fix(contracts): admin-only mint auth matrix/docs; treasury signer-spe…

contract/AUTH_MATRIX.md

@@ -37,7 +37,7 @@ Contracts covered here (deployed by `contract/scripts/deploy.sh`):
 | `approve(env, from, spender, amount, expiration_ledger)` | `from` | `from` signs and sets allowance to `spender`. | `spender` signs on behalf of `from`. |
 | `transfer_from(env, spender, from, to, amount)` | `spender` | `spender` signs and spends from prior allowance. | `from` signs but `spender` does not. |
 | `allowance(env, from, spender)` | `none` | Any caller queries active allowance. | Expecting signer/auth to be required for read. |
-| `mint(env, to, amount)` | `none` | Any caller invokes mint to increase `to` balance. | Expecting only admin to mint (not enforced by auth checks). |
+| `mint(env, to, amount)` | `admin` | Current admin signs and mints new tokens to `to`. | Non-admin signs and tries to mint; `require_auth` fails. |
 | `balance(env, id)` | `none` | Any caller reads `id` balance. | Expecting signer/auth to be required for read. |
 | `transfer(env, from, to, amount)` | `from` | `from` signs and transfers own balance. | Third-party caller submits transfer from `from` without `from` auth. |
 

contract/contracts/treasury/src/test.rs

@@ -827,8 +827,32 @@ fn test_unauthorized_deposit_reverts() {
     let treasury_id = env.register_contract(None, Treasury);
     let treasury_client = TreasuryClient::new(&env, &treasury_id);
 
-    env.mock_all_auths();
+    // Signer-specific auth: the admin signs for the token mint and for
+    // treasury initialize. No mock_all_auths in the auth test path.
+    env.mock_auths(&[MockAuth {
+        address: &admin,
+        invoke: &MockAuthInvoke {
+            contract: &token_address,
+            fn_name: "mint",
+            args: soroban_sdk::vec![&env, user.clone().into_val(&env), 1000_i128.into_val(&env)],
+            sub_invokes: &[],
+        },
+    }]);
     admin_client.mint(&user, &1000);
+
+    env.mock_auths(&[MockAuth {
+        address: &admin,
+        invoke: &MockAuthInvoke {
+            contract: &treasury_id,
+            fn_name: "initialize",
+            args: soroban_sdk::vec![
+                &env,
+                admin.clone().into_val(&env),
+                token_address.clone().into_val(&env),
+            ],
+            sub_invokes: &[],
+        },
+    }]);
     treasury_client.initialize(&admin, &token_address);
 
     // Attempt deposit without any auth.

contract/docs/interfaces/myfans-token.md

@@ -14,7 +14,7 @@ Standard token implementation.
 | `transfer_from` | `spender: Address, from: Address, to: Address, amount: i128` | `()` | spender | `soroban contract invoke ... transfer_from -- SPENDER FROM TO 100` | `("transfer", from, to) -> amount` |
 | `clear_allowance` | `from: Address, spender: Address` | `()` | from | `soroban contract invoke ... clear_allowance -- FROM SPENDER` | None |
 | `allowance` | `from: Address, spender: Address` | `i128` | none | `soroban contract invoke ... allowance -- FROM SPENDER` | None |
-| `mint` | `to: Address, amount: i128` | `()` | admin? | `soroban contract invoke ... mint -- TO 1000` | `("mint", to) -> amount` |
+| `mint` | `to: Address, amount: i128` | `()` | admin | `soroban contract invoke ... mint -- TO 1000` | `("mint", to) -> amount` |
 | `burn` | `from: Address, amount: i128` | `()` | from | `soroban contract invoke ... burn -- FROM 100` | `("burn", from) -> amount` |
 | `balance` / `transfer` | `id: Address` / `from: Address, to: Address, amount: i128` | `i128` / `()` | none/from | `soroban contract invoke ... transfer -- FROM TO 100` | `("transfer", from, to) -> amount` |