@layerzerolabs/ethena-sac-manager-stellar-contracts 1.2.28

package/src/tests/sac_manager/redistribute_funds.rs

@@ -0,0 +1,103 @@
+//! redistribute_blacklisted_funds Integration Tests
+//!
+//! Covers the `REDISTRIBUTOR_ROLE`-gated redistribution path:
+//! - happy path (including escrow field on emitted event)
+//! - guard: target must be blacklisted
+//! - guard: escrow must be configured
+//! - role/auth: caller must hold REDISTRIBUTOR_ROLE and authorize the call
+
+use super::test_helper::{mock_redistribute_funds_auth, mock_set_authorized_auth};
+use crate::errors::SACManagerError;
+use crate::sac_manager::RedistributeFunds;
+use crate::tests::test_helper::{mock_oft_mint_auth, TestSetup};
+use soroban_sdk::testutils::IssuerFlags;
+use utils::{errors::RbacError, testing_utils::assert_contains_event};
+
+// =========================================================================
+// Happy Path — clawback from blacklisted, mint to escrow, emit event
+// =========================================================================
+
+#[test]
+fn test_redistribute_funds_success() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_escrow_enabled().build();
+    let escrow = setup.escrow.clone().unwrap();
+    let blacklisted_user = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+    setup.sac_contract.issuer().set_flag(IssuerFlags::ClawbackEnabledFlag);
+
+    mock_oft_mint_auth(&setup, &blacklisted_user, 1_000_i128);
+    setup.sac_manager_client.mint(&blacklisted_user, &1_000, &setup.minter);
+    mock_set_authorized_auth(&setup, &setup.owner, &blacklisted_user, false);
+    setup.sac_manager_client.set_authorized(&blacklisted_user, &false, &setup.owner);
+
+    let escrow_balance_before = setup.sac_client.balance(&escrow);
+    let user_balance_before = setup.sac_client.balance(&blacklisted_user);
+    assert_eq!(user_balance_before, 1_000);
+    assert!(!setup.sac_client.authorized(&blacklisted_user));
+
+    mock_redistribute_funds_auth(&setup, &setup.owner, &blacklisted_user, 400_i128);
+    setup.sac_manager_client.redistribute_blacklisted_funds(&blacklisted_user, &400, &setup.owner);
+
+    let expected = RedistributeFunds { user: blacklisted_user.clone(), escrow: escrow.clone(), amount: 400 };
+    assert_contains_event(&setup.env, &setup.sac_manager, expected);
+
+    assert_eq!(setup.sac_client.balance(&blacklisted_user), user_balance_before - 400);
+    assert_eq!(setup.sac_client.balance(&escrow), escrow_balance_before + 400);
+}
+
+// =========================================================================
+// Error — target is not blacklisted
+// =========================================================================
+
+#[test]
+fn test_redistribute_funds_fails_if_not_blacklisted() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_escrow_enabled().build();
+    let user = setup.generate_address();
+
+    mock_redistribute_funds_auth(&setup, &setup.owner, &user, 100_i128);
+    let result = setup.sac_manager_client.try_redistribute_blacklisted_funds(&user, &100, &setup.owner);
+    assert_eq!(result.err().unwrap().unwrap(), SACManagerError::NotBlacklisted.into());
+}
+
+// =========================================================================
+// Error — escrow not configured (redistribution feature disabled)
+// =========================================================================
+
+#[test]
+fn test_redistribute_funds_fails_if_escrow_not_set() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let user = setup.generate_address();
+
+    mock_redistribute_funds_auth(&setup, &setup.owner, &user, 100_i128);
+    let result = setup.sac_manager_client.try_redistribute_blacklisted_funds(&user, &100, &setup.owner);
+    assert_eq!(result.err().unwrap().unwrap(), SACManagerError::EscrowNotSet.into());
+}
+
+// =========================================================================
+// Role — operator without REDISTRIBUTOR_ROLE fails
+// =========================================================================
+
+#[test]
+fn test_redistribute_funds_fails_without_role() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_escrow_enabled().build();
+    let random = setup.generate_address();
+    let user = setup.generate_address();
+
+    mock_redistribute_funds_auth(&setup, &random, &user, 100_i128);
+    let result = setup.sac_manager_client.try_redistribute_blacklisted_funds(&user, &100, &random);
+    assert_eq!(result.err().unwrap().unwrap(), RbacError::Unauthorized.into());
+}
+
+// =========================================================================
+// Auth — must be authorized by the operator
+// =========================================================================
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_redistribute_funds_fails_without_operator_auth() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_escrow_enabled().build();
+    let user = setup.generate_address();
+
+    setup.sac_manager_client.redistribute_blacklisted_funds(&user, &100, &setup.owner);
+}

package/src/tests/sac_manager/set_admin.rs

@@ -0,0 +1,47 @@
+//! set_admin Integration Tests
+//!
+//! Tests that set_admin requires ADMIN_MANAGER_ROLE on the operator.
+
+use super::test_helper::mock_set_admin_auth;
+use crate::tests::test_helper::TestSetup;
+use utils::errors::RbacError;
+
+// =========================================================================
+// set_admin Tests
+// =========================================================================
+
+#[test]
+fn test_set_admin_by_owner() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let new_admin = setup.generate_address();
+
+    assert_eq!(setup.sac_client.admin(), setup.sac_manager);
+
+    mock_set_admin_auth(&setup, &setup.owner, &new_admin);
+    setup.sac_manager_client.set_admin(&new_admin, &setup.owner);
+    assert_eq!(setup.sac_client.admin(), new_admin);
+}
+
+// =========================================================================
+// set_admin Role Auth Tests
+// =========================================================================
+
+#[test]
+fn test_set_admin_operator_without_role_fails() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let new_admin = setup.generate_address();
+    let random = setup.generate_address();
+
+    mock_set_admin_auth(&setup, &random, &new_admin);
+    let result = setup.sac_manager_client.try_set_admin(&new_admin, &random);
+    assert_eq!(result.err().unwrap().unwrap(), RbacError::Unauthorized.into());
+}
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_set_admin_without_auth() {
+    let setup = TestSetup::new().build();
+    let new_admin = setup.generate_address();
+
+    setup.sac_manager_client.set_admin(&new_admin, &setup.owner);
+}

package/src/tests/sac_manager/set_authorized.rs

@@ -0,0 +1,85 @@
+//! set_authorized Integration Tests
+//!
+//! Requires revocable issuer flag on the SAC. Operator must hold BLACKLISTER_ROLE.
+//! When the redistribution feature is enabled (escrow set), the address
+//! currently configured as the escrow may not be blacklisted.
+
+use super::test_helper::mock_set_authorized_auth;
+use crate::errors::SACManagerError;
+use crate::tests::test_helper::TestSetup;
+use soroban_sdk::testutils::IssuerFlags;
+use utils::errors::RbacError;
+
+// =========================================================================
+// set_authorized Tests
+// =========================================================================
+
+#[test]
+fn test_set_authorized_by_owner() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let user = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+    assert!(setup.sac_client.authorized(&user));
+
+    mock_set_authorized_auth(&setup, &setup.owner, &user, false);
+    setup.sac_manager_client.set_authorized(&user, &false, &setup.owner);
+    assert!(!setup.sac_client.authorized(&user));
+
+    mock_set_authorized_auth(&setup, &setup.owner, &user, true);
+    setup.sac_manager_client.set_authorized(&user, &true, &setup.owner);
+    assert!(setup.sac_client.authorized(&user));
+}
+
+// =========================================================================
+// set_authorized Role Auth Tests
+// =========================================================================
+
+#[test]
+fn test_set_authorized_operator_without_role_fails() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let user = setup.generate_address();
+    let random = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+    mock_set_authorized_auth(&setup, &random, &user, false);
+    let result = setup.sac_manager_client.try_set_authorized(&user, &false, &random);
+    assert_eq!(result.err().unwrap().unwrap(), RbacError::Unauthorized.into());
+}
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_set_authorized_without_auth() {
+    let setup = TestSetup::new().build();
+    let user = setup.generate_address();
+
+    setup.sac_manager_client.set_authorized(&user, &false, &setup.owner);
+}
+
+// =========================================================================
+// Escrow guard — cannot blacklist the address currently configured as escrow
+// =========================================================================
+
+#[test]
+fn test_set_authorized_cannot_blacklist_current_escrow() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_escrow_enabled().build();
+    let escrow = setup.escrow.clone().unwrap();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+
+    mock_set_authorized_auth(&setup, &setup.owner, &escrow, false);
+    let result = setup.sac_manager_client.try_set_authorized(&escrow, &false, &setup.owner);
+    assert_eq!(result.err().unwrap().unwrap(), SACManagerError::CannotBlockEscrow.into());
+}
+
+#[test]
+fn test_set_authorized_can_reauthorize_current_escrow() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_escrow_enabled().build();
+    let escrow = setup.escrow.clone().unwrap();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+
+    mock_set_authorized_auth(&setup, &setup.owner, &escrow, true);
+    setup.sac_manager_client.set_authorized(&escrow, &true, &setup.owner);
+    assert!(setup.sac_client.authorized(&escrow));
+}

package/src/tests/sac_manager/set_escrow.rs

@@ -0,0 +1,146 @@
+//! set_escrow Integration Tests
+//!
+//! Verifies that the escrow can be set / cleared by the owner only, that a
+//! `REDISTRIBUTOR_ROLE` holder can no longer change it, that the new escrow
+//! must not be currently blacklisted on the SAC, and that an `EscrowSet` event
+//! is emitted on every change.
+//!
+//! `set_escrow` is owner-gated (`#[only_auth]`) so that choosing the
+//! redistribution destination and executing the seizure
+//! (`redistribute_blacklisted_funds`, `REDISTRIBUTOR_ROLE`) require two
+//! distinct keys.
+//!
+//! The constraint that the escrow MUST NOT be the underlying classic asset
+//! issuer account is documented in `sac_manager.rs` and is the owner's
+//! off-chain responsibility — the classic issuer is not queryable on-chain
+//! once SAC admin has been transferred to this contract, so it cannot be
+//! enforced in the contract.
+
+use super::test_helper::{mock_set_authorized_auth, mock_set_escrow_auth};
+use crate::errors::SACManagerError;
+use crate::sac_manager::EscrowSet;
+use crate::tests::test_helper::{mock_auth, TestSetup};
+use soroban_sdk::{testutils::IssuerFlags, Symbol};
+use utils::testing_utils::assert_contains_event;
+
+// =========================================================================
+// set_escrow Happy Paths
+// =========================================================================
+
+#[test]
+fn test_set_escrow_enables_and_disables_redistribution() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let escrow = setup.generate_address();
+    assert!(setup.sac_manager_client.escrow().is_none());
+
+    mock_set_escrow_auth(&setup, &setup.owner, &Some(escrow.clone()));
+    setup.sac_manager_client.set_escrow(&Some(escrow.clone()));
+    assert_eq!(setup.sac_manager_client.escrow(), Some(escrow.clone()));
+
+    mock_set_escrow_auth(&setup, &setup.owner, &None);
+    setup.sac_manager_client.set_escrow(&None);
+    assert!(setup.sac_manager_client.escrow().is_none());
+}
+
+#[test]
+fn test_set_escrow_emits_event_with_previous_and_new() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let first = setup.generate_address();
+    let second = setup.generate_address();
+
+    mock_set_escrow_auth(&setup, &setup.owner, &Some(first.clone()));
+    setup.sac_manager_client.set_escrow(&Some(first.clone()));
+    assert_contains_event(
+        &setup.env,
+        &setup.sac_manager,
+        EscrowSet { previous_escrow: None, new_escrow: Some(first.clone()) },
+    );
+
+    mock_set_escrow_auth(&setup, &setup.owner, &Some(second.clone()));
+    setup.sac_manager_client.set_escrow(&Some(second.clone()));
+    assert_contains_event(
+        &setup.env,
+        &setup.sac_manager,
+        EscrowSet { previous_escrow: Some(first.clone()), new_escrow: Some(second.clone()) },
+    );
+
+    mock_set_escrow_auth(&setup, &setup.owner, &None);
+    setup.sac_manager_client.set_escrow(&None);
+    assert_contains_event(
+        &setup.env,
+        &setup.sac_manager,
+        EscrowSet { previous_escrow: Some(second), new_escrow: None },
+    );
+}
+
+// =========================================================================
+// set_escrow Guard — cannot set a currently-blacklisted address as escrow
+// =========================================================================
+
+#[test]
+fn test_set_escrow_fails_when_candidate_is_blacklisted() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let escrow_candidate = setup.generate_address();
+
+    setup.sac_contract.issuer().set_flag(IssuerFlags::RevocableFlag);
+
+    mock_set_authorized_auth(&setup, &setup.owner, &escrow_candidate, false);
+    setup.sac_manager_client.set_authorized(&escrow_candidate, &false, &setup.owner);
+    assert!(!setup.sac_client.authorized(&escrow_candidate));
+
+    mock_set_escrow_auth(&setup, &setup.owner, &Some(escrow_candidate.clone()));
+    let result = setup.sac_manager_client.try_set_escrow(&Some(escrow_candidate));
+    assert_eq!(result.err().unwrap().unwrap(), SACManagerError::EscrowIsBlocked.into());
+}
+
+// =========================================================================
+// set_escrow Owner-gating — a REDISTRIBUTOR_ROLE holder cannot set the escrow
+// =========================================================================
+
+#[test]
+fn test_set_escrow_fails_for_redistributor_role_holder() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let redistributor = setup.generate_address();
+    let escrow = setup.generate_address();
+
+    // Grant REDISTRIBUTOR_ROLE to a non-owner address.
+    let role = Symbol::new(&setup.env, "REDISTRIBUTOR_ROLE");
+    mock_auth(
+        &setup.env,
+        &setup.sac_manager,
+        &setup.owner,
+        "grant_role",
+        (redistributor.clone(), role.clone(), setup.owner.clone()),
+    );
+    setup.sac_manager_client.grant_role(&redistributor, &role, &setup.owner);
+
+    // Holding REDISTRIBUTOR_ROLE and authorizing the call is not enough:
+    // set_escrow is owner-gated, so the owner's authorization is required.
+    mock_set_escrow_auth(&setup, &redistributor, &Some(escrow.clone()));
+    let result = setup.sac_manager_client.try_set_escrow(&Some(escrow));
+    assert!(result.is_err());
+}
+
+// =========================================================================
+// set_escrow Auth — the owner must authorize
+// =========================================================================
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_set_escrow_fails_without_owner_auth() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let escrow = setup.generate_address();
+
+    setup.sac_manager_client.set_escrow(&Some(escrow));
+}
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_set_escrow_fails_when_non_owner_authorizes() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().build();
+    let random = setup.generate_address();
+    let escrow = setup.generate_address();
+
+    mock_auth(&setup.env, &setup.sac_manager, &random, "set_escrow", (Some(escrow.clone()),));
+    setup.sac_manager_client.set_escrow(&Some(escrow));
+}

