From d2731cc38452be5f168542fd136afbfad8168b51 Mon Sep 17 00:00:00 2001
From: devfoma <faithamarachi860@gmail.com>
Date: Tue, 1 Sep 2026 15:31:26 +0100
Subject: [PATCH] Add security tests for unauthorized access to all admin
 functions

Resolves #290
Unauthorized access prevention tests for:
- Mint, pause, grant/revoke role
- Add/remove admin, execute/upgrade multisig
- Set transfer restriction, whitelist, snapshot
- Set max supply, upgrade, transfer admin
- Set admin transfer delay, progress tracker
---
 tests/integration/security_auth_tests.rs | 126 ++++++++++++++++++++++-
 1 file changed, 124 insertions(+), 2 deletions(-)

diff --git a/tests/integration/security_auth_tests.rs b/tests/integration/security_auth_tests.rs
index 6907835..53d286c 100644
--- a/tests/integration/security_auth_tests.rs
+++ b/tests/integration/security_auth_tests.rs
@@ -2,7 +2,7 @@
 
 use learn_token::{AdminRole, LearnTokenClient};
 use progress_tracker::ProgressTracker;
-use soroban_sdk::{testutils::Address as _, Address, Env, String as SorobanString};
+use soroban_sdk::{testutils::Address as _, Address, Env, String as SorobanString, Symbol, BytesN};
 
 fn setup_env(env: &Env) -> (Address, LearnTokenClient<'static>) {
     let admin = Address::generate(env);
@@ -28,7 +28,6 @@ fn test_unauthorized_mint() {
     let (_, client) = setup_env(&env);
     let malicious = Address::generate(&env);
     let recipient = Address::generate(&env);
-    // This will panic because we didn't mock auths for 'malicious'
     client.mint(&malicious, &recipient, &1000);
 }
 
@@ -50,3 +49,126 @@ fn test_unauthorized_grant_role() {
     let new_admin = Address::generate(&env);
     client.grant_role(&malicious, &new_admin, &AdminRole::Admin);
 }
+
+#[test]
+#[should_panic]
+fn test_unauthorized_revoke_role() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    let existing_admin = Address::generate(&env);
+    client.revoke_role(&malicious, &existing_admin, &AdminRole::Admin);
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_add_admin() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    let new_admin = Address::generate(&env);
+    let admin_info = learn_token::AdminInfo {
+        address: new_admin,
+        role: AdminRole::Admin,
+    };
+    client.add_admin(&malicious, &admin_info);
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_remove_admin() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    let admin_to_remove = Address::generate(&env);
+    let admin_info = learn_token::AdminInfo {
+        address: admin_to_remove,
+        role: AdminRole::Admin,
+    };
+    client.remove_admin(&malicious, &admin_info);
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_execute_multisig() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    let co_signer = Address::generate(&env);
+    client.execute_multisig_op(&malicious, &co_signer, &Symbol::new(env, "test"));
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_upgrade_multisig() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    let co_signer = Address::generate(&env);
+    client.upgrade_multisig(&malicious, &co_signer, &BytesN::from_array(env, &[0; 32]));
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_pause_unpaused() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    client.unpause(&malicious);
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_set_max_supply() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    client.set_max_supply(&10000);
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_upgrade() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    client.upgrade(&BytesN::from_array(env, &[0; 32]));
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_transfer_admin() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    let new_admin = Address::generate(&env);
+    client.transfer_admin(&new_admin);
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_cancel_admin_transfer() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    client.cancel_admin_transfer();
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_set_admin_transfer_delay() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    client.set_admin_transfer_delay(&60);
+}
+
+#[test]
+#[should_panic]
+fn test_unauthorized_set_progress_tracker() {
+    let env = Env::default();
+    let (_, client) = setup_env(&env);
+    let malicious = Address::generate(&env);
+    let new_tracker = Address::generate(&env);
+    client.set_progress_tracker(&new_tracker);
+}
\ No newline at end of file