test(registry): negative-authorization suite proving owner-only paths #6

💠 Sidera — Stellar Name Service. Contribute via Drips Wave / GrantFox. Comment with your approach and wait for assignment before starting.

Description

The registry's security story rests on require_auth for owner-only operations (set_address, transfer), but the current tests only prove the positive path with mock_all_auths plus one MockAuth happy-path test. The escrow-style discipline in this ecosystem (soroban-forge's authz.rs) proves that a WRONG signer is rejected by the host, and pins the exact authorized-invocation tree every entrypoint demands. The registry deserves the same rigor — this is a name service that will hold valuable identities.

Desired outcome: a dedicated negative-auth test module proving per entrypoint that a non-owner's signature is rejected, and that the auth tree contains exactly the expected invocation.

Scope

• Crate/module: crates/registry, new src/authz.rs (test module) + mod authz; under #[cfg(test)]
• API: no changes
• Storage: none
• Tests: per-entrypoint wrong-signer rejection; replay/signature-args mismatch rejection; env.auths() tree assertions for register, set_address, transfer
• Docs: module-level docs explaining the verified mechanics (mirroring the house style)

Non-goals

• Property/fuzz testing (separate issue)
• Changes to any entrypoint or storage
• New dependencies beyond soroban-sdk testutils

What "done" looks like

• set_address with an impostor signature is rejected by the host (not by our own check first — order verified)
• transfer with a non-owner signer is rejected; the new owner's signature alone is NOT sufficient
• env.auths() assertions pin the exact authorized-invocation tree for each entrypoint (contract address, fn name, args)
• A signature armed for one set of args cannot be replayed against different args
• Module docs explain mock-auth mechanics and why self-authorization is implicit
• Existing tests stay green; clippy -D warnings clean

Implementation guidelines

• Reference implementation: soroban-forge's crates/escrow/src/authz.rs (public repo: Meet-hybrid/soroban-forge) — same SDK 27, same patterns: MockAuth/MockAuthInvoke for negative cases, env.auths() for tree assertions
• Use SideraRegistryClient's try_* variants to capture host errors without unwinding
• Test file organization: one #[test] per entrypoint per scenario, named fn {entrypoint}_{scenario}_is_rejected()
• Register the module with #[cfg(test)] mod authz; next to the existing mod tests

Verification

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test -p sidera-registry --all-targets --locked

PR guidelines

• Get assigned before starting; do not start work on a reserved issue.
• Work in a fork; branch off upstream/main; open the PR against Sidera-Protocol/sidera-contracts:main.
• PR description must include Closes #6.
• All CI checks must pass; human maintainer review required.

Metadata

• Affected crates/files: contracts/registry/src/authz.rs (new), src/lib.rs (mod decl)
• Complexity label: complexity: medium (150 base points)
• Type labels: test