package/src/tests/sac_manager/test_helper.rs

@@ -0,0 +1,29 @@
+use crate::tests::test_helper::{mock_auth, TestSetup};
+use soroban_sdk::Address;
+
+/// Mock auth for `clawback(from, amount, operator)` — operator must hold CLAWBACK_ROLE.
+pub fn mock_clawback_auth(setup: &TestSetup, operator: &Address, from: &Address, amount: i128) {
+    mock_auth(&setup.env, &setup.sac_manager, operator, "clawback", (from, amount, operator));
+}
+
+/// Mock auth for `set_authorized(id, authorize, operator)` — operator must hold BLACKLISTER_ROLE.
+pub fn mock_set_authorized_auth(setup: &TestSetup, operator: &Address, user: &Address, authorize: bool) {
+    mock_auth(&setup.env, &setup.sac_manager, operator, "set_authorized", (user, authorize, operator));
+}
+
+/// Mock auth for `set_admin(new_admin, operator)` — operator must hold ADMIN_MANAGER_ROLE.
+pub fn mock_set_admin_auth(setup: &TestSetup, operator: &Address, new_admin: &Address) {
+    mock_auth(&setup.env, &setup.sac_manager, operator, "set_admin", (new_admin, operator));
+}
+
+/// Mock auth for `set_escrow(escrow)` — owner-gated (`#[only_auth]`), so
+/// `authorizer` is the contract owner.
+pub fn mock_set_escrow_auth(setup: &TestSetup, authorizer: &Address, escrow: &Option<Address>) {
+    mock_auth(&setup.env, &setup.sac_manager, authorizer, "set_escrow", (escrow.clone(),));
+}
+
+/// Mock auth for `redistribute_blacklisted_funds(from, amount, operator)` —
+/// operator must hold REDISTRIBUTOR_ROLE.
+pub fn mock_redistribute_funds_auth(setup: &TestSetup, operator: &Address, from: &Address, amount: i128) {
+    mock_auth(&setup.env, &setup.sac_manager, operator, "redistribute_blacklisted_funds", (from, amount, operator));
+}

package/src/tests/sac_manager/view_functions.rs

@@ -0,0 +1,13 @@
+//! View Functions Integration Tests
+
+use crate::tests::test_helper::TestSetup;
+
+// =========================================================================
+// Core View Functions
+// =========================================================================
+
+#[test]
+fn test_underlying_sac() {
+    let setup = TestSetup::new().build();
+    assert_eq!(setup.sac_manager_client.underlying_sac(), setup.sac);
+}

