@layerzerolabs/protocol-stellar-v2 0.2.40 → 0.2.41

package/contracts/macro-integration-tests/tests/ui/upgradeable/pass/rbac.rs

@@ -0,0 +1,44 @@
+// UI (trybuild) test: `#[upgradeable(rbac)]` compiles with UpgradeableRbac.
+//
+// Purpose:
+// - Ensures the macro generates `impl UpgradeableRbac` when `rbac` is specified.
+// - Verifies upgrade/migrate take the extra `operator` parameter.
+
+use soroban_sdk::{contract, contractimpl, Address, Bytes, BytesN, Env};
+use utils::rbac::{grant_role_no_auth, RoleBasedAccessControl};
+use utils::upgradeable::{UpgradeableInternal, UPGRADER_ROLE};
+
+#[contract]
+#[common_macros::ownable]
+#[common_macros::upgradeable(rbac)]
+pub struct MyContract;
+
+impl UpgradeableInternal for MyContract {
+    type MigrationData = ();
+
+    fn __migrate(_env: &Env, _migration_data: &Self::MigrationData) {}
+}
+
+#[contractimpl(contracttrait)]
+impl RoleBasedAccessControl for MyContract {}
+
+#[contractimpl]
+impl MyContract {
+    pub fn init(env: Env, owner: Address) {
+        Self::init_owner(&env, &owner);
+    }
+
+    pub fn init_upgrader(env: Env, operator: Address) {
+        let upgrader_role = soroban_sdk::Symbol::new(&env, UPGRADER_ROLE);
+        grant_role_no_auth(&env, &operator, &upgrader_role, &env.current_contract_address());
+    }
+
+    pub fn smoke(env: Env, operator: Address) {
+        let hash = BytesN::<32>::from_array(&env, &[0u8; 32]);
+        let migration_data = Bytes::new(&env);
+        Self::upgrade(&env, &hash, &operator);
+        Self::migrate(&env, &migration_data, &operator);
+    }
+}
+
+fn main() {}

package/contracts/oapps/counter/integration_tests/utils.rs

@@ -2,7 +2,7 @@
 
 extern crate std;
 
-use crate::{codec::MsgType, counter::CounterClient, tests::mint_to};
+use crate::{codec::MsgType, counter::CounterClient, tests::{grant_oapp_admin, mint_to}};
 use endpoint_v2::{EndpointV2Client, MessagingFee, Origin, OutboundPacket};
 use message_lib_common::packet_codec_v1;
 use soroban_sdk::{
@@ -63,17 +63,19 @@ pub fn register_library(env: &Env, owner: &Address, endpoint: &EndpointV2Client<
 
 /// Sets the peer address for a counter on a destination EID.
 pub fn set_peer(env: &Env, owner: &Address, counter: &CounterClient<'_>, dst_eid: u32, peer: &BytesN<32>) {
+    grant_oapp_admin(env, &counter.address, owner);
+
     let peer_option = Some(peer.clone());
     env.mock_auths(&[MockAuth {
         address: owner,
         invoke: &MockAuthInvoke {
             contract: &counter.address,
             fn_name: "set_peer",
-            args: (&dst_eid, &peer_option).into_val(env),
+            args: (&dst_eid, &peer_option, owner).into_val(env),
             sub_invokes: &[],
         },
     }]);
-    counter.set_peer(&dst_eid, &peer_option);
+    counter.set_peer(&dst_eid, &peer_option, owner);
 }
 
 /// Decodes an outbound packet emitted by the endpoint.

package/contracts/oapps/counter/src/tests/mod.rs

@@ -1,7 +1,8 @@
+use oapp::oapp_core::OAPP_ADMIN_ROLE;
 use soroban_sdk::{
     testutils::{MockAuth, MockAuthInvoke},
     token::StellarAssetClient,
-    Address, Env, IntoVal,
+    Address, Env, IntoVal, Symbol,
 };
 
 pub mod test_codec;
@@ -23,3 +24,17 @@ pub fn mint_to(env: &Env, owner: &Address, native_token: &Address, to: &Address,
     sac.mint(to, &amount);
 }
 
