Merge pull request #224 from SarahDoma/fix/issue-170-173-174-167-doc-and-ci-fixes

Fix stale audit row, add missing refund test, run cargo doc in CI, commit lockfile

Author: chonilius

.github/workflows/ci.yml

@@ -25,6 +25,11 @@ jobs:
       - run: cargo clippy --workspace --all-targets -- -D warnings
       - run: cargo test --workspace
 
+      - name: Check documentation (catches broken intra-doc links)
+        env:
+          RUSTDOCFLAGS: "-D warnings"
+        run: cargo doc --workspace --no-deps --document-private-items
+
       - name: Generate and print code coverage
         run: cargo llvm-cov --workspace
 

.gitignore

@@ -24,4 +24,3 @@ test_snapshots/
 
 # deploy script dependencies (scripts/)
 node_modules/
-package-lock.json

contracts/escrow/src/test.rs

@@ -834,6 +834,29 @@ fn test_contribute_rejects_after_already_paid() {
     assert_eq!(err, Err(Ok(Error::AlreadyPaid)));
 }
 
+#[test]
+fn test_contribute_rejects_after_already_refunded() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let (_, _admin, _treasury, client) = setup(&env);
+
+    let token_admin = Address::generate(&env);
+    let (token_addr, asset_client, _token_client) = create_token(&env, &token_admin);
+    let alice = Address::generate(&env);
+    let bob = Address::generate(&env);
+    asset_client.mint(&alice, &10_000i128);
+    asset_client.mint(&bob, &10_000i128);
+
+    env.ledger().set_timestamp(100);
+    client.fund(&106u64, &alice, &token_addr, &5_000i128, &200u64, &None);
+
+    env.ledger().set_timestamp(200 + crate::GRACE_PERIOD);
+    client.refund(&106u64);
+
+    let err = client.try_contribute(&106u64, &bob, &1_000i128);
+    assert_eq!(err, Err(Ok(Error::AlreadyRefunded)));
+}
+
 #[test]
 fn test_contribute_rejects_beyond_max_sponsors() {
     let env = Env::default();

docs/access-control-audit.md

@@ -17,8 +17,8 @@ signature requirement on any particular address.
 | `initialize` | Deployer/authorized setup only (implicit — not written down anywhere) | none | `admin.require_auth()` | **Mismatch, fixed** — see "`initialize` has no access control" below |
 | `fund` | Sponsor-only | `sponsor.require_auth()` | unchanged | Match |
 | `release` | Admin-only | `require_admin(&env)?.require_auth()` | unchanged | Match |
-| `refund` (before `deadline`) | Admin-only | `require_admin(&env)?.require_auth()` | unchanged | Match |
-| `refund` (at/after `deadline`) | Permissionless (deliberate) | none | unchanged | Match — see [refund analysis](./refund-permissionless-analysis.md) |
+| `refund` (before `deadline + GRACE_PERIOD`) | Admin-only | `require_admin(&env)?.require_auth()` | unchanged | Match |
+| `refund` (at/after `deadline + GRACE_PERIOD`) | Permissionless (deliberate) | none | unchanged | Match — see [refund analysis](./refund-permissionless-analysis.md). The permissionless window opens at `deadline + GRACE_PERIOD`, not at `deadline` itself; the 14-day `GRACE_PERIOD` was introduced by [#49](https://github.com/MergeFi/contracts/issues/49) to close a race where a sponsor could call permissionless `refund()` right at `deadline` to claw back funds from a contributor whose `release()` had already landed. |
 | `extend_deadline` (new, this PR) | Sponsor-only, monotonic | n/a | `escrow.sponsor.require_auth()` + `new_deadline` must strictly increase | Match (new function) |
 | `get_escrow` | Permissionless (view) | none | unchanged | Match |
 | `get_admin` | Permissionless (view) | none | unchanged | Match |