package/src/tests/test_helper.rs

@@ -0,0 +1,160 @@
+//! Test helper utilities for SAC manager tests.
+//!
+//! Provides authentication mocking helpers and common setup utilities.
+
+extern crate std;
+
+use crate::{SACManager, SACManagerClient};
+use soroban_sdk::{
+    testutils::{Address as _, MockAuth, MockAuthInvoke, StellarAssetContract},
+    token::StellarAssetClient,
+    Address, Env, IntoVal, Symbol, Val,
+};
+
+// =========================================================================
+// TestSetup Builder
+// =========================================================================
+
+/// Builder for creating test setups with chainable configuration.
+///
+/// # Example
+/// ```ignore
+/// let setup = TestSetup::new()
+///     .with_manager_as_sac_admin()
+///     .with_escrow_enabled()
+///     .build();
+/// ```
+pub struct TestSetupBuilder {
+    manager_as_sac_admin: bool,
+    enable_escrow: bool,
+}
+
+impl TestSetupBuilder {
+    fn new() -> Self {
+        Self { manager_as_sac_admin: false, enable_escrow: false }
+    }
+
+    /// Set the SACManager as SAC admin during setup.
+    pub fn with_manager_as_sac_admin(mut self) -> Self {
+        self.manager_as_sac_admin = true;
+        self
+    }
+
+    /// Configure a fresh, randomly-generated escrow address on the manager so
+    /// the redistribution feature is enabled at the end of setup.
+    pub fn with_escrow_enabled(mut self) -> Self {
+        self.enable_escrow = true;
+        self
+    }
+
+    /// Build the TestSetup with the configured options.
+    pub fn build<'a>(self) -> TestSetup<'a> {
+        let env = Env::default();
+
+        let owner = Address::generate(&env);
+        let oft = Address::generate(&env);
+        let sac_contract = env.register_stellar_asset_contract_v2(owner.clone());
+        let sac = sac_contract.address();
+
+        let sac_manager = env.register(SACManager, (&sac, &owner));
+        let sac_manager_client = SACManagerClient::new(&env, &sac_manager);
+        let sac_client = StellarAssetClient::new(&env, &sac);
+
+        // Grant all roles to owner (owner is the authorizer so can grant any role)
+        for role_str in ["ADMIN_MANAGER_ROLE", "MINTER_ROLE", "BLACKLISTER_ROLE", "CLAWBACK_ROLE", "REDISTRIBUTOR_ROLE"]
+        {
+            let role = Symbol::new(&env, role_str);
+            mock_auth(&env, &sac_manager, &owner, "grant_role", (owner.clone(), role.clone(), owner.clone()));
+            sac_manager_client.grant_role(&owner, &role, &owner);
+        }
+
+        // Grant MINTER_ROLE to oft so it can call mint in tests
+        let minter_role = Symbol::new(&env, "MINTER_ROLE");
+        mock_auth(&env, &sac_manager, &owner, "grant_role", (oft.clone(), minter_role.clone(), owner.clone()));
+        sac_manager_client.grant_role(&oft, &minter_role, &owner);
+
+        if self.manager_as_sac_admin {
+            env.mock_auths(&[MockAuth {
