Implement the authorization, admin and ownership detectors (16 checks, fixtures ready)

[luhrhenz]

Goal

Expand the scanner's authorization, admin and ownership coverage. The detectors below are on the roadmap and not yet implemented — each one is an independent, self-contained piece of work.

These are ready to pick up today. Every entry already has a committed test fixture pair under test-contracts/, so the expected behaviour is pinned before you write a line of code: the scanner must report a finding on the -vulnerable crate and stay silent on the -safe one. You are not guessing at requirements.

Detector	Fixture (under test-contracts/)
address_from_str	address-from-str-vulnerable / address-from-str-safe
address_str_eq	address_str_eq-vulnerable
addr_param_no_auth	addr-param-no-auth-vulnerable / addr-param-no-auth-safe
admin_in_temp	admin-in-temp-vulnerable / admin-in-temp-safe
auth_after_write	auth-after-write-vulnerable / auth-after-write-safe
auth_in_branch	auth_in_branch-vulnerable / auth_in_branch-safe
auth_on_literal_addr	auth-on-literal-addr-vulnerable / auth-on-literal-addr-safe
auth_shadow	auth-shadow-vulnerable / auth-shadow-safe
auth_untrusted_storage	auth_untrusted_storage-vulnerable / auth_untrusted_storage-safe
ownership_immediate	ownership-immediate-vulnerable / ownership-immediate-safe
redundant_auth_args	redundant-auth-args-vulnerable / redundant-auth-args-safe
renounce_no_backup	renounce-no-backup-vulnerable / renounce-no-backup-safe
sig_verify_inverted	sig-verify-inverted-vulnerable / sig-verify-inverted-safe
unauth_address_tuple	unauth-address-tuple-vulnerable / unauth-address-tuple-safe
unauth_fee_setter	unauth-fee-setter-vulnerable / unauth-fee-setter-safe
unauth_storage_remove	unauth-storage-remove-vulnerable / unauth-storage-remove-safe

How to build one

Pick one detector from the table and claim it in a comment. One detector per PR — that keeps review fast and lets several people work in parallel.

1. Create crates/checks/src/<name>.rs.
2. Implement the Check trait — name() and run(&self, file: &syn::File, source: &str) -> Vec<Finding>. crates/checks/src/auth.rs is the reference implementation to model: it uses syn::visit::Visit to walk function bodies and crate::util::contractimpl_functions to enumerate #[contractimpl] methods.
3. Register it in crates/checks/src/lib.rs in all three places, or it will compile but never run:
   • pub mod <name>;
   • pub use <name>::<Struct>;
   • Box::new(<Struct>) inside default_checks()
4. Add unit tests in a #[cfg(test)] module in your file.
5. Verify against the fixtures:

cargo build --release
./target/release/soroban-guard scan test-contracts/<name>-vulnerable   # must report your finding
./target/release/soroban-guard scan test-contracts/<name>-safe         # must not

Acceptance criteria

• Fires on the -vulnerable fixture, silent on the -safe one.
• Unit tests cover at least one positive and one negative case.
• Severity is justified in the PR description.
• cargo fmt, cargo clippy -- -D warnings and cargo test are clean.

Notes on quality

A good detector is precise, not just present. Aim for:

• Low false positives. Flagging correct code is worse than missing a bug — it trains people to ignore the tool. The -safe fixture is the floor, not the target; think about what other legitimate patterns could trip your logic.
• Actionable descriptions. The description field should tell the reader what an attacker can actually do, not restate the rule. Compare "missing require_auth" against "Callers may mutate contract state without proving they are authorized."
• Set check_name, severity, line and function_name. Leave file_path empty — the analyzer fills it in.