fix: pre-authorize allocate and accept invocations to storage nodes

[alanshaw]

This is part of reverting the change to send allocate and accept delegations from the client. We decided this should in fact be made with the storage provider as the subject and that the upload service should be pre-authorized by the storage provider to invoke.

This PR:

• Updates the storage provider store to store proofs per provider.
• Adds a proofs arg to the sprue admin provider register CLI command.
• Uses proofs from the store instead of the invocation when invoking /blob/allocate or /blob/accept.
• Adds some additional validation to the provider registration handler to ensure required proofs are provided.

Depends on:

• fix: add space to allocate and accept args libforge#38

[Copilot]

Pull request overview

This PR shifts /blob/allocate and /blob/accept authorization to be rooted at the storage provider, with the upload service using pre-authorized UCAN proofs stored per provider (rather than passing proofs through invocation metadata).

Changes:

• Extend storage provider records/stores to persist provider-scoped UCAN proof containers and thread them through routing.
• Update allocate/accept flows (blob add + HTTP PUT conclude) to source proofs from the provider record when invoking storage nodes.
• Add a proofs argument to provider registration (capability types, client API, and CLI), plus tests.

Reviewed changes

Copilot reviewed 25 out of 28 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/store/storage_provider/storage_provider.go	Adds Proofs to provider record and updates store interface to require proofs on Put.
pkg/store/storage_provider/storage_provider_test.go	Updates store conformance tests to include proof round-tripping and missing-proofs behavior.
pkg/store/storage_provider/postgres/store.go	Persists proofs in Postgres (encode/decode container) and includes it in scan/list/get.
pkg/store/storage_provider/memory/store.go	Stores proofs in-memory and enforces non-nil proofs on Put.
pkg/store/storage_provider/aws/store.go	Stores proofs in DynamoDB and decodes on read.
pkg/service/handlers/ucan_conclude_http_put.go	Uses provider-record proofs (via routing) instead of conclude metadata; extracts space from allocate args.
pkg/service/handlers/ucan_conclude_http_put_test.go	Updates conclude flow tests for new allocate subject + args space + provider-stored proofs.
pkg/service/handlers/blob_add.go	Sources proofs from selected provider record when calling allocate/accept (instead of request metadata).
pkg/service/handlers/blob_add_test.go	Updates blob add tests to register provider proofs in store and removes forwarding proofs via request metadata.
pkg/service/handlers/admin_provider_weight_set.go	Preserves existing proofs when updating provider weights.
pkg/service/handlers/admin_provider_weight_set_test.go	Updates tests for new Put signature requiring proofs.
pkg/service/handlers/admin_provider_register.go	Decodes and stores proofs at provider registration time.
pkg/service/handlers/admin_provider_register_test.go	Updates tests to supply proofs bytes in register arguments.
pkg/service/handlers/admin_provider_list_test.go	Updates list tests to satisfy new Put signature with proofs.
pkg/service/handlers/admin_provider_deregister_test.go	Updates deregister tests to satisfy new Put signature with proofs.
pkg/routing/service.go	Threads stored proofs through StorageProviderInfo.
pkg/routing/service_test.go	Updates routing tests to satisfy new Put signature with proofs.
pkg/piriclient/client.go	Changes allocate/accept proof-chain root + invocation subject to provider DID; space moved into args.
pkg/commands/admin/provider/types.go	Adds Proofs []byte to register arguments.
pkg/commands/admin/provider/json_gen.go	Regenerates DagJSON codec for register args including proofs.
pkg/commands/admin/provider/cbor_gen.go	Regenerates CBOR codec for register args including proofs.
pkg/client/client.go	Client API now requires proofs container for provider registration and encodes it into register args.
internal/migrations/sql/00001_init.sql	Adds proofs column to storage_provider table schema.
go.sum	Updates module sums for new libforge version.
go.mod	Bumps github.com/fil-forge/libforge dependency.
cmd/client/admin/provider/register.go	CLI now requires <proofs> (inline or file) and passes decoded container into client register call.

Files not reviewed (2)

• pkg/commands/admin/provider/cbor_gen.go: Generated file
• pkg/commands/admin/provider/json_gen.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.