+pub fn grant_oapp_admin(env: &Env, contract: &Address, owner: &Address) {
+    let role = Symbol::new(env, OAPP_ADMIN_ROLE);
+    env.mock_auths(&[MockAuth {
+        address: owner,
+        invoke: &MockAuthInvoke {
+            contract,
+            fn_name: "grant_role",
+            args: (owner, &role, owner).into_val(env),
+            sub_invokes: &[],
+        },
+    }]);
+    utils::rbac::RoleBasedAccessControlClient::new(env, contract).grant_role(owner, &role, owner);
+}
+

package/contracts/oapps/counter/src/tests/test_counter.rs

@@ -88,17 +88,20 @@ fn setup<'a>() -> TestSetup<'a> {
 }
 
 fn setup_mock_peer(env: &Env, owner: &Address, counter: &CounterClient<'_>, dst_eid: u32) -> BytesN<32> {
+    super::grant_oapp_admin(env, &counter.address, owner);
+
     let peer = BytesN::from_array(env, &[1u8; 32]);
+    let peer_option = Some(peer.clone());
     env.mock_auths(&[MockAuth {
         address: owner,
         invoke: &MockAuthInvoke {
             contract: &counter.address,
             fn_name: "set_peer",
-            args: (&dst_eid, &Some(peer.clone())).into_val(env),
+            args: (&dst_eid, &peer_option, owner).into_val(env),
             sub_invokes: &[],
         },
     }]);
-    counter.set_peer(&dst_eid, &Some(peer.clone()));
+    counter.set_peer(&dst_eid, &peer_option, owner);
     peer
 }
 

package/contracts/oapps/oapp/src/oapp_core.rs

@@ -1,8 +1,15 @@
 use crate::{errors::OAppError, oapp_receiver::RECEIVER_VERSION, oapp_sender::SENDER_VERSION};
-use common_macros::{contract_trait, only_auth, storage};
+use common_macros::{contract_trait, only_role, storage};
 use endpoint_v2::LayerZeroEndpointV2Client;
 use soroban_sdk::{contractevent, Address, BytesN, Env};
-use utils::{option_ext::OptionExt, ownable::{Ownable, OwnableInitializer}};
+use utils::{
+    option_ext::OptionExt,
+    ownable::{Ownable, OwnableInitializer},
+    rbac::RoleBasedAccessControl,
+};
+
+/// Role for OApp administrative actions (set_peer, set_delegate, set_enforced_options).
+pub const OAPP_ADMIN_ROLE: &str = "OAPP_ADMIN_ROLE";
 
 // =====================================================
 // OAppCore Storage and Events
@@ -31,7 +38,7 @@ pub struct PeerSet {
 // =====================================================
 
 #[contract_trait]
-pub trait OAppCore: Ownable {
+pub trait OAppCore: Ownable + RoleBasedAccessControl {
     /// Retrieves the OApp version information.
     ///
     /// # Returns
@@ -66,8 +73,14 @@ pub trait OAppCore: Ownable {
     /// # Arguments
     /// * `eid` - The endpoint ID
     /// * `peer` - The address of the peer to be associated with the corresponding endpoint, or None to remove the peer
-    #[only_auth]
-    fn set_peer(env: &soroban_sdk::Env, eid: u32, peer: &Option<soroban_sdk::BytesN<32>>) {
+    /// * `operator` - The address that must have OAPP_ADMIN_ROLE
+    #[only_role(operator, OAPP_ADMIN_ROLE)]
+    fn set_peer(
+        env: &soroban_sdk::Env,
+        eid: u32,
+        peer: &Option<soroban_sdk::BytesN<32>>,
+        operator: &soroban_sdk::Address,
+    ) {
         OAppCoreStorage::set_or_remove_peer(env, eid, peer);
         PeerSet { eid, peer: peer.clone() }.publish(env);
     }
@@ -76,8 +89,9 @@ pub trait OAppCore: Ownable {
     ///
     /// # Arguments
     /// * `delegate` - The address of the delegate to be set, or None to remove the delegate
-    #[only_auth]
-    fn set_delegate(env: &soroban_sdk::Env, delegate: &Option<soroban_sdk::Address>) {
+    /// * `operator` - The address that must have OAPP_ADMIN_ROLE
+    #[only_role(operator, OAPP_ADMIN_ROLE)]
+    fn set_delegate(env: &soroban_sdk::Env, delegate: &Option<soroban_sdk::Address>, operator: &soroban_sdk::Address) {
         endpoint_client::<Self>(env).set_delegate(&env.current_contract_address(), delegate);
     }
 }

package/contracts/oapps/oapp/src/oapp_options_type3.rs

@@ -1,7 +1,7 @@
-use crate::{self as oapp, errors::OAppError};
-use common_macros::{contract_trait, only_auth, storage};
+use crate::{self as oapp, errors::OAppError, oapp_core::OAPP_ADMIN_ROLE};
+use common_macros::{contract_trait, only_role, storage};
 use soroban_sdk::{assert_with_error, contractevent, contracttype, panic_with_error, Bytes, Env, Vec};
-use utils::{auth::Auth, buffer_reader::BufferReader};
+use utils::{buffer_reader::BufferReader, rbac::RoleBasedAccessControl};
 
 pub const OPTION_TYPE3: u16 = 3;
 
