env.mock_all_auths() is called in TestSetup::new() (used by ~45 of the ~50 tests in src/lib.rs's mod tests), in every test's setup() helper in mod test, and in the shared setup() helpers of tests/lifecycle.rs, tests/proptest_amounts.rs, and tests/proptest_timestamps.rs — 15 call sites in total, confirmed via grep. This blanket auth bypass means the overwhelming majority of the test suite would pass identically whether or not create_vault's creator.require_auth(), validate_milestone's verifier/creator require_auth(), release_funds's creator.require_auth(), or cancel_vault's creator.require_auth() actually executed at all. Only a handful of dedicated tests (test_create_vault_fails_without_auth, test_cancel_vault_non_creator_fails, and similar) construct a fresh, unmocked Env specifically to test authorization, meaning a regression that accidentally removed or weakened any require_auth() call elsewhere in the contract would go completely undetected by the rest of the suite. Consider adding at least one authorization-focused integration test per mutating entrypoint that runs without mock_all_auths(), verifying the real Soroban auth-checking path rather than relying on the mock.
env.mock_all_auths() is called in TestSetup::new() (used by ~45 of the ~50 tests in src/lib.rs's
mod tests), in every test's setup() helper inmod test, and in the shared setup() helpers of tests/lifecycle.rs, tests/proptest_amounts.rs, and tests/proptest_timestamps.rs — 15 call sites in total, confirmed via grep. This blanket auth bypass means the overwhelming majority of the test suite would pass identically whether or not create_vault's creator.require_auth(), validate_milestone's verifier/creator require_auth(), release_funds's creator.require_auth(), or cancel_vault's creator.require_auth() actually executed at all. Only a handful of dedicated tests (test_create_vault_fails_without_auth, test_cancel_vault_non_creator_fails, and similar) construct a fresh, unmocked Env specifically to test authorization, meaning a regression that accidentally removed or weakened any require_auth() call elsewhere in the contract would go completely undetected by the rest of the suite. Consider adding at least one authorization-focused integration test per mutating entrypoint that runs without mock_all_auths(), verifying the real Soroban auth-checking path rather than relying on the mock.