Harden access control (analytics/ipfs-metadata), wire quorum_guard, document third-party API

[phertyameen]

Summary

Hardens access control across two contracts, wires a dead module back into the build, and completes the third-party API documentation. One commit, four assigned issues.

analytics — typed admin authorization (#967)

ensure_admin used a panicking assert_eq!, so unauthorized calls to admin-gated messages reverted without a typed error and were indistinguishable from any other failure. It now returns Err(AnalyticsError::Unauthorized). All eight admin-gated messages (update_market_metrics, batch_update_metrics, batch_add_trends, add_market_trend, update_market_sentiment, set_portfolio_positions, update_property_type_trend, update_benchmark_index) return Result<_, AnalyticsError>; add_market_trend gains an error surface it previously lacked entirely.

• 9 new unit tests: one per message asserting a non-admin caller receives the typed error (no panic), plus a full admin success-path test.

ipfs-metadata — metadata/document-store takeover fix (#966)

validate_and_register_metadata let any caller overwrite any property's stored metadata and grant themselves AccessLevel::Admin, which then satisfied check_write_access for register_ipfs_document/update_document/remove_document. Now:

• callers must already hold Write or Admin on the property (check_write_access);
• the contract admin remains the bootstrap path and receives persistent Admin on the property;
• authorized non-admin writers are never escalated.
• 3 new tests: unauthenticated validation rejected and no write access leaks afterwards; admin bootstrap flow works end-to-end; granted writer can operate without gaining escalation rights over others.

monitoring — compile the dead quorum_guard module (#968)

quorum_guard.rs was never declared in lib.rs, so its quorum-regression tracking existed only on disk (its own tests never ran). Wired as pub mod quorum_guard; with a doc note that automatic recording hooks into governance events are out of scope for this crate. Its four tests now run under cargo test -p propchain-monitoring.

third-party — complete public-API docs (#965)

Documented the three undocumented messages (get_service_config, get_kyc_record, get_payment_request) with behavior, caller requirements, and None-vs-error semantics, and expanded is_kyc_verified docs with the verification-level ladder plus activeness/expiry rules. cargo doc -p propchain-third-party --no-deps builds cleanly.

Test results

• cargo test -p propchain-monitoring: 22 passed (18 existing + 4 quorum_guard)
• cargo test -p propchain-analytics: 9 passed (new suite)
• cargo test -p ipfs-metadata: 6 passed (3 existing + 3 new)
• cargo test -p propchain-third-party: passes (0 tests; coverage tracked separately)

Closes #968
Closes #967
Closes #966
Closes #965

[drips-wave]

@phertyameen Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits