@layerzerolabs/protocol-stellar-v2 0.2.13 → 0.2.18

package/contracts/workers/worker/src/tests/worker.rs

@@ -0,0 +1,502 @@
+use super::setup::{bare_worker, TestSetup, WorkerTester};
+use crate::{
+    events::{
+        Paused, SetAdmin, SetAllowlist, SetDefaultMultiplierBps, SetDenylist, SetDepositAddress, SetPriceFeed,
+        SetSupportedMessageLib, SetSupportedOptionTypes, SetWorkerFeeLib, Unpaused,
+    },
+    init_worker,
+};
+use soroban_sdk::{testutils::Address as _, vec, Address, Bytes, Env, IntoVal};
+use utils::testing_utils::assert_event;
+
+// pause
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1212)")] // WorkerError::PauseStatusUnchanged
+fn test_set_paused_rejects_unchanged_status() {
+    let setup = TestSetup::new();
+
+    setup.mock_owner_auth("set_paused", (false,));
+    setup.client.set_paused(&false);
+}
+
+#[test]
+fn test_set_paused_toggles_state() {
+    let setup = TestSetup::new();
+
+    setup.mock_owner_auth("set_paused", (true,));
+    setup.client.set_paused(&true);
+    assert_event(&setup.env, &setup.contract_id, Paused { pauser: setup.owner.clone() });
+    assert_eq!(setup.client.paused(), true);
+
+    setup.mock_owner_auth("set_paused", (false,));
+    setup.client.set_paused(&false);
+    assert_event(&setup.env, &setup.contract_id, Unpaused { unpauser: setup.owner.clone() });
+    assert_eq!(setup.client.paused(), false);
+}
+
+// allowlist
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1202)")] // WorkerError::AlreadyOnAllowlist
+fn test_allowlist_rejects_duplicate_add() {
+    let setup = TestSetup::new();
+    let oapp = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_allowlist", (&oapp, true));
+    setup.client.set_allowlist(&oapp, &true);
+
+    setup.mock_owner_auth("set_allowlist", (&oapp, true));
+    setup.client.set_allowlist(&oapp, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1210)")] // WorkerError::NotOnAllowlist
+fn test_allowlist_rejects_remove_missing() {
+    let setup = TestSetup::new();
+    let oapp = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_allowlist", (&oapp, false));
+    setup.client.set_allowlist(&oapp, &false);
+}
+
+#[test]
+fn test_allowlist_remove_decrements_size_and_restores_default_acl() {
+    let setup = TestSetup::new();
+    let oapp_a = Address::generate(&setup.env);
+    let oapp_b = Address::generate(&setup.env);
+
+    // Add allowlist entry => allowlist becomes non-empty; non-allowlisted is denied
+    assert_eq!(setup.client.is_on_allowlist(&oapp_a), false);
+    setup.mock_owner_auth("set_allowlist", (&oapp_a, true));
+    setup.client.set_allowlist(&oapp_a, &true);
+    assert_event(&setup.env, &setup.contract_id, SetAllowlist { oapp: oapp_a.clone(), allowed: true });
+    assert_eq!(setup.client.is_on_allowlist(&oapp_a), true);
+    assert_eq!(setup.client.allowlist_size(), 1);
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+    assert_eq!(setup.client.has_acl(&oapp_b), false);
+
+    // Remove last allowlist entry => allowlist empty; default allows all (unless denylisted)
+    setup.mock_owner_auth("set_allowlist", (&oapp_a, false));
+    setup.client.set_allowlist(&oapp_a, &false);
+    assert_event(&setup.env, &setup.contract_id, SetAllowlist { oapp: oapp_a.clone(), allowed: false });
+    assert_eq!(setup.client.is_on_allowlist(&oapp_a), false);
+    assert_eq!(setup.client.allowlist_size(), 0);
+    assert_eq!(setup.client.has_acl(&oapp_b), true);
+}
+
+// denylist
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1203)")] // WorkerError::AlreadyOnDenylist
+fn test_denylist_rejects_duplicate_add() {
+    let setup = TestSetup::new();
+    let oapp = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_denylist", (&oapp, true));
+    setup.client.set_denylist(&oapp, &true);
+
+    setup.mock_owner_auth("set_denylist", (&oapp, true));
+    setup.client.set_denylist(&oapp, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1211)")] // WorkerError::NotOnDenylist
+fn test_denylist_rejects_remove_missing() {
+    let setup = TestSetup::new();
+    let oapp = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_denylist", (&oapp, false));
+    setup.client.set_denylist(&oapp, &false);
+}
+
+// message_libs
+
+#[test]
+fn test_message_lib_add_remove_and_errors() {
+    let setup = TestSetup::new();
+
+    let existing = setup.message_libs.get(0).unwrap();
+    let new_lib = Address::generate(&setup.env);
+
+    // Add new supported lib
+    setup.mock_owner_auth("set_supported_message_lib", (&new_lib, true));
+    setup.client.set_supported_message_lib(&new_lib, &true);
+    assert_event(
+        &setup.env,
+        &setup.contract_id,
+        SetSupportedMessageLib { message_lib: new_lib.clone(), supported: true },
+    );
+    assert_eq!(setup.client.is_supported_message_lib(&new_lib), true);
+
+    // Remove it
+    setup.mock_owner_auth("set_supported_message_lib", (&new_lib, false));
+    setup.client.set_supported_message_lib(&new_lib, &false);
+    assert_event(
+        &setup.env,
+        &setup.contract_id,
+        SetSupportedMessageLib { message_lib: new_lib.clone(), supported: false },
+    );
+    assert_eq!(setup.client.is_supported_message_lib(&new_lib), false);
+
+    // Existing is still supported
+    assert_eq!(setup.client.is_supported_message_lib(&existing), true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1206)")] // WorkerError::MessageLibAlreadySupported
+fn test_message_lib_rejects_duplicate_add() {
+    let setup = TestSetup::new();
+    let existing = setup.message_libs.get(0).unwrap();
+
+    setup.mock_owner_auth("set_supported_message_lib", (&existing, true));
+    setup.client.set_supported_message_lib(&existing, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1207)")] // WorkerError::MessageLibNotSupported
+fn test_message_lib_rejects_remove_missing() {
+    let setup = TestSetup::new();
+    let missing = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_supported_message_lib", (&missing, false));
+    setup.client.set_supported_message_lib(&missing, &false);
+}
+
+// admin-only setters
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1215)")] // WorkerError::Unauthorized
+fn test_admin_only_set_default_multiplier_requires_admin_membership() {
+    let setup = TestSetup::new();
+
+    let non_admin = Address::generate(&setup.env);
+    let bps = 12_000u32;
+
+    // Auth passes, but address isn't in admins list => Unauthorized
+    setup.mock_auth(&non_admin, "set_default_multiplier_bps", (&non_admin, bps));
+    setup.client.set_default_multiplier_bps(&non_admin, &bps);
+}
+
+#[test]
+fn test_admin_setters_update_storage_and_events() {
+    let setup = TestSetup::new();
+    let admin = setup.admins.get(0).unwrap();
+
+    // set_default_multiplier_bps
+    let bps = 12_000u32;
+    setup.mock_auth(&admin, "set_default_multiplier_bps", (&admin, bps));
+    setup.client.set_default_multiplier_bps(&admin, &bps);
+    assert_event(&setup.env, &setup.contract_id, SetDefaultMultiplierBps { multiplier_bps: bps });
+    assert_eq!(setup.client.default_multiplier_bps(), bps);
+
+    // set_deposit_address
+    let new_deposit = Address::generate(&setup.env);
+    setup.mock_auth(&admin, "set_deposit_address", (&admin, &new_deposit));
+    setup.client.set_deposit_address(&admin, &new_deposit);
+    assert_event(&setup.env, &setup.contract_id, SetDepositAddress { deposit_address: new_deposit.clone() });
+    assert_eq!(setup.client.deposit_address(), new_deposit);
+
+    // set_supported_option_types
+    let eid_a = 1u32;
+    let eid_b = 2u32;
+
+    let option_types = Bytes::from_slice(&setup.env, &[0xAA, 0xBB, 0xCC]);
+    setup.mock_auth(&admin, "set_supported_option_types", (&admin, eid_a, option_types.clone()));