@@ -30,7 +30,7 @@ pub struct EnforcedOptionSet {
 // =========================================================================
 
 #[contract_trait]
-pub trait OAppOptionsType3: Auth {
+pub trait OAppOptionsType3: RoleBasedAccessControl {
     /// Retrieves the enforced options for a given endpoint and message type.
     ///
     /// # Arguments
@@ -53,10 +53,12 @@ pub trait OAppOptionsType3: Auth {
     ///
     /// # Arguments
     /// * `options` - A vector of EnforcedOptionParam structures specifying enforced options
-    #[only_auth]
+    /// * `operator` - The address that must have OAPP_ADMIN_ROLE
+    #[only_role(operator, OAPP_ADMIN_ROLE)]
     fn set_enforced_options(
         env: &soroban_sdk::Env,
         options: &soroban_sdk::Vec<oapp::oapp_options_type3::EnforcedOptionParam>,
+        operator: &soroban_sdk::Address,
     ) {
         for param in options {
             if let Some(ref opts) = param.options {

package/contracts/oapps/oapp/src/tests/mod.rs

@@ -3,3 +3,24 @@ mod oapp_options_type3;
 mod oapp_receiver;
 mod oapp_sender;
 mod test_macros;
+
+use crate::oapp_core::OAPP_ADMIN_ROLE;
+use soroban_sdk::{
+    testutils::{MockAuth, MockAuthInvoke},
+    Address, Env, IntoVal, Symbol,
+};
+
+/// Grants `OAPP_ADMIN_ROLE` to `owner` via the public `grant_role` interface.
+pub(super) fn grant_oapp_admin(env: &Env, contract: &Address, owner: &Address) {
+    let role = Symbol::new(env, OAPP_ADMIN_ROLE);
+    env.mock_auths(&[MockAuth {
+        address: owner,
+        invoke: &MockAuthInvoke {
+            contract,
+            fn_name: "grant_role",
+            args: (owner, &role, owner).into_val(env),
+            sub_invokes: &[],
+        },
+    }]);
+    utils::rbac::RoleBasedAccessControlClient::new(env, contract).grant_role(owner, &role, owner);
+}

package/contracts/oapps/oapp/src/tests/oapp_core.rs

@@ -75,6 +75,8 @@ fn setup<'a>() -> TestSetup<'a> {
     let oapp = env.register(DummyOApp, (&owner, &endpoint));
     soroban_sdk::log!(&env, "oapp: {}", oapp);
     let oapp_client = DummyOAppClient::new(&env, &oapp);
+    super::grant_oapp_admin(&env, &oapp, &owner);
+
     TestSetup { env, owner, endpoint, oapp_client }
 }
 
@@ -90,11 +92,11 @@ fn set_peer_with_auth(
         invoke: &MockAuthInvoke {
             contract: &oapp_client.address,
             fn_name: "set_peer",
-            args: (&eid, peer).into_val(env),
+            args: (&eid, peer, signer).into_val(env),
             sub_invokes: &[],
         },
     }]);
-    oapp_client.set_peer(&eid, peer);
+    oapp_client.set_peer(&eid, peer, signer);
 }
 
 fn set_delegate_with_auth(env: &Env, signer: &Address, oapp_client: &DummyOAppClient<'_>, delegate: &Option<Address>) {
@@ -103,11 +105,11 @@ fn set_delegate_with_auth(env: &Env, signer: &Address, oapp_client: &DummyOAppCl
         invoke: &MockAuthInvoke {
             contract: &oapp_client.address,
             fn_name: "set_delegate",
-            args: (delegate,).into_val(env),
+            args: (delegate, signer).into_val(env),
             sub_invokes: &[],
         },
     }]);
-    oapp_client.set_delegate(delegate);
+    oapp_client.set_delegate(delegate, signer);
 }
 
