Test Authorization

Tests can assert on the auths that are expected to occur.

The following example sets up a test environment, registers an increment contract, and checks after the increment invocation what auths were required.

#[test]
fn test() {
    let env = Env::default();
    env.mock_all_auths();
    let contract_id = env.register(IncrementContract, ());
    let client = IncrementContractClient::new(&env, &contract_id);

    let user_1 = Address::random(&env);

    assert_eq!(client.increment(&user_1, &5), 5);

    // Verify that the user indeed had to authorize a call of `increment` with
    // the expected arguments:
    assert_eq!(
        // Get the auths that were seen in the last invocation.
        env.auths(),
        std::vec![(
            // Address for which authorization check is performed
            user_1.clone(),
            // Invocation tree that needs to be authorized
            AuthorizedInvocation {
                // Function that is authorized. Can be a contract function or
                // a host function that requires authorization.
                function: AuthorizedFunction::Contract((
                    // Address of the called contract
                    contract_id.clone(),
                    // Name of the called function
                    symbol_short!("increment"),
                    // Arguments used to call `increment` (converted to the
                    // env-managed vector via `into_val`)
                    (user_1.clone(), 5_u32).into_val(&env),
                )),
                // The contract doesn't call any other contracts that require
                // authorization,
                sub_invocations: std::vec![]
            }
        )]
    );
}

tip

For the full example the above snippet is extracted from, see the auth example contract.

Authorization in constructors

If a contract's constructor calls require_auth() (or require_auth_for_args()), both env.register(...) and env.register_at(...) switch the environment to recording-auth mode for the duration of the constructor invocation, inheriting the mode from the current auth manager. Once the constructor returns, the previous auth manager is restored. This means constructor auth checks succeed for contracts registered with either function, without requiring mock_all_auths() to be called first.

To have auth in a constructor execute as it will in production the contract must be deployed in the test using the standard deployment functions after being built to Wasm.

caution

This behaviour was not consistent in some versions of the soroban-sdk due to an issue, but is consistent as of v27.0.2.