@layerzerolabs/protocol-stellar-v2 0.2.13 → 0.2.15

package/contracts/workers/worker/src/tests/setup.rs

@@ -0,0 +1,147 @@
+use soroban_sdk::{
+    testutils::{Address as _, MockAuth, MockAuthInvoke},
+    Address, Bytes, Env, IntoVal, Val, Vec,
+};
+
+use crate::{init_worker, set_admin_by_admin, set_admin_by_owner, Worker};
+
+use common_macros::{contract_impl, ownable};
+use soroban_sdk::contract;
+
+#[contract]
+#[ownable]
+pub struct WorkerTester;
+
+#[contract_impl]
+impl WorkerTester {
+    #[allow(clippy::too_many_arguments)]
+    pub fn __constructor(
+        env: &Env,
+        owner: &Address,
+        admins: &Vec<Address>,
+        message_libs: &Vec<Address>,
+        price_feed: &Address,
+        default_multiplier_bps: u32,
+        worker_fee_lib: &Address,
+        deposit_address: &Address,
+    ) {
+        Self::init_owner(env, owner);
+        init_worker::<Self>(
+            env,
+            admins,
+            message_libs,
+            price_feed,
+            default_multiplier_bps,
+            worker_fee_lib,
+            deposit_address,
+        );
+    }
+
+    /// Test-only wrapper exposing `set_admin_by_owner` as a contract function
+    /// so we can exercise auth + storage updates in unit tests.
+    pub fn set_admin_by_owner_for_test(env: &Env, admin: &Address, active: bool) {
+        set_admin_by_owner::<Self>(env, admin, active);
+    }
+
+    /// Test-only wrapper exposing `set_admin_by_admin` as a contract function
+    /// so we can exercise auth + storage updates in unit tests.
+    pub fn set_admin_by_admin_for_test(env: &Env, caller: &Address, admin: &Address, active: bool) {
+        set_admin_by_admin::<Self>(env, caller, admin, active);
+    }
+}
+
+#[contract_impl(contracttrait)]
+impl Worker for WorkerTester {}
+
+mod bare_worker_contract {
+    use super::*;
+
+    #[contract]
+    #[ownable]
+    pub struct BareWorker;
+
+    #[contract_impl]
+    impl BareWorker {
+        pub fn __constructor(env: &Env, owner: &Address) {
+            Self::init_owner(env, owner);
+        }
+    }
+
+    #[contract_impl(contracttrait)]
+    impl Worker for BareWorker {}
+}
+
+pub struct TestSetup<'a> {
+    pub env: Env,
+    pub contract_id: Address,
+    pub client: WorkerTesterClient<'a>,
+    pub owner: Address,
+    pub admins: Vec<Address>,
+    pub message_libs: Vec<Address>,
+    pub price_feed: Address,
+    pub worker_fee_lib: Address,
+    pub deposit_address: Address,
+    pub default_multiplier_bps: u32,
+}
+
+impl<'a> TestSetup<'a> {
+    pub fn new() -> Self {
+        let env = Env::default();
+
+        let owner = Address::generate(&env);
+        let admins: Vec<Address> = soroban_sdk::vec![&env, Address::generate(&env), Address::generate(&env)];
+        let message_libs: Vec<Address> = soroban_sdk::vec![&env, Address::generate(&env)];
+        let price_feed = Address::generate(&env);
+        let worker_fee_lib = Address::generate(&env);
+        let deposit_address = Address::generate(&env);
+        let default_multiplier_bps = 10_000;
+
+        let contract_id = env.register(
+            WorkerTester,
+            (&owner, &admins, &message_libs, &price_feed, &default_multiplier_bps, &worker_fee_lib, &deposit_address),
+        );
+        let client = WorkerTesterClient::new(&env, &contract_id);
+
+        Self {
+            env,
+            contract_id,
+            client,
+            owner,
+            admins,
+            message_libs,
+            price_feed,
+            worker_fee_lib,
+            deposit_address,
+            default_multiplier_bps,
+        }
+    }
+
+    pub fn as_contract<F, R>(&self, f: F) -> R
+    where
+        F: FnOnce() -> R,
+    {
+        self.env.as_contract(&self.contract_id, f)
+    }
+
+    pub fn mock_auth<T: IntoVal<Env, Vec<Val>>>(&self, address: &Address, fn_name: &str, args: T) {