 #[test]
@@ -166,14 +168,14 @@ fn test_peer_lifecycle_set_get_update_remove_and_events() {
 #[test]
 #[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
 fn test_set_peer_unauthorized() {
-    let TestSetup { env, oapp_client, .. } = setup();
+    let TestSetup { env, owner, oapp_client, .. } = setup();
 
     let test_peer: BytesN<32> = BytesN::from_array(&env, &[33; 32]);
-    oapp_client.set_peer(&REMOTE_EID, &Some(test_peer));
+    oapp_client.set_peer(&REMOTE_EID, &Some(test_peer), &owner);
 }
 
 #[test]
-#[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
+#[should_panic(expected = "Error(Contract, #1086)")] // RbacError::Unauthorized
 fn test_set_peer_non_owner_authorized() {
     let TestSetup { env, owner, oapp_client, .. } = setup();
     let non_owner = Address::generate(&env);
@@ -204,14 +206,14 @@ fn test_set_delegate_updates_and_clears_endpoint_delegate() {
 #[test]
 #[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
 fn test_set_delegate_unauthorized() {
-    let TestSetup { env, oapp_client, .. } = setup();
+    let TestSetup { env, owner, oapp_client, .. } = setup();
 
     let delegate = Address::generate(&env);
-    oapp_client.set_delegate(&Some(delegate));
+    oapp_client.set_delegate(&Some(delegate), &owner);
 }
 
 #[test]
-#[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
+#[should_panic(expected = "Error(Contract, #1086)")] // RbacError::Unauthorized
 fn test_set_delegate_non_owner_authorized() {
     let TestSetup { env, owner, oapp_client, .. } = setup();
     let non_owner = Address::generate(&env);

package/contracts/oapps/oapp/src/tests/oapp_options_type3.rs

@@ -32,6 +32,9 @@ impl DummyEndpoint {
 #[oapp_macros::oapp(custom = [core, sender, receiver])]
 pub struct DummyOAppOptionsType3;
 
+#[contract_impl(contracttrait)]
+impl utils::rbac::RoleBasedAccessControl for DummyOAppOptionsType3 {}
+
 #[contract_impl(contracttrait)]
 impl OAppCore for DummyOAppOptionsType3 {}
 
@@ -73,6 +76,7 @@ fn setup<'a>() -> TestSetup<'a> {
     let delegate = owner.clone();
     let oapp = env.register(DummyOAppOptionsType3, (&owner, &endpoint, &delegate));
     let oapp_client = DummyOAppOptionsType3Client::new(&env, &oapp);
+    super::grant_oapp_admin(&env, &oapp, &owner);
 
     TestSetup { env, owner, oapp_client }
 }
@@ -94,11 +98,11 @@ fn set_enforced_options_with_auth(
         invoke: &MockAuthInvoke {
             contract: &oapp_client.address,
             fn_name: "set_enforced_options",
-            args: (enforced_params,).into_val(env),
+            args: (enforced_params, signer).into_val(env),
             sub_invokes: &[],
         },
     }]);
-    oapp_client.set_enforced_options(enforced_params);
+    oapp_client.set_enforced_options(enforced_params, signer);
 }
 
 #[test]
@@ -164,16 +168,16 @@ fn test_combine_options() {
 #[test]
 #[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
 fn test_set_enforced_options_unauthorized() {
-    let TestSetup { env, oapp_client, .. } = setup();
+    let TestSetup { env, owner, oapp_client, .. } = setup();
 
     let options = create_valid_options(&env, &[1, 2, 3, 4]);
     let enforced_params =
         vec![&env, EnforcedOptionParam { eid: REMOTE_EID_1, msg_type: MSG_TYPE_SEND, options: Some(options.clone()) }];
-    oapp_client.set_enforced_options(&enforced_params);
+    oapp_client.set_enforced_options(&enforced_params, &owner);
 }
 
 #[test]
-#[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
+#[should_panic(expected = "Error(Contract, #1086)")] // RbacError::Unauthorized
 fn test_set_enforced_options_non_owner_authorized() {
     let TestSetup { env, owner, oapp_client, .. } = setup();
     let non_owner = Address::generate(&env);
@@ -202,11 +206,11 @@ fn test_set_enforced_options_invalid_options_returns_error() {
         invoke: &MockAuthInvoke {
             contract: &oapp_client.address,
             fn_name: "set_enforced_options",
-            args: (&enforced_params,).into_val(&env),
+            args: (&enforced_params, &owner).into_val(&env),
             sub_invokes: &[],
         },
     }]);
-    let result = oapp_client.try_set_enforced_options(&enforced_params);
+    let result = oapp_client.try_set_enforced_options(&enforced_params, &owner);
     assert_eq!(result.err().unwrap().ok().unwrap(), OAppError::InvalidOptions.into());
 }
 

package/contracts/oapps/oapp/src/tests/oapp_receiver.rs

@@ -95,6 +95,8 @@ fn setup<'a>() -> TestSetup<'a> {
     let endpoint = env.register(MockEndpoint, (&native_token,));
     let oapp = env.register(DummyOAppReceiver, (&owner, &endpoint));
     let oapp_client = DummyOAppReceiverClient::new(&env, &oapp);
+    super::grant_oapp_admin(&env, &oapp, &owner);
+
     TestSetup { env, owner, endpoint, token_admin, native_token, native_token_admin_client, oapp_client }
 }
 
@@ -105,11 +107,11 @@ fn set_peer(env: &Env, owner: &Address, oapp_client: &DummyOAppReceiverClient<'_
         invoke: &MockAuthInvoke {
             contract: &oapp_client.address,
             fn_name: "set_peer",
-            args: (&eid, &peer_option).into_val(env),
+            args: (&eid, &peer_option, owner).into_val(env),
             sub_invokes: &[],
         },
     }]);
-    oapp_client.set_peer(&eid, &peer_option);
+    oapp_client.set_peer(&eid, &peer_option, owner);
 }
 
 fn lz_receive(

package/contracts/oapps/oapp/src/tests/oapp_sender.rs

@@ -152,6 +152,7 @@ fn setup<'a>() -> TestSetup<'a> {
     // Deploy OApp
     let oapp = env.register(DummyOAppSender, (&owner, &endpoint));
     let oapp_client = DummyOAppSenderClient::new(&env, &oapp);
+    super::grant_oapp_admin(&env, &oapp, &owner);
 
     TestSetup {
         env,
@@ -180,11 +181,11 @@ fn set_peer_with_auth(
         invoke: &MockAuthInvoke {
             contract: &oapp_client.address,
             fn_name: "set_peer",
-            args: (&eid, &peer_option).into_val(env),
+            args: (&eid, &peer_option, owner).into_val(env),
             sub_invokes: &[],
         },
     }]);
-    oapp_client.set_peer(&eid, &peer_option);
+    oapp_client.set_peer(&eid, &peer_option, owner);
 }
 
 fn mint_to(

package/contracts/oapps/oapp/src/tests/test_macros.rs

@@ -42,6 +42,9 @@ mod test_full_manual_core {
     #[oapp(custom = [core])]
     struct TestFullManualCore;
 
+    #[soroban_sdk::contractimpl(contracttrait)]
+    impl utils::rbac::RoleBasedAccessControl for TestFullManualCore {}
+
     #[contractimpl(contracttrait)]
     impl OAppCore for TestFullManualCore {
         fn oapp_version(_env: &Env) -> (u64, u64) {
@@ -191,6 +194,9 @@ mod test_full_manual_core_sender {
     #[oapp(custom = [core, sender])]
     struct TestFullManualCoreSender;
 
+    #[soroban_sdk::contractimpl(contracttrait)]
+    impl utils::rbac::RoleBasedAccessControl for TestFullManualCoreSender {}
+
     #[contractimpl(contracttrait)]
     impl OAppCore for TestFullManualCoreSender {
         fn oapp_version(_env: &Env) -> (u64, u64) {
@@ -234,6 +240,9 @@ mod test_full_manual_core_receiver {
     #[oapp(custom = [core, receiver])]
     struct TestFullManualCoreReceiver;
 
+    #[soroban_sdk::contractimpl(contracttrait)]
+    impl utils::rbac::RoleBasedAccessControl for TestFullManualCoreReceiver {}
+
     #[contractimpl(contracttrait)]
     impl OAppCore for TestFullManualCoreReceiver {
         fn oapp_version(_env: &Env) -> (u64, u64) {
@@ -316,6 +325,9 @@ mod test_full_manual_all_except_options {
     #[oapp(custom = [core, sender, receiver])]
     struct TestFullManualAllExceptOptions;
 