+    setup.client.set_supported_option_types(&admin, &eid_a, &option_types);
+    assert_event(
+        &setup.env,
+        &setup.contract_id,
+        SetSupportedOptionTypes { dst_eid: eid_a, option_types: option_types.clone() },
+    );
+
+    assert_eq!(setup.client.get_supported_option_types(&eid_a), Some(option_types));
+    assert_eq!(setup.client.get_supported_option_types(&eid_b), None);
+
+    // set_worker_fee_lib
+    let new_fee_lib = Address::generate(&setup.env);
+    setup.mock_auth(&admin, "set_worker_fee_lib", (&admin, &new_fee_lib));
+    setup.client.set_worker_fee_lib(&admin, &new_fee_lib);
+    assert_event(&setup.env, &setup.contract_id, SetWorkerFeeLib { fee_lib: new_fee_lib.clone() });
+    assert_eq!(setup.client.worker_fee_lib(), new_fee_lib);
+
+    // set_price_feed
+    let new_price_feed = Address::generate(&setup.env);
+    setup.mock_auth(&admin, "set_price_feed", (&admin, &new_price_feed));
+    setup.client.set_price_feed(&admin, &new_price_feed);
+    assert_event(&setup.env, &setup.contract_id, SetPriceFeed { price_feed: new_price_feed.clone() });
+    assert_eq!(setup.client.price_feed(), new_price_feed);
+}
+
+// view functions
+
+#[test]
+fn test_acl_allowlist_denylist_precedence() {
+    let setup = TestSetup::new();
+    let oapp_a = Address::generate(&setup.env);
+    let oapp_b = Address::generate(&setup.env);
+
+    // Empty allowlist => allowed unless denylisted
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+
+    // Denylist overrides everything
+    assert_eq!(setup.client.is_on_denylist(&oapp_a), false);
+    setup.mock_owner_auth("set_denylist", (&oapp_a, true));
+    setup.client.set_denylist(&oapp_a, &true);
+    assert_event(&setup.env, &setup.contract_id, SetDenylist { oapp: oapp_a.clone(), denied: true });
+    assert_eq!(setup.client.is_on_denylist(&oapp_a), true);
+    assert_eq!(setup.client.has_acl(&oapp_a), false);
+
+    // Remove from denylist => allowed again (since allowlist is empty)
+    setup.mock_owner_auth("set_denylist", (&oapp_a, false));
+    setup.client.set_denylist(&oapp_a, &false);
+    assert_event(&setup.env, &setup.contract_id, SetDenylist { oapp: oapp_a.clone(), denied: false });
+    assert_eq!(setup.client.is_on_denylist(&oapp_a), false);
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+
+    // Add allowlist entry => allowlist becomes non-empty; non-allowlisted is denied
+    setup.mock_owner_auth("set_allowlist", (&oapp_a, true));
+    setup.client.set_allowlist(&oapp_a, &true);
+    assert_eq!(setup.client.allowlist_size(), 1);
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+    assert_eq!(setup.client.has_acl(&oapp_b), false);
+
+    // Denylist must override allowlist even for the same OApp.
+    setup.mock_owner_auth("set_denylist", (&oapp_a, true));
+    setup.client.set_denylist(&oapp_a, &true);
+    assert_event(&setup.env, &setup.contract_id, SetDenylist { oapp: oapp_a.clone(), denied: true });
+    assert_eq!(setup.client.has_acl(&oapp_a), false);
+
+    // Removing from denylist should restore allowlist effect.
+    setup.mock_owner_auth("set_denylist", (&oapp_a, false));
+    setup.client.set_denylist(&oapp_a, &false);
+    assert_event(&setup.env, &setup.contract_id, SetDenylist { oapp: oapp_a.clone(), denied: false });
+    assert_eq!(setup.client.has_acl(&oapp_a), true);
+}
+
+// uninitialized getters (BareWorker)
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1205)")] // WorkerError::DepositAddressNotSet
+fn test_view_panics_when_deposit_address_unset() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let (_cid, client) = bare_worker(&env, &owner);
+    let _ = client.deposit_address();
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1213)")] // WorkerError::PriceFeedNotSet
+fn test_view_panics_when_price_feed_unset() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let (_cid, client) = bare_worker(&env, &owner);
+    let _ = client.price_feed();
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1217)")] // WorkerError::WorkerFeeLibNotSet
+fn test_view_panics_when_worker_fee_lib_unset() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let (_cid, client) = bare_worker(&env, &owner);
+    let _ = client.worker_fee_lib();
+}
+
+#[test]
+fn test_default_multiplier_bps_returns_zero_when_unset() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let (_cid, client) = bare_worker(&env, &owner);
+    assert_eq!(client.default_multiplier_bps(), 0);
+}
+
+// init_worker / construction
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1208)")] // WorkerError::NoAdminsProvided
+fn test_init_worker_requires_non_empty_admins() {
+    let env = Env::default();
+
+    let owner = Address::generate(&env);
+    let admins: soroban_sdk::Vec<Address> = vec![&env];
+    let message_libs: soroban_sdk::Vec<Address> = vec![&env, Address::generate(&env)];
+    let price_feed = Address::generate(&env);
+    let worker_fee_lib = Address::generate(&env);
+    let deposit_address = Address::generate(&env);
+    let default_multiplier_bps = 10_000u32;
+
+    // Panics inside __constructor via init_worker()
+    let _ = env.register(
+        WorkerTester,
+        (&owner, &admins, &message_libs, &price_feed, &default_multiplier_bps, &worker_fee_lib, &deposit_address),
+    );
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1214)")] // WorkerError::ReInitialize
+fn test_init_worker_cannot_reinitialize() {
+    let setup = TestSetup::new();
+
+    setup.as_contract(|| {
+        init_worker::<WorkerTester>(
+            &setup.env,
+            &setup.admins,
+            &setup.message_libs,
+            &setup.price_feed,
+            setup.default_multiplier_bps,
+            &setup.worker_fee_lib,
+            &setup.deposit_address,
+        );
+    });
+}
+
+#[test]
+fn test_init_worker_sets_config_and_defaults() {
+    let setup = TestSetup::new();
+
+    assert_eq!(setup.client.paused(), false);
+    assert_eq!(setup.client.admins(), setup.admins);
+    assert_eq!(setup.client.message_libs(), setup.message_libs);
+    assert_eq!(setup.client.price_feed(), setup.price_feed);
+    assert_eq!(setup.client.worker_fee_lib(), setup.worker_fee_lib);
+    assert_eq!(setup.client.deposit_address(), setup.deposit_address);
+    assert_eq!(setup.client.default_multiplier_bps(), setup.default_multiplier_bps);
+    assert_eq!(setup.client.allowlist_size(), 0);
+
+    let lib = setup.message_libs.get(0).unwrap();
+    assert_eq!(setup.client.is_supported_message_lib(&lib), true);
+}
+
+// admin management (admins list)
+
+#[test]
+fn test_admin_management_by_owner_adds_and_removes_admin() {
+    let setup = TestSetup::new();
+    let new_admin = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_admin_by_owner_for_test", (&new_admin, true));
+    setup.client.set_admin_by_owner_for_test(&new_admin, &true);
+    assert_event(&setup.env, &setup.contract_id, SetAdmin { admin: new_admin.clone(), active: true });
+    assert_eq!(setup.client.is_admin(&new_admin), true);
+
+    setup.mock_owner_auth("set_admin_by_owner_for_test", (&new_admin, false));
+    setup.client.set_admin_by_owner_for_test(&new_admin, &false);
+    assert_event(&setup.env, &setup.contract_id, SetAdmin { admin: new_admin.clone(), active: false });
+    assert_eq!(setup.client.is_admin(&new_admin), false);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1200)")] // WorkerError::AdminAlreadyExists
+fn test_admin_management_by_owner_rejects_duplicate_add() {
+    let setup = TestSetup::new();
+    let existing_admin = setup.admins.get(0).unwrap();
+
+    setup.mock_owner_auth("set_admin_by_owner_for_test", (&existing_admin, true));
+    setup.client.set_admin_by_owner_for_test(&existing_admin, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1201)")] // WorkerError::AdminNotFound