+        self.env.mock_auths(&[MockAuth {
+            address,
+            invoke: &MockAuthInvoke {
+                contract: &self.contract_id,
+                fn_name,
+                args: args.into_val(&self.env),
+                sub_invokes: &[],
+            },
+        }]);
+    }
+
+    pub fn mock_owner_auth<T: IntoVal<Env, Vec<Val>>>(&self, fn_name: &str, args: T) {
+        self.mock_auth(&self.owner, fn_name, args)
+    }
+}
+
+pub fn bare_worker<'a>(env: &'a Env, owner: &Address) -> (Address, bare_worker_contract::BareWorkerClient<'a>) {
+    let contract_id = env.register(bare_worker_contract::BareWorker, (owner,));
+    let client = bare_worker_contract::BareWorkerClient::new(env, &contract_id);
+    (contract_id, client)
+}

package/contracts/workers/worker/src/tests/worker.rs

@@ -0,0 +1,501 @@
+use super::setup::{bare_worker, TestSetup, WorkerTester};
+use crate::events::{
+    Paused, SetAdmin, SetAllowlist, SetDefaultMultiplierBps, SetDenylist, SetDepositAddress, SetPriceFeed,
+    SetSupportedMessageLib, SetSupportedOptionTypes, SetWorkerFeeLib, Unpaused,
+};
+use crate::init_worker;
+use soroban_sdk::testutils::Address as _;
+use soroban_sdk::{vec, Address, Bytes, Env, IntoVal};
+use utils::testing_utils::assert_event;
+
+// pause
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1212)")] // WorkerError::PauseStatusUnchanged
+fn test_set_paused_rejects_unchanged_status() {
+    let setup = TestSetup::new();
+
+    setup.mock_owner_auth("set_paused", (false,));
+    setup.client.set_paused(&false);
+}
+
+#[test]
+fn test_set_paused_toggles_state() {
+    let setup = TestSetup::new();
+
+    setup.mock_owner_auth("set_paused", (true,));
+    setup.client.set_paused(&true);
+    assert_event(&setup.env, &setup.contract_id, Paused { pauser: setup.owner.clone() });
+    assert_eq!(setup.client.paused(), true);
+
+    setup.mock_owner_auth("set_paused", (false,));
+    setup.client.set_paused(&false);
+    assert_event(&setup.env, &setup.contract_id, Unpaused { unpauser: setup.owner.clone() });
+    assert_eq!(setup.client.paused(), false);
+}
+
+// allowlist
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1202)")] // WorkerError::AlreadyOnAllowlist
+fn test_allowlist_rejects_duplicate_add() {
+    let setup = TestSetup::new();
+    let oapp = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_allowlist", (&oapp, true));
+    setup.client.set_allowlist(&oapp, &true);
+
+    setup.mock_owner_auth("set_allowlist", (&oapp, true));
+    setup.client.set_allowlist(&oapp, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1210)")] // WorkerError::NotOnAllowlist
+fn test_allowlist_rejects_remove_missing() {
+    let setup = TestSetup::new();
+    let oapp = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_allowlist", (&oapp, false));
+    setup.client.set_allowlist(&oapp, &false);
+}
+
+#[test]
+fn test_allowlist_remove_decrements_size_and_restores_default_acl() {
+    let setup = TestSetup::new();
+    let oapp_a = Address::generate(&setup.env);
+    let oapp_b = Address::generate(&setup.env);
+
+    // Add allowlist entry => allowlist becomes non-empty; non-allowlisted is denied
+    assert_eq!(setup.client.is_on_allowlist(&oapp_a), false);
+    setup.mock_owner_auth("set_allowlist", (&oapp_a, true));
+    setup.client.set_allowlist(&oapp_a, &true);
+    assert_event(&setup.env, &setup.contract_id, SetAllowlist { oapp: oapp_a.clone(), allowed: true });
+    assert_eq!(setup.client.is_on_allowlist(&oapp_a), true);
+    assert_eq!(setup.client.allowlist_size(), 1);
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+    assert_eq!(setup.client.has_acl(&oapp_b), false);
+
+    // Remove last allowlist entry => allowlist empty; default allows all (unless denylisted)
+    setup.mock_owner_auth("set_allowlist", (&oapp_a, false));
