Provide an entrypoint for a smart server authentication plugin

I've been looking into ways to do simple authentication for the smart server, I've been modelling my approach on gitosis (http://eagain.net/gitweb/?p=gitosis.git), which does have a few-years-old bazaar equivalent - bazitis (https://launchpad.net/bazitis). The general idea with these is to use a single unix user on the server, and a different command string for each public key - which passes a username in via argv.

The approach taken by bazitis to restrict access to individual directories (and thus branches) on the remote server is to replace the file:/// transport, and then authenticate against its config file. This seems unnecessarily complex. The reason it's done this way, is because when accessing over bzr+ssh, the SSH_ORIGINAL_COMMAND is always `bzr serve` with --directory=/, any information about the paths or actions is sent over the medium, not on initialisation.

What i'm looking for, is a neat way to drop a hook/authentication function into the smart server transport, which can then do whatever is needed.

I've done a rather hacky approach with a small plugin, that i'll put up somewhere once i've tidied it up a bit; the approach taken is thus:

1) ssh command wrapper sets environment variable BZR_AUTH_USER, then runs serve (it also restricts the root directory to a repositories directory).
2) a plugin monkeypatches the `bzrlib.smart.request.SmartServerRequest.translate_client_path` function, to run the path past a whitelist.
3) the whitelist checks the path/username combo and raises a PermissionDenied error if needed.

This actually works relatively neatly - but the monkeypatch isn't particularly pretty - especially as translate_client_path is called multiple times per operation.

Hope this explanation is clear enough.