fix: guard milestone dispute status transitions

contracts/milestone-tracker/src/lib.rs

@@ -215,6 +215,11 @@ impl MilestoneTrackerContract {
             panic!("unauthorized: only advertiser or admin can dispute");
         }
 
+        match milestone.status {
+            MilestoneStatus::Pending | MilestoneStatus::InProgress => {}
+            _ => panic!("milestone cannot be disputed in its current status"),
+        }
+
         milestone.status = MilestoneStatus::Disputed;
         let _ttl_key = DataKey::Milestone(milestone_id);
         env.storage().persistent().set(&_ttl_key, &milestone);

contracts/milestone-tracker/src/test.rs

@@ -100,10 +100,10 @@ fn test_update_progress_achieves() {
 }
 
 #[test]
-fn test_dispute_milestone() {
+fn test_dispute_pending_milestone() {
     let env = Env::default();
     env.mock_all_auths();
-    let (c, _, oracle) = setup(&env);
+    let (c, _, _) = setup(&env);
     let advertiser = Address::generate(&env);
     let id = c.create_milestone(
         &advertiser,
@@ -114,12 +114,100 @@ fn test_dispute_milestone() {
         &50_000i128,
         &86_400u64, // 1 day
     );
-    c.update_progress(&oracle, &id, &1000u64);
     c.dispute_milestone(&advertiser, &id);
     let m = c.get_milestone(&id).unwrap();
     assert!(matches!(m.status, MilestoneStatus::Disputed));
 }
 
+#[test]
+fn test_dispute_in_progress_milestone() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let (c, _, oracle) = setup(&env);
+    let advertiser = Address::generate(&env);
+    let id = c.create_milestone(
+        &advertiser,
+        &1u64,
+        &s(&env, "1000 views"),
+        &s(&env, "views"),
+        &1000u64,
+        &50_000i128,
+        &86_400u64,
+    );
+
+    c.update_progress(&oracle, &id, &500u64);
+    c.dispute_milestone(&advertiser, &id);
+
+    let m = c.get_milestone(&id).unwrap();
+    assert!(matches!(m.status, MilestoneStatus::Disputed));
+}
+
+#[test]
+#[should_panic(expected = "milestone cannot be disputed in its current status")]
+fn test_dispute_achieved_milestone_rejected() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let (c, _, oracle) = setup(&env);
+    let advertiser = Address::generate(&env);
+    let id = c.create_milestone(
+        &advertiser,
+        &1u64,
+        &s(&env, "1000 views"),
+        &s(&env, "views"),
+        &1000u64,
+        &50_000i128,
+        &86_400u64,
+    );
+
+    c.update_progress(&oracle, &id, &1000u64);
+    c.dispute_milestone(&advertiser, &id);
+}
+
+#[test]
+#[should_panic(expected = "milestone cannot be disputed in its current status")]
+fn test_dispute_missed_milestone_rejected() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let (c, _, oracle) = setup(&env);
+    let advertiser = Address::generate(&env);
+    let id = c.create_milestone(
+        &advertiser,
+        &1u64,
+        &s(&env, "1000 views"),
+        &s(&env, "views"),
+        &1000u64,
+        &50_000i128,
+        &MIN_DURATION_SECS,
+    );
+
+    env.ledger().with_mut(|li| {
+        li.timestamp += MIN_DURATION_SECS + 1;
+    });
+    c.update_progress(&oracle, &id, &500u64);
+    c.dispute_milestone(&advertiser, &id);
+}
+
+#[test]
+#[should_panic(expected = "milestone cannot be disputed in its current status")]
+fn test_dispute_disputed_milestone_rejected() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let (c, _, _) = setup(&env);
+    let advertiser = Address::generate(&env);
+    let id = c.create_milestone(
+        &advertiser,
+        &1u64,
+        &s(&env, "1000 views"),
+        &s(&env, "views"),
+        &1000u64,
+        &50_000i128,
+        &86_400u64,
+    );
+
+    c.dispute_milestone(&advertiser, &id);
+    c.dispute_milestone(&advertiser, &id);
+}
+
 #[test]
 #[should_panic(expected = "unauthorized: only advertiser or admin can dispute")]
 fn test_dispute_milestone_rejects_unauthorized_caller() {
@@ -146,7 +234,7 @@ fn test_dispute_milestone_rejects_unauthorized_caller() {
 fn test_resolve_dispute() {
     let env = Env::default();
     env.mock_all_auths();
-    let (c, admin, oracle) = setup(&env);
+    let (c, admin, _) = setup(&env);
     let advertiser = Address::generate(&env);
     let id = c.create_milestone(
         &advertiser,
@@ -157,7 +245,6 @@ fn test_resolve_dispute() {
         &50_000i128,
         &86_400u64, // 1 day
     );
-    c.update_progress(&oracle, &id, &1000u64);
     c.dispute_milestone(&advertiser, &id);
     c.resolve_dispute(&admin, &id, &true);
     let m = c.get_milestone(&id).unwrap();