+                address: &owner,
+                invoke: &MockAuthInvoke {
+                    contract: &sac,
+                    fn_name: "set_admin",
+                    args: (&sac_manager,).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }]);
+            sac_client.set_admin(&sac_manager);
+        }
+
+        let escrow = if self.enable_escrow {
+            let escrow = Address::generate(&env);
+            mock_auth(&env, &sac_manager, &owner, "set_escrow", (Some(escrow.clone()),));
+            sac_manager_client.set_escrow(&Some(escrow.clone()));
+            Some(escrow)
+        } else {
+            None
+        };
+
+        // Clear mock auths so test starts with clean auth state
+        env.mock_auths(&[]);
+
+        TestSetup { env, owner, minter: oft, sac, sac_contract, sac_manager, sac_manager_client, sac_client, escrow }
+    }
+}
+
+// =========================================================================
+// TestSetup
+// =========================================================================
+
+/// Common test setup that creates a SAC and SACManager.
+pub struct TestSetup<'a> {
+    pub env: Env,
+    pub owner: Address,
+    /// Address that has MINTER_ROLE in default setup (used as operator for mint in tests).
+    pub minter: Address,
+    pub sac: Address,
+    pub sac_contract: StellarAssetContract,
+    pub sac_manager: Address,
+    pub sac_manager_client: SACManagerClient<'a>,
+    pub sac_client: StellarAssetClient<'a>,
+    /// Escrow address configured during build if `with_escrow_enabled()` was used.
+    pub escrow: Option<Address>,
+}
+
+impl TestSetup<'_> {
+    /// Start building a new test setup.
+    #[allow(clippy::new_ret_no_self)]
+    pub fn new() -> TestSetupBuilder {
+        TestSetupBuilder::new()
+    }
+
+    /// Generate a new random address in this test environment.
+    pub fn generate_address(&self) -> Address {
+        Address::generate(&self.env)
+    }
+}
+
+// =========================================================================
+// Auth Helpers
+// =========================================================================
+
+/// Test helper to mock a single contract invocation auth.
+///
+/// This keeps test files from repeating `env.mock_auths(&[MockAuth { ... }])` blocks.
+pub fn mock_auth<A: IntoVal<Env, soroban_sdk::Vec<Val>>>(
+    env: &Env,
+    contract_id: &Address,
+    address: &Address,
+    fn_name: &'static str,
+    args: A,
+) {
+    env.mock_auths(&[MockAuth {
+        address,
+        invoke: &MockAuthInvoke { contract: contract_id, args: args.into_val(env), fn_name, sub_invokes: &[] },
+    }]);
+}
+
+/// Mock auth for minter-originated `mint(to, amount, operator)`.
+pub fn mock_oft_mint_auth(setup: &TestSetup, recipient: &Address, amount: i128) {
+    mock_auth(&setup.env, &setup.sac_manager, &setup.minter, "mint", (recipient, amount, &setup.minter));
+}