+    #[soroban_sdk::contractimpl(contracttrait)]
+    impl utils::rbac::RoleBasedAccessControl for TestFullManualAllExceptOptions {}
+
     #[contractimpl(contracttrait)]
     impl OAppCore for TestFullManualAllExceptOptions {
         fn oapp_version(_env: &Env) -> (u64, u64) {
@@ -364,6 +376,9 @@ mod test_full_manual_all {
     #[oapp(custom = [core, sender, receiver, options_type3])]
     struct TestFullManualAll;
 
+    #[soroban_sdk::contractimpl(contracttrait)]
+    impl utils::rbac::RoleBasedAccessControl for TestFullManualAll {}
+
     #[contractimpl(contracttrait)]
     impl OAppCore for TestFullManualAll {
         fn oapp_version(_env: &Env) -> (u64, u64) {

package/contracts/oapps/oapp-macros/src/generators.rs

@@ -98,12 +98,18 @@ pub fn generate_oapp(attr: TokenStream, input: TokenStream) -> TokenStream {
 
 /// Generates an empty `impl OAppCore` that uses the trait's default implementations
 /// for peer management and endpoint access.
+///
+/// Also generates `impl RoleBasedAccessControl` because OAppCore extends it.
 fn generate_oapp_core(name: &Ident) -> TokenStream {
     quote! {
         use oapp::oapp_core::OAppCore as _;
+        use utils::rbac::RoleBasedAccessControl as _;
 
         #[soroban_sdk::contractimpl(contracttrait)]
         impl oapp::oapp_core::OAppCore for #name {}
+
+        #[soroban_sdk::contractimpl(contracttrait)]
+        impl utils::rbac::RoleBasedAccessControl for #name {}
     }
 }
 

package/contracts/oapps/oapp-macros/src/tests/snapshots/oapp_macros__tests__oapp__snapshot_generate_oapp.snap

@@ -8,8 +8,11 @@ expression: combined
 #[common_macros::lz_contract]
 pub struct MyOApp;
 use oapp::oapp_core::OAppCore as _;
+use utils::rbac::RoleBasedAccessControl as _;
 #[soroban_sdk::contractimpl(contracttrait)]
 impl oapp::oapp_core::OAppCore for MyOApp {}
+#[soroban_sdk::contractimpl(contracttrait)]
+impl utils::rbac::RoleBasedAccessControl for MyOApp {}
 use oapp::oapp_sender::OAppSenderInternal as _;
 impl oapp::oapp_sender::OAppSenderInternal for MyOApp {}
 use oapp::oapp_receiver::OAppReceiver as _;
@@ -39,8 +42,11 @@ impl oapp::oapp_options_type3::OAppOptionsType3 for MyOApp {}
 #[common_macros::lz_contract]
 pub struct MyOApp;
 use oapp::oapp_core::OAppCore as _;
+use utils::rbac::RoleBasedAccessControl as _;
 #[soroban_sdk::contractimpl(contracttrait)]
 impl oapp::oapp_core::OAppCore for MyOApp {}
+#[soroban_sdk::contractimpl(contracttrait)]
+impl utils::rbac::RoleBasedAccessControl for MyOApp {}
 use oapp::oapp_receiver::OAppReceiver as _;
 #[soroban_sdk::contractimpl(contracttrait)]
 impl oapp::oapp_receiver::OAppReceiver for MyOApp {}
@@ -54,8 +60,11 @@ impl oapp::oapp_options_type3::OAppOptionsType3 for MyOApp {}
 #[common_macros::lz_contract]
 pub struct MyOApp;
 use oapp::oapp_core::OAppCore as _;
+use utils::rbac::RoleBasedAccessControl as _;
 #[soroban_sdk::contractimpl(contracttrait)]
 impl oapp::oapp_core::OAppCore for MyOApp {}
+#[soroban_sdk::contractimpl(contracttrait)]
+impl utils::rbac::RoleBasedAccessControl for MyOApp {}
 use oapp::oapp_sender::OAppSenderInternal as _;
 impl oapp::oapp_sender::OAppSenderInternal for MyOApp {}
 use oapp::oapp_options_type3::OAppOptionsType3 as _;
@@ -68,8 +77,11 @@ impl oapp::oapp_options_type3::OAppOptionsType3 for MyOApp {}
 #[common_macros::lz_contract]
 pub struct MyOApp;
 use oapp::oapp_core::OAppCore as _;
+use utils::rbac::RoleBasedAccessControl as _;
 #[soroban_sdk::contractimpl(contracttrait)]
 impl oapp::oapp_core::OAppCore for MyOApp {}
+#[soroban_sdk::contractimpl(contracttrait)]
+impl utils::rbac::RoleBasedAccessControl for MyOApp {}
 use oapp::oapp_sender::OAppSenderInternal as _;
 impl oapp::oapp_sender::OAppSenderInternal for MyOApp {}
 use oapp::oapp_receiver::OAppReceiver as _;
@@ -91,8 +103,11 @@ pub struct FancyOApp {
     pub x: u32,
 }
 use oapp::oapp_core::OAppCore as _;
+use utils::rbac::RoleBasedAccessControl as _;
 #[soroban_sdk::contractimpl(contracttrait)]
 impl oapp::oapp_core::OAppCore for FancyOApp {}
+#[soroban_sdk::contractimpl(contracttrait)]
+impl utils::rbac::RoleBasedAccessControl for FancyOApp {}
 use oapp::oapp_sender::OAppSenderInternal as _;
 impl oapp::oapp_sender::OAppSenderInternal for FancyOApp {}
 use oapp::oapp_receiver::OAppReceiver as _;

