update

README.md

@@ -78,3 +78,4 @@ MIT
 
 Explorer: `https://stellar.expert/explorer/testnet/contract/CDD5WKK3WT3QVKXMXTJNDIXE4T73FK6GGXDSD6UTJAH6YYZU52SQ4MUH`
 - Update README with latest progress
+

contracts/milestone-escrow/src/admin_override_cancel_tests.rs

@@ -16,9 +16,12 @@
 //!   - Error::InvalidAmount is returned (not a panic) for edge-case amounts.
 //!   - Terminal milestones are correctly skipped in every scenario.
 
+#![cfg(test)]
+
 use super::*;
+use crate::test::setup_funded_escrow;
 use crate::{DataKey, Error, MilestoneEscrowClient, MilestoneStatus};
-use soroban_sdk::{token, vec, Address, Env};
+use soroban_sdk::{testutils::Address as _, token, vec, Address, Env};
 
 // ────────────────────────────────────────────────────────────────────────────
 // Issue #383: admin_override_cancel_release storage footprint
@@ -118,8 +121,7 @@ fn test_cancel_release_requires_cancel_lock() {
     let env = Env::default();
     env.mock_all_auths();
 
-    let (_, _, _, admin_addr, _, _, client) =
-        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+    let (_, _, _, admin_addr, _, _, client) = setup_funded_escrow(&env, vec![&env, 1_000_i128]);
 
     let result = client.try_admin_override_cancel_release(&admin_addr);
     assert_eq!(result, Err(Ok(Error::InvalidStatus)));
@@ -131,8 +133,7 @@ fn test_cancel_release_unauthorized_caller_rejected() {
     let env = Env::default();
     env.mock_all_auths();
 
-    let (client_addr, _, _, _, _, _, client) =
-        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+    let (client_addr, _, _, _, _, _, client) = setup_funded_escrow(&env, vec![&env, 1_000_i128]);
     client.cancel_escrow(&client_addr);
 
     let attacker = Address::generate(&env);
@@ -225,8 +226,7 @@ fn test_cancel_refund_requires_cancel_lock() {
     let env = Env::default();
     env.mock_all_auths();
 
-    let (_, _, _, admin_addr, _, _, client) =
-        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+    let (_, _, _, admin_addr, _, _, client) = setup_funded_escrow(&env, vec![&env, 1_000_i128]);
 
     let result = client.try_admin_override_cancel_refund(&admin_addr);
     assert_eq!(result, Err(Ok(Error::InvalidStatus)));
@@ -263,13 +263,19 @@ fn test_cancel_refund_all_terminal_returns_invalid_amount() {
     let env = Env::default();
     env.mock_all_auths();
 
-    let (client_addr, freelancer_addr, _, admin_addr, _, _, client) =
+    let (client_addr, freelancer_addr, _, admin_addr, token_id, contract_id, client) =
         setup_funded_escrow(&env, vec![&env, 2_000_i128]);
 
     // Fully release the single milestone via normal path.
     client.mark_delivered(&freelancer_addr, &0u32);
     client.approve_milestone(&client_addr, &0u32);
 
+    // Top up the contract so the zero-balance boundary guard in
+    // `cancel_escrow` still lets a cancel go through even though every
+    // milestone is now terminal and fully released.
+    let token_admin = token::StellarAssetClient::new(&env, &token_id);
+    token_admin.mint(&contract_id, &1_000_i128);
+
     client.cancel_escrow(&client_addr);
 
     let result = client.try_admin_override_cancel_refund(&admin_addr);
@@ -324,8 +330,7 @@ fn test_cancel_refund_multiple_milestones_sum_correctly() {
     env.mock_all_auths();
 
     let amounts = vec![&env, 100_i128, 200_i128, 300_i128, 400_i128];
-    let (client_addr, _, _, admin_addr, token_id, _, client) =
-        setup_funded_escrow(&env, amounts);
+    let (client_addr, _, _, admin_addr, token_id, _, client) = setup_funded_escrow(&env, amounts);
 
     client.cancel_escrow(&client_addr);
 
