fix(soroban): fix cargo test — 70+ pre-existing compile and runtime failures

[Meshmulla]

Summary

Third follow-up to #13 (alongside #14 and #15). With the ethnum fix (#14) and the escrow_contract crate split (#15) applied, cargo build --release --target wasm32-unknown-unknown goes green — but cargo test still failed outright. This PR fixes it, going from "doesn't compile" to 725 tests passing, 0 failing, verified on a real disposable CI run combining all three fixes together.

Note on the diff: this branch is stacked on #15 (which is stacked on #13), so GitHub is showing the cumulative diff since feature/1-split-escrow-contract-crate only exists on my fork and can't be used as a cross-repo PR base. The commits unique to this PR are the 8 most recent ones (fix(soroban): fix cargo test compile errors... through fix(soroban): fix version_migration_tests runtime failures) — everything before that is #15's content. Once #14/#15 merge, rebasing will shrink this to just those 8 commits.

None of this had ever been exercised by CI before, so it had accumulated two waves of pre-existing breakage: things that didn't even compile, and things that compiled but panicked at runtime once the compile errors were cleared out of the way.

Wave 1 — compile errors

• Several soroban/tests/*.test.rs files imported the crate under its pre-rename name (bridge_watch_soroban / bridge_watch_contracts) instead of the current swipely_contracts.
• emergency_fund_recovery_tests.rs and version_migration_tests.rs used crate:: to reach the library under test, which doesn't resolve from an integration test (a separate crate) — switched to swipely_contracts::.
• insurance_pool.test.rs and governance.test.rs had no [[test]] entry in Cargo.toml, so Cargo auto-discovered them and tried to derive a binary name from the file stem (insurance_pool.test), which isn't a valid crate name because of the literal dot.
  • Digging further: both governance/insurance_pool modules are #[cfg(test)]-gated in lib.rs (to keep them out of the wasm build, avoiding the symbol-collision problem fix(soroban): extract escrow_contract into its own crate to fix wasm build #15 fixed for escrow_contract). #[cfg(test)] is only true when a crate compiles itself in test mode — never true for an external crate merely linking it as a dependency, which is exactly what a tests/*.rs file is. So these two files could never work as integration tests, regardless of naming — a structural dead end. Both contracts already have substantial in-module #[cfg(test)] mod tests covering the same scenarios, so I removed the two external files rather than fight the architecture.
• source_trust.test.rs called Ledger::with_mut without importing the soroban_sdk::testutils::Ledger trait that provides it.
• asset_deprecation.rs: two helpers were pub fn inside the #[contractimpl] block, making soroban-sdk treat them as contract endpoints and enforce serializable-by-value parameter types — but they take &Env/&String and are only called internally. Made them plain (non-pub) fns, matching an existing helper in the same impl block.
• liquidity_pool.rs: two tests asserted against a .depth field that doesn't exist (real fields are pool_id/reserve_a/reserve_b/total_value_locked/depth_score/timestamp), and one used format!, unavailable in this #![no_std] crate.
• batch_query.rs: format! again (fixed via a #[cfg(test)]-gated extern crate alloc + explicit .to_string() calls, kept test-only since the wasm release build has no allocator wired up), plus an enum variant literally named Error colliding with #[contracttype]'s generated TryFromVal impl ("ambiguous associated item") — renamed to Failure.

Wave 2 — runtime failures (57, then 16, then a handful more as later targets were finally reached)

• Missing env.as_contract() context (the single biggest category): several free-function modules' own #[cfg(test)] mod tests — and two tests/*.rs integration files (emergency_fund_recovery_tests.rs, version_migration_tests.rs) — called contract functions directly, with no contract registered. soroban-sdk requires an active contract call frame for any env.storage() access. Registered a minimal dummy #[contract] in each setup()/setup_env() and wrapped calls in env.as_contract(&contract_id, || ...).
• Double require_auth() per frame: soroban's host allows require_auth() for a given address only once per call frame. Two distinct bugs from this:
  • Several public contract entrypoints call another public entrypoint that also require_auth()s the same address (set_config_bulk/init_default_config → set_config; submit_*_signed → submit_*). Extracted *_internal() variants without the auth check that both callers now share.
  • Several tests called two or more auth-requiring free functions on the same address inside one env.as_contract() block. Split each mutating call into its own block — this is already a documented idiom elsewhere in the repo (see soroban/tests/operator_rotation.test.rs), just not followed consistently in the modules' own internal suites.
• A real storage-key bug: get_all_configs() read the config-keys list from keys::CONFIG_KEYS (a plain string constant) while set_config writes that list under DataKey::ConfigKeys (a different, unrelated key) — two different storage slots, so get_all_configs() always saw an empty list. Fixed the read to match the write.
• A real replay-protection gap: verify_signature() cached verification results keyed only by the message payload hash, checked before the nonce-replay check. Resubmitting the exact same signed payload (a textbook replay attack) hit the cache and returned true without ever reaching the nonce check. Moved the nonce check ahead of the cache lookup.
  • Adjacent, not fixed here: verify_multi_sig() calls verify_signature() once per distinct signer against the same message, so a second signer's call can still short-circuit past real signature validation via a cache hit left by an earlier signer's legitimate check. No test currently exercises multi-signer verification against a shared message, so I left this as a flagged follow-up rather than redesigning the cache blind.
• Two real missing guards: pause_asset()/unpause_asset() were missing the assert_asset_not_locked() guard that every other asset-mutating entrypoint (submit_health, submit_price, ...) already calls — a locked asset could still be paused/unpaused. Added the guard, matching the existing pattern.
• A real missing admin exemption: the trusted-source check in submit_health/submit_price applied to every caller including admin, with no bypass — but check_permission()'s equivalent role check already exempts admin elsewhere in the same file, and an existing test (test_admin_can_always_submit_regardless_of_trust) is explicitly written to expect that same exemption. Added it.
• A handful of tests asserted timestamp > 0 fields without ever calling env.ledger().set_timestamp(...) in setup(), so they compared against the default t=0. Added the same set_timestamp(1_000_000) every other test file's setup already uses.
• One test (remove_operator) always targeted the only active operator, tripping a real "cannot remove the last active operator" safety guard — added a second operator so the removal path under test can actually succeed.
• One test's own name/assertions were checking the wrong thing given real (and correct, documented) contract behavior: consume_limit() deliberately persists breach side-effects (cooldown) even on a rejected call. Rewrote the assertion to check the usage counter directly (get_user_usage()) rather than check_limit(), which now correctly errors with CooldownActive right after a breach.

Testing/validation performed

Combined this branch with #14 (ethnum) and #15 (escrow split) on a disposable branch and pushed to real GitHub Actions repeatedly through this fix, iterating on each newly-surfaced failure as earlier ones were cleared (cargo stops scheduling new compile targets after a failure, so later targets' bugs were invisible until earlier ones were fixed). Final run: build green, test green — 725 passed, 0 failed, across every target (swipely-contracts lib + all soroban/tests/* integration targets + transfer-state-machine + escrow-contract). The disposable validation branch has been deleted — it was for verification only, not a deliverable.

Related

• Depends on / pairs with fix(deps): bump ethnum 1.5.2 -> 1.5.3 to fix build on current Rust stable #14 (ethnum bump) and fix(soroban): extract escrow_contract into its own crate to fix wasm build #15 (escrow_contract crate split) — needed together for both cargo build and cargo test to fully pass.
• Follow-up to feat(ci): add CI workflow to build, test, and validate contracts #13.