package/contracts/oapps/oft/integration-tests/setup.rs

@@ -10,12 +10,13 @@ use crate::{
     oft_types::OftType,
 };
 use endpoint_v2::{EndpointV2, EndpointV2Client};
+use oapp::oapp_core::OAPP_ADMIN_ROLE;
 use simple_message_lib::{SimpleMessageLib, SimpleMessageLibClient};
 use soroban_sdk::{
     contract, contractimpl, contracttype, log,
     testutils::{Address as _, MockAuth, MockAuthInvoke},
     token::{StellarAssetClient, TokenClient},
-    Address, BytesN, Env, IntoVal,
+    Address, BytesN, Env, IntoVal, Symbol,
 };
 
 // ============================================================================
@@ -126,7 +127,7 @@ fn setup_chain<'a>(env: &Env) -> ChainSetup<'a> {
     let shared_decimals: u32 = 6; // Default shared decimals
                                   // MintBurn with SAC wrapper: OFT uses wrapper for mint on credit; burn is on token directly.
     let mode = OftType::MintBurn(sac_wrapper_address.clone());
-    let oft_address = env.register(OFT, (&oft_token, &shared_decimals, &mode, &owner, &endpoint_address, &delegate));
+    let oft_address = env.register(OFT, (&oft_token, &shared_decimals, &mode, &endpoint_address, delegate.as_ref().unwrap()));
 
     let endpoint = EndpointV2Client::new(env, &endpoint_address);
     let sml = SimpleMessageLibClient::new(env, &sml_address);
@@ -213,17 +214,34 @@ pub fn wire_oft(env: &Env, chains: &[&ChainSetup<'_>]) {
     }
 }
 
+fn grant_oapp_admin(env: &Env, contract: &Address, owner: &Address) {
+    let role = Symbol::new(env, OAPP_ADMIN_ROLE);
+    env.mock_auths(&[MockAuth {
+        address: owner,
+        invoke: &MockAuthInvoke {
+            contract,
+            fn_name: "grant_role",
+            args: (owner, &role, owner).into_val(env),
+            sub_invokes: &[],
+        },
+    }]);
+    utils::rbac::RoleBasedAccessControlClient::new(env, contract).grant_role(owner, &role, owner);
+}
+
 pub fn set_peer(env: &Env, owner: &Address, oft: &OFTClient<'_>, dst_eid: u32, peer: &BytesN<32>) {
+    grant_oapp_admin(env, &oft.address, owner);
+
+    let peer_option = Some(peer.clone());
     env.mock_auths(&[MockAuth {
         address: owner,
         invoke: &MockAuthInvoke {
             contract: &oft.address,
             fn_name: "set_peer",
-            args: (&dst_eid, &Some(peer.clone())).into_val(env),
+            args: (&dst_eid, &peer_option, owner).into_val(env),
             sub_invokes: &[],
         },
     }]);
-    oapp::oapp_core::OAppCoreClient::new(env, &oft.address).set_peer(&dst_eid, &Some(peer.clone()));
+    oapp::oapp_core::OAppCoreClient::new(env, &oft.address).set_peer(&dst_eid, &peer_option, owner);
 }
 
 pub fn register_library(env: &Env, owner: &Address, endpoint: &EndpointV2Client<'_>, lib: &Address) {