test(admin): assert admin auth is actually required, not just mocked

[Sendi0011]

Summary

Closes #73

setup() in both contracts/events/src/tests/common.rs and
contracts/profile/src/tests/common.rs calls env.mock_all_auths(),
which approves any address's require_auth() unconditionally. The
existing admin-suite tests (admin.rs in both crates) only assert on
resulting contract state, never on which address was asked to
authorize. That means deleting require_admin() from a privileged
entrypoint (apply_upgrade, set_fee_account, pause/unpause,
migrate, set_admin, etc.) would not fail CI — the call would
succeed identically with or without the check.

Fix

Added a negative test per require_admin()-gated entrypoint in both
contracts/events/src/tests/admin.rs and
contracts/profile/src/tests/admin.rs. Each test calls
ctx.env.mock_auths(&[]) (empty auth set) immediately before invoking
the entrypoint via its try_* client method, then asserts the call
returns Err. If require_admin() is ever removed, the call stops
requesting authorization, the empty mock set is never violated, and
the call succeeds — turning the test red.

This mirrors the existing auth-rejection pattern already used
elsewhere in the codebase (profile/src/tests/reputation.rs,
profile/src/tests/earnings.rs), rather than introducing a new
convention.

Entrypoints covered

events: pause, unpause, set_admin, set_fee_bps,
set_fee_account, set_profile_contract, propose_upgrade,
apply_upgrade, cancel_pending_upgrade, migrate

profile: pause, unpause, set_admin, set_events_contract,
propose_events_contract, accept_events_contract,
cancel_pending_events_contract, propose_upgrade, apply_upgrade,
cancel_pending_upgrade, migrate

Testing

• cargo test -p boundless-events admin:: — all pass
• cargo test -p boundless-profile admin:: — all pass
• cargo test --workspace — full suite green
• Manually verified regression detection: temporarily removed
  require_admin(env)?; from pause() in
  contracts/events/src/admin.rs and confirmed
  pause_reverts_without_admin_auth failed as expected, then reverted.

Screenshot

Notes

• No contract logic changed — test-only PR.
• setup() in both common.rs files is left untouched
  (mock_all_auths() is still required for the existing happy-path
  tests); the new tests locally override the mock via
  mock_auths(&[]) only for the call under test.

Summary by CodeRabbit

• Tests
  • Added regression coverage ensuring admin-restricted operations require explicit authorization.
  • Extended checks to confirm unauthorized admin attempts are rejected across pause/unpause, admin/settings changes, contract management, upgrades (including timelock-gated apply), pending upgrade cancellation, and migration.
  • Added targeted validation that accept_admin enforces authorization specifically from the pending target address.
  • Added a test confirming admin_slash_reputation demands the admin’s authorization as recorded in the execution context.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b8c0a175-a323-4ff8-91b4-387a98ddfeb1

📥 Commits

Reviewing files that changed from the base of the PR and between 3f5526b and ed7174b.

📒 Files selected for processing (3)

• contracts/events/src/tests/admin.rs
• contracts/profile/src/tests/admin.rs
• contracts/profile/src/tests/reputation.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• contracts/profile/src/tests/admin.rs

---

📝 Walkthrough

Walkthrough

Admin test suites for the events and profile contracts now verify that privileged entrypoints reject missing authorization and require the correct admin or pending-target identity, including timelocked operations and reputation slashing.

Changes

Admin authorization regression guards

Layer / File(s)	Summary
Unauthorized admin entrypoint coverage contracts/events/src/tests/admin.rs, contracts/profile/src/tests/admin.rs	Adds negative tests with empty authorization mocks for admin-only operations, including pause, configuration, migration, contract changes, and timelocked upgrades.
Required authorization identity checks contracts/events/src/tests/admin.rs, contracts/profile/src/tests/admin.rs, contracts/profile/src/tests/reputation.rs	Verifies accept_admin requires the pending target’s authorization and admin_slash_reputation requires the configured admin’s authorization.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: 0xdevcollins

Poem

A rabbit guards the admin door,
No empty mock may pass anymore.
The right target must approve,
And slashing checks the admin’s proof.
Timelocks tick, the tests take flight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: strengthening tests to require real admin authorization instead of relying on mocked auth.
Linked Issues check	✅ Passed	The PR adds negative auth tests for privileged entrypoints in events and profile, including accept_admin and admin_slash_reputation, matching #73.
Out of Scope Changes check	✅ Passed	The changes stay within authorization test coverage and do not introduce unrelated code or behavior changes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[0xdevcollins]

@Sendi0011 Solid work the mechanism is verified correct and matches the issue's deliverable.
Before I merge please

1. Add the missing negative test for admin_slash_reputation
2. Add coverage for accept_admin in both contracts

[0xdevcollins]

Lastly, I can't merge your PR unless your commits is signed

[Sendi0011]

@Sendi0011 Solid work the mechanism is verified correct and matches the issue's deliverable. Before I merge please

1. Add the missing negative test for admin_slash_reputation
2. Add coverage for accept_admin in both contracts

Gm @0xdevcollins, thanks for the review! I've pushed changes for all three points:

For admin_slash_reputation — turns out admin_slash_rejects_non_admin_caller already covers this (it's been there since #60), so I didn't want to duplicate it exactly. Instead I added admin_slash_demands_admins_auth_specifically right next to it, which checks env.auths() to confirm the auth demanded is actually the admin's and not just any address mock_all_auths() happens to wave through. Figured that closes the gap you were pointing at either way.

For accept_admin — good catch, this one doesn't even go through require_admin(), it authorizes against the pending target address instead (pending.target.require_auth()). Added two tests for each contract:

• one that clears the mock auths entirely and confirms the call fails
• one that confirms the auth actually demanded belongs to the pending target specifically

Did the same for both events and profile since the logic is identical in both.

And commits should be signed now — set up SSH signing and rebased to sign everything on the branch.

Ran cargo test --workspace locally before pushing, everything's green (22 in events::admin, 26 in profile::admin, 25 in profile::reputation). Let me know if you want anything adjusted!