@@ -357,4 +362,3 @@ fn test_cancel_refund_minimum_valid_amount() {
 
     assert_eq!(token.balance(&client_addr), client_before + 1);
 }
-

contracts/milestone-escrow/src/admin_override_refund_tests.rs

@@ -0,0 +1,145 @@
+//! Authorization and source-state guards for `admin_override_refund`
+//! (issue #329).
+//!
+//! An unauthorized caller and an illegal (paused) source state must each
+//! return their specific typed error, and neither path may mutate storage.
+
+use super::*;
+use crate::{Error, MilestoneStatus};
+use soroban_sdk::token;
+use soroban_sdk::{symbol_short, vec, Address, Env, IntoVal, Val};
+use crate::test::setup_funded_escrow;
+
+fn refund_event_count(env: &Env) -> u32 {
+    let topic_val: Val = symbol_short!("admovrf").into_val(env);
+    let mut count = 0u32;
+    for event in env.events().all().iter() {
+        if let Some(topic) = event.1.get(0) {
+            if topic.get_payload() == topic_val.get_payload() {
+                count += 1;
+            }
+        }
+    }
+    count
+}
+
+struct RefundLedgerSnapshot {
+    paused: bool,
+    status: MilestoneStatus,
+    released_amount: i128,
+    client_balance: i128,
+    contract_balance: i128,
+}
+
+fn snapshot_refund_ledger(
+    env: &Env,
+    client: &MilestoneEscrowClient,
+    token_id: &Address,
+    client_addr: &Address,
+) -> RefundLedgerSnapshot {
+    let job = client.get_job();
+    let milestone = job.milestones.get(0).unwrap();
+    let token = token::Client::new(env, token_id);
+    let paused = env.as_contract(&client.address, || {
+        env.storage()
+            .instance()
+            .get::<_, bool>(&crate::DataKey::Paused)
+            .unwrap_or(false)
+    });
+    RefundLedgerSnapshot {
+        paused,
+        status: milestone.status,
+        released_amount: milestone.released_amount,
+        client_balance: token.balance(client_addr),
+        contract_balance: token.balance(&client.address),
+    }
+}
+
+fn assert_ledger_unchanged(before: &RefundLedgerSnapshot, after: &RefundLedgerSnapshot) {
+    assert_eq!(after.paused, before.paused);
+    assert_eq!(after.status, before.status);
+    assert_eq!(after.released_amount, before.released_amount);
+    assert_eq!(after.client_balance, before.client_balance);
+    assert_eq!(after.contract_balance, before.contract_balance);
+}
+
+#[test]
+fn unauthorized_caller_returns_unauthorized_and_does_not_mutate_storage() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (client_addr, _, _, _admin_addr, token_id, _, client) =
+        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+
+    let before = snapshot_refund_ledger(&env, &client, &token_id, &client_addr);
+    assert!(!before.paused);
+    assert_eq!(before.status, MilestoneStatus::Pending);
+    assert_eq!(before.released_amount, 0);
+
+    let attacker = Address::generate(&env);
+    let result = client.try_admin_override_refund(&attacker, &0u32);
+    assert_eq!(result, Err(Ok(Error::Unauthorized)));
+
+    let after = snapshot_refund_ledger(&env, &client, &token_id, &client_addr);
+    assert_ledger_unchanged(&before, &after);
+    assert_eq!(refund_event_count(&env), 0);
+}
+
+#[test]
+fn illegal_paused_source_state_returns_paused_and_does_not_mutate_storage() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (client_addr, _, _, admin_addr, token_id, _, client) =
+        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+    client.admin_pause_escrow(&admin_addr);
+
+    let before = snapshot_refund_ledger(&env, &client, &token_id, &client_addr);
+    assert!(before.paused);
+    assert_eq!(before.status, MilestoneStatus::Pending);
+    assert_eq!(before.released_amount, 0);
+
+    let result = client.try_admin_override_refund(&admin_addr, &0u32);
+    assert_eq!(result, Err(Ok(Error::Paused)));
+
+    let after = snapshot_refund_ledger(&env, &client, &token_id, &client_addr);
+    assert_ledger_unchanged(&before, &after);
+    assert!(after.paused);
+    assert_eq!(refund_event_count(&env), 0);
+}
+
+#[test]
+fn client_freelancer_and_arbiter_are_unauthorized_without_storage_mutation() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (client_addr, freelancer_addr, arbiter_addr, _admin_addr, token_id, _, client) =
+        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+
+    let before = snapshot_refund_ledger(&env, &client, &token_id, &client_addr);
+    for caller in [client_addr.clone(), freelancer_addr, arbiter_addr] {
+        let result = client.try_admin_override_refund(&caller, &0u32);
+        assert_eq!(result, Err(Ok(Error::Unauthorized)));
+        let after = snapshot_refund_ledger(&env, &client, &token_id, &client_addr);
+        assert_ledger_unchanged(&before, &after);
+    }
+    assert_eq!(refund_event_count(&env), 0);
+}
+
+#[test]
+fn admin_override_refund_refunds_client() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (client_addr, _, _, admin_addr, token_id, _, client) =
+        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+
+    let before = snapshot_refund_ledger(&env, &client, &token_id, &client_addr);
+    client.admin_override_refund(&admin_addr, &0u32);
+
+    let after = snapshot_refund_ledger(&env, &client, &token_id, &client_addr);
+    assert_eq!(after.status, MilestoneStatus::Refunded);
+    assert_eq!(after.released_amount, 1_000);
+    assert_eq!(after.client_balance, before.client_balance + 1_000);
+    assert_eq!(after.contract_balance, before.contract_balance - 1_000);
+}