+fn test_admin_management_by_owner_rejects_remove_missing_admin() {
+    let setup = TestSetup::new();
+    let missing_admin = Address::generate(&setup.env);
+
+    setup.mock_owner_auth("set_admin_by_owner_for_test", (&missing_admin, false));
+    setup.client.set_admin_by_owner_for_test(&missing_admin, &false);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1204)")] // WorkerError::AttemptingToRemoveOnlyAdmin
+fn test_admin_management_cannot_remove_last_admin() {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let admins: soroban_sdk::Vec<Address> = vec![&env, Address::generate(&env)];
+    let message_libs: soroban_sdk::Vec<Address> = vec![&env, Address::generate(&env)];
+    let price_feed = Address::generate(&env);
+    let worker_fee_lib = Address::generate(&env);
+    let deposit_address = Address::generate(&env);
+    let default_multiplier_bps = 10_000u32;
+
+    let cid = env.register(
+        WorkerTester,
+        (&owner, &admins, &message_libs, &price_feed, &default_multiplier_bps, &worker_fee_lib, &deposit_address),
+    );
+    let client = super::setup::WorkerTesterClient::new(&env, &cid);
+    let only_admin = admins.get(0).unwrap();
+
+    env.mock_auths(&[soroban_sdk::testutils::MockAuth {
+        address: &owner,
+        invoke: &soroban_sdk::testutils::MockAuthInvoke {
+            contract: &cid,
+            fn_name: "set_admin_by_owner_for_test",
+            args: (&only_admin, false).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+
+    client.set_admin_by_owner_for_test(&only_admin, &false);
+}
+
+#[test]
+fn test_admin_management_by_admin_can_add_admin() {
+    let setup = TestSetup::new();
+    let caller = setup.admins.get(0).unwrap();
+    let new_admin = Address::generate(&setup.env);
+
+    setup.mock_auth(&caller, "set_admin_by_admin_for_test", (&caller, &new_admin, true));
+    setup.client.set_admin_by_admin_for_test(&caller, &new_admin, &true);
+    assert_event(&setup.env, &setup.contract_id, SetAdmin { admin: new_admin.clone(), active: true });
+    assert_eq!(setup.client.is_admin(&new_admin), true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1215)")] // WorkerError::Unauthorized
+fn test_admin_management_by_admin_requires_caller_is_admin() {
+    let setup = TestSetup::new();
+    let non_admin = Address::generate(&setup.env);
+    let new_admin = Address::generate(&setup.env);
+
+    setup.mock_auth(&non_admin, "set_admin_by_admin_for_test", (&non_admin, &new_admin, true));
+    setup.client.set_admin_by_admin_for_test(&non_admin, &new_admin, &true);
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1209)")] // WorkerError::NotAllowed
+fn test_assert_acl_rejects_when_not_allowed() {
+    let setup = TestSetup::new();
+    let allowed = Address::generate(&setup.env);
+    let not_allowed = Address::generate(&setup.env);
+
+    // Make allowlist non-empty so non-allowlisted addresses are denied.
+    setup.mock_owner_auth("set_allowlist", (&allowed, true));
+    setup.client.set_allowlist(&allowed, &true);
+
+    setup.as_contract(|| {
+        crate::assert_acl::<WorkerTester>(&setup.env, &not_allowed);
+    });
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1216)")] // WorkerError::UnsupportedMessageLib
+fn test_assert_supported_message_lib_rejects_unsupported() {
+    let setup = TestSetup::new();
+    let unsupported = Address::generate(&setup.env);
+
+    setup.as_contract(|| {
+        crate::assert_supported_message_lib::<WorkerTester>(&setup.env, &unsupported);
+    });
+}
+
+#[test]
+#[should_panic(expected = "Error(Contract, #1218)")] // WorkerError::WorkerIsPaused
+fn test_assert_not_paused_panics_when_paused() {
+    let setup = TestSetup::new();
+
+    setup.mock_owner_auth("set_paused", (true,));
+    setup.client.set_paused(&true);
+
+    setup.as_contract(|| {
+        crate::assert_not_paused::<WorkerTester>(&setup.env);
+    });
+}

package/contracts/workers/worker/src/worker.rs

@@ -1,9 +1,3 @@
-use soroban_sdk::{assert_with_error, contracttrait, Address, Bytes, Env, Vec};
-use utils::{
-    option_ext::OptionExt,
-    ownable::{enforce_owner_auth, require_owner_auth, Ownable},
-};
-
 use crate::{
     errors::WorkerError,
     events::{
@@ -12,10 +6,20 @@ use crate::{
     },
     storage::WorkerStorage,
 };
+use common_macros::contract_trait;
+use soroban_sdk::{assert_with_error, panic_with_error, Address, Bytes, Env, Vec};
+use utils::{
+    auth::{enforce_auth, require_auth, Auth},
+    option_ext::OptionExt,
+};
 
 /// Worker interface providing common functionality for LayerZero workers.
-#[contracttrait]
-pub trait Worker: Ownable + Sized {
+///
+/// Requires the `Auth` trait to be implemented, which can be provided by either:
+/// - `#[ownable]` macro for single-owner contracts (e.g., Executor)
+/// - `Multisig` trait for multisig-controlled contracts (e.g., DVN)
+#[contract_trait]
+pub trait Worker: Auth {
     // ========================================================================
     // Manager Functions
     // ========================================================================
@@ -28,14 +32,14 @@ pub trait Worker: Ownable + Sized {
     /// # Arguments
     /// * `paused` - `true` to pause, `false` to unpause
     fn set_paused(env: &Env, paused: bool) {
-        let owner = enforce_owner_auth::<Self>(env);
+        let authorizer = enforce_auth::<Self>(env);
         assert_with_error!(env, Self::paused(env) != paused, WorkerError::PauseStatusUnchanged);
 
         WorkerStorage::set_paused(env, &paused);
         if paused {
-            Paused { pauser: owner }.publish(env);
+            Paused { pauser: authorizer }.publish(env);
         } else {
-            Unpaused { unpauser: owner }.publish(env);
+            Unpaused { unpauser: authorizer }.publish(env);
         }
     }
 
@@ -48,7 +52,7 @@ pub trait Worker: Ownable + Sized {
     /// * `message_lib` - The message library contract address
     /// * `supported` - `true` to add support, `false` to remove support
     fn set_supported_message_lib(env: &Env, message_lib: &Address, supported: bool) {
-        require_owner_auth::<Self>(env);
+        require_auth::<Self>(env);
         set_message_lib_no_auth::<Self>(env, message_lib, supported);
     }
 
@@ -62,7 +66,7 @@ pub trait Worker: Ownable + Sized {
     /// * `oapp` - The OApp contract address
     /// * `allowed` - `true` to add to allowlist, `false` to remove
     fn set_allowlist(env: &Env, oapp: &Address, allowed: bool) {
-        require_owner_auth::<Self>(env);
+        require_auth::<Self>(env);
 
         let is_on_list = Self::is_on_allowlist(env, oapp);
         if allowed {
@@ -92,7 +96,7 @@ pub trait Worker: Ownable + Sized {
     /// * `oapp` - The OApp contract address
     /// * `denied` - `true` to add to denylist, `false` to remove
     fn set_denylist(env: &Env, oapp: &Address, denied: bool) {
-        require_owner_auth::<Self>(env);
+        require_auth::<Self>(env);
         let is_on_list = Self::is_on_denylist(env, oapp);
 
         if denied {
@@ -240,13 +244,7 @@ pub trait Worker: Ownable + Sized {
     /// # Arguments
     /// * `sender` - OApp contract address to check
     fn has_acl(env: &Env, sender: &Address) -> bool {
-        if Self::is_on_denylist(env, sender) {
-            return false;
-        }
-        if Self::allowlist_size(env) == 0 || Self::is_on_allowlist(env, sender) {
-            return true;
-        }
-        false
+        !Self::is_on_denylist(env, sender) && (Self::allowlist_size(env) == 0 || Self::is_on_allowlist(env, sender))
     }
 
     /// Returns the number of addresses on the allowlist.
@@ -375,13 +373,13 @@ pub fn assert_supported_message_lib<T: Worker>(env: &Env, message_lib: &Address)
 // Admin Setter Functions with authentication
 // ============================================================================================
 