+    setup.client.set_allowlist(&oapp_a, &false);
+    assert_event(&setup.env, &setup.contract_id, SetAllowlist { oapp: oapp_a.clone(), allowed: false });
+    assert_eq!(setup.client.is_on_allowlist(&oapp_a), false);
+    assert_eq!(setup.client.allowlist_size(), 0);
+    assert_eq!(setup.client.has_acl(&oapp_b), true);
+}
+
+// denylist
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1203)")] // WorkerError::AlreadyOnDenylist
+fn test_denylist_rejects_duplicate_add() {
+    let setup = TestSetup::new();
+    let oapp = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_denylist", (&oapp, true));
+    setup.client.set_denylist(&oapp, &true);
+
+    setup.mock_owner_auth("set_denylist", (&oapp, true));
+    setup.client.set_denylist(&oapp, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1211)")] // WorkerError::NotOnDenylist
+fn test_denylist_rejects_remove_missing() {
+    let setup = TestSetup::new();
+    let oapp = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_denylist", (&oapp, false));
+    setup.client.set_denylist(&oapp, &false);
+}
+
+// message_libs
+
+#[test]
+fn test_message_lib_add_remove_and_errors() {
+    let setup = TestSetup::new();
+
+    let existing = setup.message_libs.get(0).unwrap();
+    let new_lib = Address::generate(&setup.env);
+
+    // Add new supported lib
+    setup.mock_owner_auth("set_supported_message_lib", (&new_lib, true));
+    setup.client.set_supported_message_lib(&new_lib, &true);
+    assert_event(
+        &setup.env,
+        &setup.contract_id,
+        SetSupportedMessageLib { message_lib: new_lib.clone(), supported: true },
+    );
+    assert_eq!(setup.client.is_supported_message_lib(&new_lib), true);
+
+    // Remove it
+    setup.mock_owner_auth("set_supported_message_lib", (&new_lib, false));
+    setup.client.set_supported_message_lib(&new_lib, &false);
+    assert_event(
+        &setup.env,
+        &setup.contract_id,
+        SetSupportedMessageLib { message_lib: new_lib.clone(), supported: false },
+    );
+    assert_eq!(setup.client.is_supported_message_lib(&new_lib), false);
+
+    // Existing is still supported
+    assert_eq!(setup.client.is_supported_message_lib(&existing), true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1206)")] // WorkerError::MessageLibAlreadySupported
+fn test_message_lib_rejects_duplicate_add() {
+    let setup = TestSetup::new();
+    let existing = setup.message_libs.get(0).unwrap();
+
+    setup.mock_owner_auth("set_supported_message_lib", (&existing, true));
+    setup.client.set_supported_message_lib(&existing, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1207)")] // WorkerError::MessageLibNotSupported
+fn test_message_lib_rejects_remove_missing() {
+    let setup = TestSetup::new();
+    let missing = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_supported_message_lib", (&missing, false));
+    setup.client.set_supported_message_lib(&missing, &false);
+}
+
+// admin-only setters
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1215)")] // WorkerError::Unauthorized
+fn test_admin_only_set_default_multiplier_requires_admin_membership() {
+    let setup = TestSetup::new();
+
+    let non_admin = Address::generate(&setup.env);
+    let bps = 12_000u32;
+
+    // Auth passes, but address isn't in admins list => Unauthorized
+    setup.mock_auth(&non_admin, "set_default_multiplier_bps", (&non_admin, bps));
+    setup.client.set_default_multiplier_bps(&non_admin, &bps);
+}
+
+#[test]
+fn test_admin_setters_update_storage_and_events() {
+    let setup = TestSetup::new();
+    let admin = setup.admins.get(0).unwrap();
+
+    // set_default_multiplier_bps
+    let bps = 12_000u32;
+    setup.mock_auth(&admin, "set_default_multiplier_bps", (&admin, bps));
+    setup.client.set_default_multiplier_bps(&admin, &bps);
