feat: Implement access pass management commands and global state authority updates

[juan-malbeclabs]

The most important changes include adding Access Pass management commands, restructuring device and global config commands for better authority and interface management, and introducing new link acceptance functionality. These updates enhance the flexibility and extensibility of the CLI tools, making them easier to use and maintain.

The Access Pass will be implemented without being used for validation in order to test the development, and later it will be integrated with user validation.

New CLI Features

• Access Pass Management: Added new accesspass CLI module and commands (Set, List) to both client/doublezero and controlplane/doublezero-admin, allowing users to manage access passes directly from the CLI. [1] [2] [3] [4] [5]

Global Configuration Improvements

• Authority Subcommands: Added authority management under global config, with new subcommands for setting and getting the global configuration authority. [1] [2] [3] [4] [5]

Test and Utility Updates

• Test Client Setup: Updated test utilities to initialize allowlists and authority keys with a unique payer, improving test coverage and reliability. [1] [2]

Testing Verification

• test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.47s

[Copilot]

Pull Request Overview

This PR implements a comprehensive access pass management system and global state authority updates for the DoubleZero CLI tools. The changes introduce new access pass functionality, restructure device and global config commands for better authority management, and establish a more flexible authentication system.

• Adds Access Pass management commands (Set, List) to both client and admin CLI tools with support for prepaid/postpaid types
• Introduces global state authority management with separate activator and access authorities replacing foundation allowlist checks
• Updates test utilities to properly initialize authority keys with unique payers for improved test coverage

Reviewed Changes

Copilot reviewed 75 out of 75 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
smartcontract/test/start-test.sh	Adds authority configuration and access pass creation commands to test setup
smartcontract/sdk/rs/src/tests.rs	Updates test utilities to initialize authority keys with unique payers
smartcontract/programs/doublezero-serviceability/src/state/globalstate.rs	Adds activator_authority_pk and access_authority_pk fields to GlobalState
smartcontract/programs/doublezero-serviceability/src/state/accesspass.rs	Implements new AccessPass state with type, status, and payment tracking
smartcontract/programs/doublezero-serviceability/src/processors/globalstate/setauthority.rs	Adds processor for setting global state authorities
smartcontract/programs/doublezero-serviceability/src/processors/accesspass/setaccesspass.rs	Implements access pass creation and update functionality
smartcontract/cli/src/globalconfig/authority/set.rs	Adds CLI command for setting global configuration authorities
smartcontract/cli/src/accesspass/set.rs	Implements CLI command for setting access passes
controlplane/doublezero-admin/src/main.rs	Integrates new access pass and authority commands into admin CLI
client/doublezero/src/main.rs	Integrates new access pass and authority commands into client CLI

Comments suppressed due to low confidence (1)

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[jeffgrunewald]

is the intent for the activator to validate a pass PDA by reconstructing the pubkey and seed for the AccessPass from the connecting client's IP address and ensure it matches the one in the pass account? otherwise what's to stop a connecting client from submitting any valid account on behalf of a host at a given IP address without ensuring the client is indeed connecting from the IP address that got authorized and encoded in the access pass?

[juan-malbeclabs]

@jeffgrunewald

Access control is handled in the create user instruction.

The idea is that the User.Create instruction receives the AccessPass account corresponding to the IP to be connected. If it has been previously created, it will validate the epoch; if not, it will reject the connection.

[karl-dz]

Left a few comments