contracts/milestone-escrow/src/admin_override_release_tests.rs

@@ -0,0 +1,136 @@
+//! Authorization and source-state guards for `admin_override_release`
+//! (issue #328).
+//!
+//! An unauthorized caller and an illegal (terminal) source state must each
+//! return their specific typed error, and neither path may mutate storage.
+
+use super::*;
+use crate::{Error, MilestoneStatus};
+use soroban_sdk::token;
+use soroban_sdk::{symbol_short, vec, Address, Env, IntoVal, Val};
+
+fn release_event_count(env: &Env) -> u32 {
+    let topic_val: Val = symbol_short!("admovrls").into_val(env);
+    let mut count = 0u32;
+    for event in env.events().all().iter() {
+        if let Some(topic) = event.1.get(0) {
+            if topic.get_payload() == topic_val.get_payload() {
+                count += 1;
+            }
+        }
+    }
+    count
+}
+
+struct ReleaseLedgerSnapshot {
+    status: MilestoneStatus,
+    released_amount: i128,
+    freelancer_balance: i128,
+    contract_balance: i128,
+}
+
+fn snapshot_release_ledger(
+    env: &Env,
+    client: &MilestoneEscrowClient,
+    token_id: &Address,
+    freelancer_addr: &Address,
+) -> ReleaseLedgerSnapshot {
+    let job = client.get_job();
+    let milestone = job.milestones.get(0).unwrap();
+    let token = token::Client::new(env, token_id);
+    ReleaseLedgerSnapshot {
+        status: milestone.status,
+        released_amount: milestone.released_amount,
+        freelancer_balance: token.balance(freelancer_addr),
+        contract_balance: token.balance(&client.address),
+    }
+}
+
+fn assert_ledger_unchanged(before: &ReleaseLedgerSnapshot, after: &ReleaseLedgerSnapshot) {
+    assert_eq!(after.status, before.status);
+    assert_eq!(after.released_amount, before.released_amount);
+    assert_eq!(after.freelancer_balance, before.freelancer_balance);
+    assert_eq!(after.contract_balance, before.contract_balance);
+}
+
+#[test]
+fn unauthorized_caller_returns_unauthorized_and_does_not_mutate_storage() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (_, freelancer_addr, _, admin_addr, token_id, _, client) =
+        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+
+    let before = snapshot_release_ledger(&env, &client, &token_id, &freelancer_addr);
+    assert_eq!(before.status, MilestoneStatus::Pending);
+    assert_eq!(before.released_amount, 0);
+
+    let attacker = Address::generate(&env);
+    let result = client.try_admin_override_release(&attacker, &0u32);
+    assert_eq!(result, Err(Ok(Error::Unauthorized)));
+
+    let after = snapshot_release_ledger(&env, &client, &token_id, &freelancer_addr);
+    assert_ledger_unchanged(&before, &after);
+    assert_eq!(release_event_count(&env), 0);
+}
+
+#[test]
+fn illegal_terminal_source_state_returns_invalid_status_and_does_not_mutate_storage() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (client_addr, freelancer_addr, _, admin_addr, token_id, _, client) =
+        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+
+    // Fully release the milestone first so the source state is terminal.
+    client.mark_delivered(&freelancer_addr, &0u32);
+    client.approve_milestone(&client_addr, &0u32);
+
+    let before = snapshot_release_ledger(&env, &client, &token_id, &freelancer_addr);
+    assert_eq!(before.status, MilestoneStatus::Released);
+    assert_eq!(before.released_amount, 1_000);
+
+    let result = client.try_admin_override_release(&admin_addr, &0u32);
+    assert_eq!(result, Err(Ok(Error::InvalidStatus)));
+
+    let after = snapshot_release_ledger(&env, &client, &token_id, &freelancer_addr);
+    assert_ledger_unchanged(&before, &after);
+    assert_eq!(release_event_count(&env), 0);
+}
+
+#[test]
+fn client_freelancer_and_arbiter_are_unauthorized_without_storage_mutation() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (client_addr, freelancer_addr, arbiter_addr, admin_addr, token_id, _, client) =
+        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+
+    let before = snapshot_release_ledger(&env, &client, &token_id, &freelancer_addr);
+    for caller in [client_addr.clone(), freelancer_addr.clone(), arbiter_addr] {
+        let result = client.try_admin_override_release(&caller, &0u32);
+        assert_eq!(result, Err(Ok(Error::Unauthorized)));
+        let after = snapshot_release_ledger(&env, &client, &token_id, &freelancer_addr);
+        assert_ledger_unchanged(&before, &after);
+    }
+    assert_eq!(release_event_count(&env), 0);
+}
+
+#[test]
+fn admin_override_release_releases_funds_to_freelancer() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (_, freelancer_addr, _, admin_addr, token_id, _, client) =
+        setup_funded_escrow(&env, vec![&env, 1_000_i128]);
+
+    let before = snapshot_release_ledger(&env, &client, &token_id, &freelancer_addr);
+    client.admin_override_release(&admin_addr, &0u32);
+
+    let after = snapshot_release_ledger(&env, &client, &token_id, &freelancer_addr);
+    assert_eq!(after.status, MilestoneStatus::Released);
+    assert_eq!(after.released_amount, 1_000);
+    assert_eq!(after.freelancer_balance, before.freelancer_balance + 1_000);
+    assert_eq!(after.contract_balance, before.contract_balance - 1_000);
+    assert_eq!(release_event_count(&env), 1);
+}