+    assert_event(&setup.env, &setup.contract_id, SetDefaultMultiplierBps { multiplier_bps: bps });
+    assert_eq!(setup.client.default_multiplier_bps(), bps);
+
+    // set_deposit_address
+    let new_deposit = Address::generate(&setup.env);
+    setup.mock_auth(&admin, "set_deposit_address", (&admin, &new_deposit));
+    setup.client.set_deposit_address(&admin, &new_deposit);
+    assert_event(&setup.env, &setup.contract_id, SetDepositAddress { deposit_address: new_deposit.clone() });
+    assert_eq!(setup.client.deposit_address(), new_deposit);
+
+    // set_supported_option_types
+    let eid_a = 1u32;
+    let eid_b = 2u32;
+
+    let option_types = Bytes::from_slice(&setup.env, &[0xAA, 0xBB, 0xCC]);
+    setup.mock_auth(&admin, "set_supported_option_types", (&admin, eid_a, option_types.clone()));
+    setup.client.set_supported_option_types(&admin, &eid_a, &option_types);
+    assert_event(
+        &setup.env,
+        &setup.contract_id,
+        SetSupportedOptionTypes { dst_eid: eid_a, option_types: option_types.clone() },
+    );
+
+    assert_eq!(setup.client.get_supported_option_types(&eid_a), Some(option_types));
+    assert_eq!(setup.client.get_supported_option_types(&eid_b), None);
+
+    // set_worker_fee_lib
+    let new_fee_lib = Address::generate(&setup.env);
+    setup.mock_auth(&admin, "set_worker_fee_lib", (&admin, &new_fee_lib));
+    setup.client.set_worker_fee_lib(&admin, &new_fee_lib);
+    assert_event(&setup.env, &setup.contract_id, SetWorkerFeeLib { fee_lib: new_fee_lib.clone() });
+    assert_eq!(setup.client.worker_fee_lib(), new_fee_lib);
+
+    // set_price_feed
+    let new_price_feed = Address::generate(&setup.env);
+    setup.mock_auth(&admin, "set_price_feed", (&admin, &new_price_feed));
+    setup.client.set_price_feed(&admin, &new_price_feed);
+    assert_event(&setup.env, &setup.contract_id, SetPriceFeed { price_feed: new_price_feed.clone() });
+    assert_eq!(setup.client.price_feed(), new_price_feed);
+}
+
+// view functions
+
+#[test]
+fn test_acl_allowlist_denylist_precedence() {
+    let setup = TestSetup::new();
+    let oapp_a = Address::generate(&setup.env);
+    let oapp_b = Address::generate(&setup.env);
+
+    // Empty allowlist => allowed unless denylisted
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+
+    // Denylist overrides everything
+    assert_eq!(setup.client.is_on_denylist(&oapp_a), false);
+    setup.mock_owner_auth("set_denylist", (&oapp_a, true));
+    setup.client.set_denylist(&oapp_a, &true);
+    assert_event(&setup.env, &setup.contract_id, SetDenylist { oapp: oapp_a.clone(), denied: true });
+    assert_eq!(setup.client.is_on_denylist(&oapp_a), true);
+    assert_eq!(setup.client.has_acl(&oapp_a), false);
+
+    // Remove from denylist => allowed again (since allowlist is empty)
+    setup.mock_owner_auth("set_denylist", (&oapp_a, false));
+    setup.client.set_denylist(&oapp_a, &false);
+    assert_event(&setup.env, &setup.contract_id, SetDenylist { oapp: oapp_a.clone(), denied: false });
+    assert_eq!(setup.client.is_on_denylist(&oapp_a), false);
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+
+    // Add allowlist entry => allowlist becomes non-empty; non-allowlisted is denied
+    setup.mock_owner_auth("set_allowlist", (&oapp_a, true));
+    setup.client.set_allowlist(&oapp_a, &true);
+    assert_eq!(setup.client.allowlist_size(), 1);
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+    assert_eq!(setup.client.has_acl(&oapp_b), false);
+
+    // Denylist must override allowlist even for the same OApp.
+    setup.mock_owner_auth("set_denylist", (&oapp_a, true));
+    setup.client.set_denylist(&oapp_a, &true);
+    assert_event(&setup.env, &setup.contract_id, SetDenylist { oapp: oapp_a.clone(), denied: true });
+    assert_eq!(setup.client.has_acl(&oapp_a), false);
+
+    // Removing from denylist should restore allowlist effect.
