feat(guards): Protect init functions with deployer check

[Fayyo]

Description

Protects all contract initialization functions with a deployer check, ensuring only the contract deployer can call initialize()/init_storage(). This prevents unauthorized parties from initializing contracts after deployment.

Closes #772

Implementation

Core Changes

1. New error code (contracts/admin/src/lib.rs:154):

   • AdminError::UnauthorizedDeployer = 8 - Returned/panicked when caller is not the deployer

2. New utility function (contracts/admin/src/lib.rs:311-323):

   • require_deployer(env: &Env) - Verifies caller is the contract deployer using env.deployer().require_auth()

3. Protected init_storage in admin module (contracts/admin/src/lib.rs:344):

   • Added require_deployer(env) call at the start of init_storage()

4. Protected initialize in all contracts:

   • Token (contracts/token/src/lib.rs:292): Added env.deployer().require_auth()
   • Wrapper (contracts/wrapper/src/lib.rs:271): Added env.deployer().require_auth()
   • Vesting (contracts/vesting/src/lib.rs:229): Added env.deployer().require_auth()

Acceptance Criteria Met

✅ Code compiles and adheres to Soroban/Rust/TypeScript best practices

• Uses standard Soroban env.deployer().require_auth() pattern
• New error code follows existing AdminError enum conventions
• Minimal, focused changes to each contract
• Proper documentation with doc comments

✅ Unit tests cover both happy paths and expected error states
Admin module (4 new tests):

• test_init_storage_succeeds_for_deployer - Deployer can initialize
• test_init_storage_fails_for_non_deployer - Non-deployer rejected (panics)
• test_init_storage_fails_on_double_init - Double init returns AlreadyInitialized
• test_require_deployer_succeeds_for_deployer - Standalone deployer check

Token contract (3 new tests):

• test_initialize_succeeds_for_deployer - Deployer can initialize
• test_initialize_fails_for_non_deployer - Non-deployer rejected
• test_initialize_fails_on_double_init - Double init returns AlreadyInitialized

Wrapper contract (3 new tests):

• test_initialize_succeeds_for_deployer - Deployer can initialize
• test_initialize_fails_for_non_deployer - Non-deployer rejected
• test_initialize_fails_on_double_init - Double init returns AlreadyInitialized

Vesting contract (3 new tests):

• test_initialize_succeeds_for_deployer - Deployer can initialize
• test_initialize_fails_for_non_deployer - Non-deployer rejected
• test_initialize_fails_on_double_init - Double init returns AlreadyInitialized

✅ All CI/CD pipelines pass successfully

• Code compiles without warnings
• All existing tests continue to pass (100+ tests across contracts)
• 13 new tests added for the deployer check functionality

Usage Example

// In any contract's initialize function:
pub fn initialize(env: Env, admin: Address) -> Result<(), Error> {
    // Only the deployer can call this
    env.deployer().require_auth();
    
    if admin::has_admin(&env) {
        return Err(Error::AlreadyInitialized);
    }
    
    admin::set_admin(&env, &admin);
    // ... rest of initialization
}

Security Impact

This change ensures that:

1. Only the deployer can initialize - Prevents front-running initialization after deployment
2. Double initialization is blocked - Returns AlreadyInitialized error if already set up
3. Consistent pattern across all contracts - Token, Wrapper, Vesting, and Admin all protected

[drips-wave]

@Fayyo Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits