  "meta": {
    "lastUpdated": "2025-04-05T23:15:14.391663Z",
    "createdAt": "2025-04-05T23:08:50.895545Z",
    "versionId": "89"
  }
}

GET /AccessPolicy/allow-admin-client-management

content-type: application/json 
accept: application/json

{
  "engine": "matcho",
  "matcho": {
    "user": {
      "id": "admin"
    },
    "resource": {
      "resourceType": "Client"
    }
  },
  "description": "Allow admin user to manage Client resources for SDK use",
  "id": "allow-admin-client-management",
  "resourceType": "AccessPolicy",
  "meta": {
    "lastUpdated": "2025-04-05T23:15:14.391663Z",
    "createdAt": "2025-04-05T23:08:50.895545Z",
    "versionId": "89"
  }
}

PUT /Client/sdk-client
accept: application/json
content-type: application/json

{
  "resourceType": "Client",
  "id": "sdk-client",
  "secret": "Pertexa#xx9",
  "grant_types": ["basic"],
  "name": "My SDK Client"
}

{
  "name": "My SDK Client",
  "secret": "__sha256:8D811AE0DAFF4C671A88E2714DD5B6B355887152C34658D08F46AC4177E192B6",
  "grant_types": [
    "basic"
  ],
  "id": "sdk-client",
  "resourceType": "Client",
  "meta": {
    "lastUpdated": "2025-04-05T23:23:36.076482Z",
    "createdAt": "2025-04-05T23:23:36.076482Z",
    "versionId": "101"
  }
}