+    setup.mock_owner_auth("set_denylist", (&oapp_a, false));
+    setup.client.set_denylist(&oapp_a, &false);
+    assert_event(&setup.env, &setup.contract_id, SetDenylist { oapp: oapp_a.clone(), denied: false });
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+}
+
+// uninitialized getters (BareWorker)
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1205)")] // WorkerError::DepositAddressNotSet
+fn test_view_panics_when_deposit_address_unset() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let (_cid, client) = bare_worker(&env, &owner);
+    let _ = client.deposit_address();
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1213)")] // WorkerError::PriceFeedNotSet
+fn test_view_panics_when_price_feed_unset() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let (_cid, client) = bare_worker(&env, &owner);
+    let _ = client.price_feed();
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1217)")] // WorkerError::WorkerFeeLibNotSet
+fn test_view_panics_when_worker_fee_lib_unset() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let (_cid, client) = bare_worker(&env, &owner);
+    let _ = client.worker_fee_lib();
+}
+
+#[test]
+fn test_default_multiplier_bps_returns_zero_when_unset() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let (_cid, client) = bare_worker(&env, &owner);
+    assert_eq!(client.default_multiplier_bps(), 0);
+}
+
+// init_worker / construction
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1208)")] // WorkerError::NoAdminsProvided
+fn test_init_worker_requires_non_empty_admins() {
+    let env = Env::default();
+
+    let owner = Address::generate(&env);
+    let admins: soroban_sdk::Vec<Address> = vec![&env];
+    let message_libs: soroban_sdk::Vec<Address> = vec![&env, Address::generate(&env)];
+    let price_feed = Address::generate(&env);
+    let worker_fee_lib = Address::generate(&env);
+    let deposit_address = Address::generate(&env);
+    let default_multiplier_bps = 10_000u32;
+
+    // Panics inside __constructor via init_worker()
+    let _ = env.register(
+        WorkerTester,
+        (&owner, &admins, &message_libs, &price_feed, &default_multiplier_bps, &worker_fee_lib, &deposit_address),
+    );
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1214)")] // WorkerError::ReInitialize
+fn test_init_worker_cannot_reinitialize() {
+    let setup = TestSetup::new();
+
+    setup.as_contract(|| {
+        init_worker::<WorkerTester>(
+            &setup.env,
+            &setup.admins,
+            &setup.message_libs,
+            &setup.price_feed,
+            setup.default_multiplier_bps,
+            &setup.worker_fee_lib,
+            &setup.deposit_address,
+        );
+    });
+}
+
+#[test]
+fn test_init_worker_sets_config_and_defaults() {
+    let setup = TestSetup::new();
+
+    assert_eq!(setup.client.paused(), false);
+    assert_eq!(setup.client.admins(), setup.admins);
+    assert_eq!(setup.client.message_libs(), setup.message_libs);
+    assert_eq!(setup.client.price_feed(), setup.price_feed);
+    assert_eq!(setup.client.worker_fee_lib(), setup.worker_fee_lib);
+    assert_eq!(setup.client.deposit_address(), setup.deposit_address);
+    assert_eq!(setup.client.default_multiplier_bps(), setup.default_multiplier_bps);
+    assert_eq!(setup.client.allowlist_size(), 0);
+
+    let lib = setup.message_libs.get(0).unwrap();
+    assert_eq!(setup.client.is_supported_message_lib(&lib), true);
+}
+
+// admin management (admins list)
+
+#[test]
+fn test_admin_management_by_owner_adds_and_removes_admin() {
+    let setup = TestSetup::new();
+    let new_admin = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_admin_by_owner_for_test", (&new_admin, true));
+    setup.client.set_admin_by_owner_for_test(&new_admin, &true);
+    assert_event(&setup.env, &setup.contract_id, SetAdmin { admin: new_admin.clone(), active: true });
+    assert_eq!(setup.client.is_admin(&new_admin), true);
+
+    setup.mock_owner_auth("set_admin_by_owner_for_test", (&new_admin, false));
+    setup.client.set_admin_by_owner_for_test(&new_admin, &false);
+    assert_event(&setup.env, &setup.contract_id, SetAdmin { admin: new_admin.clone(), active: false });
+    assert_eq!(setup.client.is_admin(&new_admin), false);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1200)")] // WorkerError::AdminAlreadyExists