-/// Sets admin status for an address by owner.
+/// Sets admin status for an address by authorizer (owner/multisig).
 ///
 /// # Arguments
 /// * `admin` - The address to set admin status for
 /// * `active` - `true` to add admin, `false` to remove
 pub fn set_admin_by_owner<T: Worker>(env: &Env, admin: &Address, active: bool) {
-    require_owner_auth::<T>(env);
+    require_auth::<T>(env);
     set_admin_no_auth::<T>(env, admin, active);
 }
 
@@ -416,9 +414,10 @@ fn set_admin_no_auth<T: Worker>(env: &Env, admin: &Address, active: bool) {
         admins.push_back(admin.clone());
     } else {
         // Remove admin - ensure present
-        assert_with_error!(env, admins.contains(admin), WorkerError::AdminNotFound);
         assert_with_error!(env, admins.len() > 1, WorkerError::AttemptingToRemoveOnlyAdmin);
-        let index = admins.first_index_of(admin).unwrap();
+        let Some(index) = admins.first_index_of(admin) else {
+            panic_with_error!(env, WorkerError::AdminNotFound);
+        };
         admins.remove(index);
     }
     WorkerStorage::set_admins(env, &admins);
@@ -439,15 +438,14 @@ fn set_message_lib_no_auth<T: Worker>(env: &Env, message_lib: &Address, supporte
         // Add message lib - ensure not already supported
         assert_with_error!(env, !libs.contains(message_lib), WorkerError::MessageLibAlreadySupported);
         libs.push_back(message_lib.clone());
-        WorkerStorage::set_message_libs(env, &libs);
     } else {
         // Remove message lib - ensure present
-        assert_with_error!(env, libs.contains(message_lib), WorkerError::MessageLibNotSupported);
-        let index = libs.first_index_of(message_lib).unwrap();
+        let Some(index) = libs.first_index_of(message_lib) else {
+            panic_with_error!(env, WorkerError::MessageLibNotSupported);
+        };
         libs.remove(index);
-        WorkerStorage::set_message_libs(env, &libs);
     }
-
+    WorkerStorage::set_message_libs(env, &libs);
     SetSupportedMessageLib { message_lib: message_lib.clone(), supported }.publish(env);
 }
 

package/package.json

@@ -1,21 +1,24 @@
 {
   "name": "@layerzerolabs/protocol-stellar-v2",
-  "version": "0.2.13",
+  "version": "0.2.18",
   "private": false,
   "devDependencies": {
     "@types/node": "^22.18.6",
     "tsx": "^4.19.3",
     "typescript": "^5.8.2",
-    "@layerzerolabs/common-node-utils": "0.2.13",
-    "@layerzerolabs/vm-tooling-stellar": "0.2.13"
+    "@layerzerolabs/common-node-utils": "0.2.18",
+    "@layerzerolabs/vm-tooling-stellar": "0.2.18"
   },
   "publishConfig": {
     "access": "restricted",
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
-    "build": "pnpm build:contracts && pnpm generate:sdk",
-    "build:contracts": "pnpm exec lz-tool stellar contract build",
+    "build": "pnpm build:contracts:sandbox && pnpm generate:sdk && pnpm build:wasm",
+    "build:contracts:mainnet": "pnpm exec lz-tool stellar contract build --features mainnet",
+    "build:contracts:sandbox": "pnpm exec lz-tool stellar contract build --features sandbox",
+    "build:contracts:testnet": "pnpm exec lz-tool stellar contract build --features testnet",
+    "build:wasm": "lz-tool extra stellar build-typescript-sdk target sdk/src",
     "format": "pnpm exec lz-tool --script \"cargo fmt\" stellar",
     "generate:sdk": "pnpm exec lz-tool --script \"cargo run -p ts-bindings-gen\" stellar",
     "lint": "pnpm exec lz-tool --script \"cargo clippy -- -D warnings\" stellar",

package/sdk/.turbo/turbo-build.log

@@ -1,3 +1,4 @@
+ WARN  Issue while reading "/home/runner/work/monorepo-internal/monorepo-internal/.npmrc". Failed to replace env in config: ${NPM_TOKEN}
 
 > @layerzerolabs/lz-v2-stellar-sdk@0.0.1 build /home/runner/work/monorepo-internal/monorepo-internal/contracts/protocol/stellar/sdk
 > tsc