Entitlement inference in entitlement migration grants too many entitlements

[j1010001]

Discord thread

context:

• Entitlement migration pulls all entitlements that a migrated type needs
• Disjunction access (e.g function needs access(Owner | Deposit)) is translated to conjunction authorization (auth(Owner, Deposit))

This is high priority, because we want to migrate capabilities with as few entitlements as possible, to minimize the chances of the migration causing safety issues for the migrated contracts. It is difficult to determine subset of entitlements actually needed.

• Potential solutions:
  • Improve entitlement inference in entitlement migration in general
  • Don't include Owner entitlement in NFT. But other developers' contracts might have similar problem
  • Special case NFT in entitlements migration. But other developers' contracts might have similar problem

Impact: NFTs, majority of contracts

[turbolent]

Been working on an idea to improve this on the side, will push up a PoC soon.

[turbolent]

In any case we should improve the migration guide. Opened #3268

[turbolent]

Keeping this open to wait for feedback on real-world contracts