Gate account linking behind pragma

[turbolent]

Issue to be solved

Currently, the account capabilities / linking feature is gated behind a configuration option of the checker. This option is constantly enabled by FVM on all networks but Mainnet.

Sentiment on the account capabilities FLIP has been positive, but there has also been a lot of feedback, requesting additional safe guards to make abuse of the feature harder.

A long term solution is being discussed in https://forum.onflow.org/t/super-user-account/4088. However, it will likely only be released with Stable Cadence.

As we would like to not block the release of the feature until the release of Stable Cadence, we need a temporary solution.

Suggested Solution

Introduce a new #allowAccountLinking pragma.

In the Cadence implementation, when the type checker encounters the pragma, enable the account linking feature.

This solution is both simple to add and remove, once migrating to the long-term solution.

It also allows wallets to detect relatively easily if the account linking feature is used in a transaction, and potentially prevent it.

[bluesign]

this seems like a great solution actually. One minor suggestion, can we force this to be declared on the top of the transaction? This way even wallets does not support (warning etc), user can see easily.

[jacob-tucker]

I also really like this solution. And totally agree with @bluesign - this should be required at the top of the transaction

[sisyphusSmiling]

This is great to see! Thanks for moving quickly on this feature.

Question on the full scope of coverage for this feature - it's clear that account linking would be gated, but would accessing an existing AuthAccount Capability also be gated behind the pragma? More concretely, once I've linked my account at myAccount.linkAccount(/private/MyAccountCap) with a gated transaction, could another un-gated transaction simply call myAccount.getCapability<&AuthAccount>(/private/MyAccountCap) without requiring the pragma?

[turbolent]

@sisyphusSmiling Correct, the pragma is purely for allowing the linking, it has no influence on the use of the link.