test(contracts): add authorization coverage for registry mutations #467

[stevengrams]

Overview

This PR adds explicit authorization test coverage for every public state-changing registry operation on TalosRegistry, verifying that caller boundaries (admin, creator, patron, unauthorized) are strictly enforced and that rejected calls do not mutate storage or emit misleading events.

Re-submission of #477, rebased onto current main with all production code preserved.

Related Issue

Closes #467

Changes

🧪 Test Coverage & Authorization Boundary Verification

• [NEW] auth_create_talos_unauthorized_fails_and_leaves_storage_and_events_unchanged
  • Verifies that unauthorized callers attempting to create a Talos are rejected, NextTalosId is not incremented, no record is stored, and no events are emitted.
• [NEW] auth_update_patron_unauthorized_fails_and_preserves_state_and_events
  • Asserts that updating patron configuration without creator authorization fails, preserving existing share distributions and emitting no events.
• [NEW] auth_update_kernel_unauthorized_fails_and_preserves_state
  • Verifies non-creator callers cannot modify kernel thresholds or GTM budget.
• [NEW] auth_update_pulse_unauthorized_fails_and_preserves_state
  • Ensures pulse token configuration remains immutable to unauthorized callers.
• [NEW] auth_deactivate_talos_unauthorized_fails_and_remains_active
  • Verifies deactivation requires creator auth and leaves the Talos active upon rejection.
• [NEW] auth_governance_and_timelock_unauthorized_mutations_fail
  • Covers timelock configurations (set_timelock_config), action scheduling (schedule_action), action cancellation (cancel_action), and batch touch maintenance (touch_batch).
• [FIX] Restored pause-control dependency in talos_registry/Cargo.toml.
• [FIX] Updated pause_control and storage_migration test harnesses to use registered contracts per soroban-sdk requirements.

Verification Results

cargo test -p talos-registry
test result: ok. 51 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

cargo test -p talos-name-service
test result: ok. 27 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

cargo test -p talos-governance
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

Acceptance Criteria	Status
Each public state-changing method has an explicit authorization test	✅ Added tests for create_talos, update_patron, update_kernel, update_pulse, deactivate_talos, set_timelock_config, schedule_action, cancel_action, touch_batch
Unauthorized calls fail with stable behavior	✅ Enforced via require_auth & verified with try_*
Storage and event state remain unchanged after rejection	✅ State & event count assertions pass on failure paths
Production code preserved	✅ Rebased onto current main; all pause controls, compatibility, and contract behavior intact

[vercel]

@stevengrams is attempting to deploy a commit to the Cankat's projects Team on Vercel.

A member of the Team first needs to authorize it.