chore: use restricted access keys instead of full access keys for MPC nodes

[barakeinav1]

Summary

• Replace grant-full-access with grant-function-call-access in all scripts and docs that add node account keys
• Restricted keys can only call node-facing methods on the MPC contract:
  respond, respond_ckd, respond_verify_foreign_tx, vote_pk, start_keygen_instance, vote_reshared, vote_foreign_chain_policy, start_reshare_instance, vote_abort_key_event_instance, verify_tee, submit_participant_info, conclude_node_migration
• Allowance set to 1 NEAR

Files changed

Scripts (4):

• localnet/tee/scripts/rust-launcher/deploy-tee-localnet.sh
• localnet/tee/scripts/deploy-tee-localnet.sh
• deployment/testnet/scripts/scale-testnet-tee.sh
• scripts/launch-localnet.sh

Docs (3):

• docs/localnet/localnet.md
• docs/localnet/tee-localnet.md
• docs/testnet/setup-guide-for-testnet-with-tee-support.md

The method list was verified against crates/near-mpc-contract-interface/src/method_names.rs and the ChainSendTransactionRequest enum in crates/node/src/indexer/types.rs.

Closes #2543

Test plan

• Run localnet E2E TEE test with restricted keys
• Verify nodes can still sign, vote, and submit attestations

[claude]

PR title type suggestion: This PR changes only deployment scripts and documentation, so the type prefix should probably be chore: instead of fix:.

Suggested title: chore: use restricted access keys instead of full access keys for MPC nodes

[claude]

Code Review

Verified the method list against crates/near-mpc-contract-interface/src/method_names.rs and the ChainSendTransactionRequest enum in crates/node/src/indexer/types.rs — all 12 methods are present and no node-facing methods are missing.

Checked quoting across all scripts: the comma-separated method list contains no whitespace so word-splitting is not a concern, even in launch-localnet.sh where it passes through eval.

Good security improvement — replacing full-access keys with restricted function-call access keys limits blast radius if a node key is compromised.

✅ Approved — clean, consistent change across all scripts and docs.

[claude]

PR title type suggestion: This PR changes only deployment scripts and documentation, so the type prefix should probably be chore: instead of fix:.

Suggested title: chore: use restricted access keys instead of full access keys for MPC nodes

[Copilot]

Pull request overview

This PR updates localnet/testnet deployment scripts and documentation to add MPC node public keys as restricted function-call access keys (instead of full-access keys), limiting what node keys can do on the MPC contract and setting a 1 NEAR allowance.

Changes:

• Replace grant-full-access with grant-function-call-access for adding node signer/responder keys.
• Restrict allowed contract methods to the node-facing transaction methods (respond/vote/start/TEE/migration-related).
• Update localnet/testnet docs to reflect the restricted-key CLI commands.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/launch-localnet.sh	Adds node keys as function-call-only keys scoped to mpc-contract.test.near with 1 NEAR allowance.
localnet/tee/scripts/rust-launcher/deploy-tee-localnet.sh	Updates near_add_key_skip_if_exists to create restricted function-call keys for node signer/responder keys.
localnet/tee/scripts/deploy-tee-localnet.sh	Same restricted-key change for the non-rust-launcher localnet TEE deploy script.
deployment/testnet/scripts/scale-testnet-tee.sh	Same restricted-key change for scaling TEE nodes on testnet.
docs/localnet/localnet.md	Updates localnet instructions to add restricted function-call keys (with method allowlist).
docs/localnet/tee-localnet.md	Updates TEE localnet instructions to add restricted function-call keys (with method allowlist).
docs/testnet/setup-guide-for-testnet-with-tee-support.md	Updates testnet setup instructions to add restricted function-call keys (with method allowlist).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

NODE_METHODS is defined in the previous fenced code block, but the $SAM_ACCOUNT add-key commands are in a separate code block. If a reader copies only the SAM block, $NODE_METHODS will be undefined and near account add-key will fail. Consider either repeating the NODE_METHODS=... line in the second block or merging both Frodo/Sam commands into a single code block.

[barakeinav1]

fixed