+fn test_admin_management_by_owner_rejects_duplicate_add() {
+    let setup = TestSetup::new();
+    let existing_admin = setup.admins.get(0).unwrap();
+
+    setup.mock_owner_auth("set_admin_by_owner_for_test", (&existing_admin, true));
+    setup.client.set_admin_by_owner_for_test(&existing_admin, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1201)")] // WorkerError::AdminNotFound
+fn test_admin_management_by_owner_rejects_remove_missing_admin() {
+    let setup = TestSetup::new();
+    let missing_admin = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_admin_by_owner_for_test", (&missing_admin, false));
+    setup.client.set_admin_by_owner_for_test(&missing_admin, &false);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1204)")] // WorkerError::AttemptingToRemoveOnlyAdmin
+fn test_admin_management_cannot_remove_last_admin() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let admins: soroban_sdk::Vec<Address> = vec![&env, Address::generate(&env)];
+    let message_libs: soroban_sdk::Vec<Address> = vec![&env, Address::generate(&env)];
+    let price_feed = Address::generate(&env);
+    let worker_fee_lib = Address::generate(&env);
+    let deposit_address = Address::generate(&env);
+    let default_multiplier_bps = 10_000u32;
+
+    let cid = env.register(
+        WorkerTester,
+        (&owner, &admins, &message_libs, &price_feed, &default_multiplier_bps, &worker_fee_lib, &deposit_address),
+    );
+    let client = super::setup::WorkerTesterClient::new(&env, &cid);
+    let only_admin = admins.get(0).unwrap();
+
+    env.mock_auths(&[soroban_sdk::testutils::MockAuth {
+        address: &owner,
+        invoke: &soroban_sdk::testutils::MockAuthInvoke {
+            contract: &cid,
+            fn_name: "set_admin_by_owner_for_test",
+            args: (&only_admin, false).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+
+    client.set_admin_by_owner_for_test(&only_admin, &false);
+}
+
+#[test]
+fn test_admin_management_by_admin_can_add_admin() {
+    let setup = TestSetup::new();
+    let caller = setup.admins.get(0).unwrap();
+    let new_admin = Address::generate(&setup.env);
+
+    setup.mock_auth(&caller, "set_admin_by_admin_for_test", (&caller, &new_admin, true));
+    setup.client.set_admin_by_admin_for_test(&caller, &new_admin, &true);
+    assert_event(&setup.env, &setup.contract_id, SetAdmin { admin: new_admin.clone(), active: true });
+    assert_eq!(setup.client.is_admin(&new_admin), true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1215)")] // WorkerError::Unauthorized
+fn test_admin_management_by_admin_requires_caller_is_admin() {
+    let setup = TestSetup::new();
+    let non_admin = Address::generate(&setup.env);
+    let new_admin = Address::generate(&setup.env);
+
+    setup.mock_auth(&non_admin, "set_admin_by_admin_for_test", (&non_admin, &new_admin, true));
+    setup.client.set_admin_by_admin_for_test(&non_admin, &new_admin, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1209)")] // WorkerError::NotAllowed
+fn test_assert_acl_rejects_when_not_allowed() {
+    let setup = TestSetup::new();
+    let allowed = Address::generate(&setup.env);
+    let not_allowed = Address::generate(&setup.env);
+
+    // Make allowlist non-empty so non-allowlisted addresses are denied.
+    setup.mock_owner_auth("set_allowlist", (&allowed, true));
+    setup.client.set_allowlist(&allowed, &true);
+
+    setup.as_contract(|| {
+        crate::assert_acl::<WorkerTester>(&setup.env, &not_allowed);
+    });
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1216)")] // WorkerError::UnsupportedMessageLib
+fn test_assert_supported_message_lib_rejects_unsupported() {
+    let setup = TestSetup::new();
+    let unsupported = Address::generate(&setup.env);
+
+    setup.as_contract(|| {
+        crate::assert_supported_message_lib::<WorkerTester>(&setup.env, &unsupported);
+    });
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1218)")] // WorkerError::WorkerIsPaused
+fn test_assert_not_paused_panics_when_paused() {
+    let setup = TestSetup::new();
+
+    setup.mock_owner_auth("set_paused", (true,));
+    setup.client.set_paused(&true);
+
+    setup.as_contract(|| {
+        crate::assert_not_paused::<WorkerTester>(&setup.env);
+    });
+}