From fb6b5b80c6faf11bad5c1b75d302472c08474b13 Mon Sep 17 00:00:00 2001 From: Leigh <351529+leighmcculloch@users.noreply.github.com> Date: Tue, 21 Jul 2026 21:19:06 +0000 Subject: [PATCH 1/6] document constructor auth behavior for register/register_at --- docs/build/guides/testing/test-contract-auth.mdx | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/build/guides/testing/test-contract-auth.mdx b/docs/build/guides/testing/test-contract-auth.mdx index 522c0a49e7..f4db573232 100644 --- a/docs/build/guides/testing/test-contract-auth.mdx +++ b/docs/build/guides/testing/test-contract-auth.mdx @@ -58,3 +58,13 @@ fn test() { For the full example the above snippet is extracted from, see the [auth example contract](../../smart-contracts/example-contracts/auth.mdx). ::: + +## Authorization in constructors + +If a contract's constructor calls `require_auth()` (or `require_auth_for_args()`), both `env.register(...)` and `env.register_at(...)` switch the environment to recording-auth mode, inherited from the current auth manager, for the duration of the constructor invocation, then restore the previous auth manager afterward. This means constructor auth checks succeed for Wasm contracts registered with either function, without requiring `mock_all_auths()` to be called first. + +:::caution + +This only applies to contracts registered from Wasm bytes. If a contract is registered as a native/mock Rust value for testing (not from Wasm), its constructor invocation does not switch to recording auth. In that case, a `require_auth()` call in the constructor still requires `mock_all_auths()` (or explicit auth mocking) to be set up beforehand. + +::: From 5451c50c28416a9ced3626ea97f48a5dc46cb319 Mon Sep 17 00:00:00 2001 From: Leigh <351529+leighmcculloch@users.noreply.github.com> Date: Tue, 21 Jul 2026 21:20:57 +0000 Subject: [PATCH 2/6] note native contract auth gap is a current limitation --- docs/build/guides/testing/test-contract-auth.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/build/guides/testing/test-contract-auth.mdx b/docs/build/guides/testing/test-contract-auth.mdx index f4db573232..c23a5e965d 100644 --- a/docs/build/guides/testing/test-contract-auth.mdx +++ b/docs/build/guides/testing/test-contract-auth.mdx @@ -65,6 +65,6 @@ If a contract's constructor calls `require_auth()` (or `require_auth_for_args()` :::caution -This only applies to contracts registered from Wasm bytes. If a contract is registered as a native/mock Rust value for testing (not from Wasm), its constructor invocation does not switch to recording auth. In that case, a `require_auth()` call in the constructor still requires `mock_all_auths()` (or explicit auth mocking) to be set up beforehand. +This only applies to contracts registered from Wasm bytes. If a contract is registered as a native/mock Rust value for testing (not from Wasm), its constructor invocation does not currently switch to recording auth. In that case, a `require_auth()` call in the constructor still requires `mock_all_auths()` (or explicit auth mocking) to be set up beforehand. ::: From 472f8473d130098870a55c502e0300972ead5f95 Mon Sep 17 00:00:00 2001 From: Leigh <351529+leighmcculloch@users.noreply.github.com> Date: Wed, 22 Jul 2026 10:07:33 +1000 Subject: [PATCH 3/6] Update test-contract-auth.mdx --- docs/build/guides/testing/test-contract-auth.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/build/guides/testing/test-contract-auth.mdx b/docs/build/guides/testing/test-contract-auth.mdx index c23a5e965d..50622a6009 100644 --- a/docs/build/guides/testing/test-contract-auth.mdx +++ b/docs/build/guides/testing/test-contract-auth.mdx @@ -61,10 +61,10 @@ For the full example the above snippet is extracted from, see the [auth example ## Authorization in constructors -If a contract's constructor calls `require_auth()` (or `require_auth_for_args()`), both `env.register(...)` and `env.register_at(...)` switch the environment to recording-auth mode, inherited from the current auth manager, for the duration of the constructor invocation, then restore the previous auth manager afterward. This means constructor auth checks succeed for Wasm contracts registered with either function, without requiring `mock_all_auths()` to be called first. +If a contract's constructor calls `require_auth()` (or `require_auth_for_args()`), both `env.register(...)` and `env.register_at(...)` switch the environment to recording-auth mode, inherited from the current auth manager, for the duration of the constructor invocation, then restore the previous auth manager afterward. This means constructor auth checks succeed for contracts registered with either function, without requiring `mock_all_auths()` to be called first. :::caution -This only applies to contracts registered from Wasm bytes. If a contract is registered as a native/mock Rust value for testing (not from Wasm), its constructor invocation does not currently switch to recording auth. In that case, a `require_auth()` call in the constructor still requires `mock_all_auths()` (or explicit auth mocking) to be set up beforehand. +This behaviour was not consistent in some versions of the `soroban-sdk` due to a issue, but is consistent as of v27.0.2. ::: From e130a872ff9e61faa281b4eb50c31dc16eec0935 Mon Sep 17 00:00:00 2001 From: Leigh <351529+leighmcculloch@users.noreply.github.com> Date: Wed, 22 Jul 2026 10:09:23 +1000 Subject: [PATCH 4/6] Update authorization notes in test-contract-auth guide Clarify the behavior of authorization in constructors and note the version consistency of the soroban-sdk. --- docs/build/guides/testing/test-contract-auth.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/build/guides/testing/test-contract-auth.mdx b/docs/build/guides/testing/test-contract-auth.mdx index 50622a6009..e655eaf76e 100644 --- a/docs/build/guides/testing/test-contract-auth.mdx +++ b/docs/build/guides/testing/test-contract-auth.mdx @@ -63,6 +63,8 @@ For the full example the above snippet is extracted from, see the [auth example If a contract's constructor calls `require_auth()` (or `require_auth_for_args()`), both `env.register(...)` and `env.register_at(...)` switch the environment to recording-auth mode, inherited from the current auth manager, for the duration of the constructor invocation, then restore the previous auth manager afterward. This means constructor auth checks succeed for contracts registered with either function, without requiring `mock_all_auths()` to be called first. +To have auth in a constructor execute as it will in production the contract must be deployed in the test using the standard deployment functions after being built to Wasm. + :::caution This behaviour was not consistent in some versions of the `soroban-sdk` due to a issue, but is consistent as of v27.0.2. From 7991edc16f89096d2b02cec2f2ad9551f9ea3546 Mon Sep 17 00:00:00 2001 From: Elliot Voris Date: Thu, 23 Jul 2026 08:52:43 -0500 Subject: [PATCH 5/6] correct an article use "a" -> "an" Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/build/guides/testing/test-contract-auth.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/build/guides/testing/test-contract-auth.mdx b/docs/build/guides/testing/test-contract-auth.mdx index e655eaf76e..cd6f37ab08 100644 --- a/docs/build/guides/testing/test-contract-auth.mdx +++ b/docs/build/guides/testing/test-contract-auth.mdx @@ -67,6 +67,6 @@ To have auth in a constructor execute as it will in production the contract must :::caution -This behaviour was not consistent in some versions of the `soroban-sdk` due to a issue, but is consistent as of v27.0.2. +This behaviour was not consistent in some versions of the `soroban-sdk` due to an issue, but is consistent as of v27.0.2. ::: From 51fcf2769587116dec1fc9c6e2597e76210824b9 Mon Sep 17 00:00:00 2001 From: Leigh <351529+leighmcculloch@users.noreply.github.com> Date: Fri, 24 Jul 2026 09:09:07 +1000 Subject: [PATCH 6/6] Update docs/build/guides/testing/test-contract-auth.mdx Co-authored-by: Elliot Voris --- docs/build/guides/testing/test-contract-auth.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/build/guides/testing/test-contract-auth.mdx b/docs/build/guides/testing/test-contract-auth.mdx index cd6f37ab08..17f8cec910 100644 --- a/docs/build/guides/testing/test-contract-auth.mdx +++ b/docs/build/guides/testing/test-contract-auth.mdx @@ -61,7 +61,7 @@ For the full example the above snippet is extracted from, see the [auth example ## Authorization in constructors -If a contract's constructor calls `require_auth()` (or `require_auth_for_args()`), both `env.register(...)` and `env.register_at(...)` switch the environment to recording-auth mode, inherited from the current auth manager, for the duration of the constructor invocation, then restore the previous auth manager afterward. This means constructor auth checks succeed for contracts registered with either function, without requiring `mock_all_auths()` to be called first. +If a contract's constructor calls `require_auth()` (or `require_auth_for_args()`), both `env.register(...)` and `env.register_at(...)` switch the environment to recording-auth mode for the duration of the constructor invocation, inheriting the mode from the current auth manager. Once the constructor returns, the previous auth manager is restored. This means constructor auth checks succeed for contracts registered with either function, without requiring `mock_all_auths()` to be called first. To have auth in a constructor execute as it will in production the contract must be deployed in the test using the standard deployment functions after being built to Wasm.