Admin tests bypass authorization via mock_all_auths (auth regressions invisible to CI)

[0xdevcollins]

Severity: MEDIUM · Tests · boundless-events + boundless-profile

Surfaced by the Almanax scan of e1f17937. Closes Admin tests bypass authorization via mock_all_auths.

Files

• contracts/events/src/tests/* admin suites (and the profile equivalents) using env.mock_all_auths() in setup()

Problem

With mock_all_auths(), deleting require_admin() from any privileged entrypoint (apply_upgrade, set_fee_account, pause/unpause, migrate, …) would not fail CI — an access-control regression could ship undetected. This is high leverage: a third-party audit is the P0 blocker in BACKLOG.md, so the auth controls should be proven in the test suite first.

Fix

• For privileged-path tests, use env.mock_auths(&[...]) with the exact expected (address, fn, args) and/or assert against env.auths().
• Add negative tests: a non-admin caller must receive an auth error for each privileged entrypoint.

Tests

• The new negative tests are the deliverable.
• Existing positive tests stay green under the tighter mocks.

[coderabbitai]

🔗 Related PRs

#46 - test: hackathon pillar — select_winners distribution + claim [merged]
#47 - test(events): added bounty pillar — apply / withdraw_application + c… [merged]
#48 - test(profile): add credits.rs coverage for spend/earn/refund/admin_grant [merged]
#51 - test(profile): earnings register — full coverage [merged]
#54 - test(coverage): add 9 test modules for contract test coverage push [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[Sendi0011]

Gm Team, can i work on this? I am a fullstack/Smartcontract developer with years of experience working on issues like this, and as a contributor to boundless, i assure a good job for this issue

I will approach this by:

1. Auditing all admin test suites in contracts/events/src/tests/* and the boundless-profile equivalents to find every test currently using env.mock_all_auths() in setup() for privileged entrypoints (apply_upgrade, set_fee_account, pause/unpause, migrate, etc.).
2. Replace mock_all_auths() in those privileged-path tests with env.mock_auths(&[...]), specifying the exact expected (address, fn, args) for each call, so the test only passes if the correct admin actually authorized that specific invocation.
3. Add assertions against env.auths() after each privileged call to confirm the auth was actually required and captured, not just implicitly allowed.
4. Add negative tests for each privileged entrypoint: call it with a non-admin address and assert it returns/panics with an auth error, so a deleted require_admin() would fail CI immediately.
5. Run the full existing suite to confirm all current positive tests still pass under the tighter mocks, adjusting any tests that were relying on mock_all_auths() incidentally rather than intentionally.
6. Keep the change scoped to test files only, no changes to contract logic, unless a genuine gap is found while tightening the tests (in which case I'll flag it separately rather than bundling it in).

I'll keep the diff scoped to the test suites, no unrelated refactors.

ETA: 12 hours

[grantfox-oss]

🦊 GrantFox — @Sendi0011 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #73)
2. Your PR will be reviewed by the boundlessfi maintainers

Good luck! Track your progress on GrantFox.