refactor(permissions): collapse to one authorized set, drop install args

[lwshang]

Summary

Simplifies the canister's permission model down to two rules and removes the install-time arguments that configured it.

Permission model (14d6ac2)

Replaces the three-level model (Commit/Prepare/ManagePermissions) with:

• Controllers can do anything.
• A single authorized set of non-controller principals may sync assets; only controllers can change it. Controllers are always allowed without being stored.

Canister changes:

• Drop the Permission enum and grant_permission/revoke_permission/list_permitted/take_ownership; keep authorize/deauthorize/list_authorized.
• Collapse the can_commit/can_prepare guards into one guard_can_sync; set management is guarded by guard_is_controller.
• Add a can_sync query so a caller can check its own access up front.
• Drop the legacy StableStatePermissions blob; stable state stores one authorized set.

Sync plugin:

• ensure_can_sync runs before any scan/diff and uses can_sync, so an unauthorized run fails fast. Proxy mode grants via the proxy; direct mode errors. Controllers are no longer falsely blocked.

Drop install args (3cf7f7c)

Removes AssetCanisterArgs/InitArgs/UpgradeArgs entirely. The canister now installs with no args; the authorized set is managed exclusively through the controller-guarded authorize/deauthorize endpoints.

• init() clears state; post_upgrade(stable_state) restores it untouched.
• Drop the Init-vs-Upgrade trap branches and State::set_authorized (which only existed to apply the args).
• Service signature becomes service: () -> {.

Testing

• cargo test -p canister-core — passes
• cargo test -p sync-core — passes
• candid_interface_compatibility — exported interface matches assets.did
• cargo test -p e2e — full suite passes (live deploy with no install args)
• cargo clippy — clean

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Refactors the assets canister permission model into a single controller-managed “authorized” set (with controllers always implicitly allowed) and removes install/upgrade-time args from the canister interface. Sync tooling is updated to preflight authorization via a new can_sync query and to authorize via proxy when available.

Changes:

• Replace multi-level permissions with a single authorized set + controller-only management; add can_sync query for preflight checks.
• Update sync-core to fail fast using can_sync, and to authorize via proxy mode when needed.
• Remove install/upgrade args from the canister’s candid and Rust entrypoints; simplify stable state to store only the authorized set.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/sync-core/tests/bench_sync.rs	Updates bench mock to support the new can_sync preflight call.
crates/sync-core/src/sync.rs	Adds ensure_can_sync fast-fail authorization preflight + proxy authorization path; updates tests accordingly.
crates/sync-core/src/canister.rs	Removes legacy permission call wrappers; adds can_sync and authorize_via_proxy wrappers.
crates/canister/src/lib.rs	Drops init/upgrade args, replaces guards with guard_can_sync/guard_is_controller, and exposes can_sync query.
crates/canister/assets.did	Removes legacy permission and install-arg types; updates service signature to service: () -> { ... } and adds can_sync.
crates/canister-core/src/types.rs	Removes legacy permission/install-arg wire types from the core types module.
crates/canister-core/src/tests.rs	Updates stable-state construction and adds tests for authorize/deauthorize + stable roundtrip of the authorized set.
crates/canister-core/src/state.rs	Replaces per-permission principal sets with a single authorized set and updates stable-state restoration accordingly.
crates/canister-core/src/stable.rs	Simplifies stable state to persist only the authorized set (drops legacy permissions blob).
crates/canister-core/src/lib.rs	Implements new authorization API (authorize/deauthorize/can_sync) and new guards; removes install arg handling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.