Add view auth snapshot tests

README.md

@@ -1,5 +1,13 @@
 # Callora Contracts
 
+## Auth snapshot coverage
+
+Focused per-entrypoint auth snapshot tests cover read-only view entrypoints so
+regressions in `require_auth` behavior are caught by test diffs. Current view
+coverage includes capability views in `cold`, `emergency`, and `stake`, plus
+`yield` limits read views and the vault's `simulate_deduct` pre-flight view.
+
+
 Soroban smart contracts for the Callora API marketplace: prepaid vault (USDC) and balance deduction for pay-per-call settlement.
 
 [![CI](https://github.com/CalloraOrg/Callora-Contracts/actions/workflows/ci.yml/badge.svg)](https://github.com/CalloraOrg/Callora-Contracts/actions/workflows/ci.yml)

contracts/emergency/tests/auth_snap.rs

@@ -0,0 +1,37 @@
+#![cfg(test)]
+
+extern crate std;
+
+use callora_emergency::{CalloraEmergency, CalloraEmergencyClient, ALL_CAPABILITIES};
+use soroban_sdk::Env;
+
+fn create_contract(env: &Env) -> CalloraEmergencyClient<'_> {
+    let contract_id = env.register(CalloraEmergency, ());
+    CalloraEmergencyClient::new(env, &contract_id)
+}
+
+#[test]
+fn capabilities_does_not_require_auth() {
+    let env = Env::default();
+    let client = create_contract(&env);
+
+    env.set_auths(&[]);
+    let caps = client.capabilities();
+    assert_eq!(caps, ALL_CAPABILITIES);
+}
+
+#[test]
+fn capabilities_returns_nonzero() {
+    let env = Env::default();
+    let client = create_contract(&env);
+
+    assert_ne!(client.capabilities(), 0);
+}
+
+#[test]
+fn capabilities_equals_all_capabilities_constant() {
+    let env = Env::default();
+    let client = create_contract(&env);
+
+    assert_eq!(client.capabilities(), ALL_CAPABILITIES);
+}

contracts/vault/tests/auth_snap.rs

@@ -259,6 +259,17 @@ fn balance_does_not_require_auth() {
     assert_eq!(client.balance(), 500);
 }
 
+#[test]
+fn simulate_deduct_does_not_require_auth() {
+    let env = Env::default();
+    let (_owner, caller, client, _usdc_addr, _usdc_client, _usdc_admin) = setup_with_balance(&env, 500);
+    let developer = Address::generate(&env);
+
+    env.set_auths(&[]);
+    let res = client.simulate_deduct(&caller, &100_i128, &None, &u32::MAX, &developer);
+    assert_eq!(res, Ok(400));
+}
+
 #[test]
 fn get_owner_does_not_require_auth() {
     let env = Env::default();