Implement access control: admin, whitelists, and role checks across N…

[anumukul]

Implement robust access control across all contracts

Summary

Implements a robust access control system across Commitment NFT, Commitment Core, and Attestation Engine to manage permissions and authorized callers as specified in the issue.

closes #18

Access control patterns

• Admin role management – Admin storage, getter/setter, and admin-only checks on all three contracts.
• Authorized contract whitelists – Per-contract whitelists for minters (NFT), allocators (Core), and verifiers (Attestation).
• Role-based permissions – Sensitive operations restricted to admin or whitelisted addresses.
• Owner verification – Owner checks on transfer and early_exit; shared_utils require_owner used where applicable.

Implementation

Whitelist management (all contracts)

• add_authorized_contract(caller, contract_address) – Admin-only; adds an address to the whitelist.
• remove_authorized_contract(caller, contract_address) – Admin-only; removes an address from the whitelist.
• is_authorized(contract_address) -> bool – Returns whether an address may perform the protected action.

Commitment NFT

• Mint restricted to: admin, configured core contract, or addresses in the authorized minter whitelist.
• New storage: AuthorizedMinter(Address) (existing key used).
• Events: AuthorizedContractAdded, AuthorizedContractRemoved on whitelist changes.
• Breaking: mint now takes caller as first argument: mint(caller, owner, commitment_id, ...).

Commitment Core

• allocate restricted to: admin or addresses in the authorized allocator whitelist.
• New storage: AuthorizedAllocator(Address).
• Events: AuthorizedContractAdded, AuthorizedContractRemoved on whitelist changes.
• Breaking: allocate now takes caller as first argument: allocate(caller, commitment_id, target_pool, amount).
• Fix: pause / unpause / is_paused moved from a misplaced free block into the contract impl; admin-only via stored admin and require_auth.

Attestation Engine

• attest already restricted to admin or authorized verifiers (unchanged).
• add_verifier / remove_verifier retained; added public aliases add_authorized_contract and remove_authorized_contract for API consistency.
• is_authorized(contract_address) added (delegates to existing verifier check).
• Events: existing VerifierAdded, VerifierRemoved on whitelist changes.

Security

• Unauthorized mint/allocate/attest attempts are rejected with clear errors (NotAuthorized / Unauthorized).
• All whitelist changes are logged via events for auditing.

Testing

• Commitment NFT: test_add_remove_is_authorized_contract, test_mint_unauthorized_caller_fails; all existing mint tests updated to pass caller.
• Commitment Core: test_add_remove_is_authorized_allocator, test_allocate_unauthorized_caller_fails; test_allocate_event updated with caller and mock_all_auths.
• Attestation Engine: Existing verifier and unauthorized-caller tests cover access control; no new tests required.

Breaking changes

• Commitment NFT: mint(owner, commitment_id, ...) → mint(caller, owner, commitment_id, ...). Callers (e.g. commitment_core) must pass the invoking address as caller.
• Commitment Core: allocate(commitment_id, target_pool, amount) → allocate(caller, commitment_id, target_pool, amount). Callers must pass the authorized address (admin or whitelisted allocator) as caller.

Checklist

• Admin storage and management on all contracts
• add_authorized_contract / remove_authorized_contract / is_authorized on all contracts
• Admin-only checks and owner verification where required
• Event logging for access control (whitelist) changes
• Tests for admin, whitelist management, and unauthorized access prevention
• No new unnecessary files or comments

[1nonlypiece]

@anumukul Please fix the pipeline

[anumukul]

@anumukul Please fix the pipeline

I have fixed it please review it

[1nonlypiece]

@anumukul

[1nonlypiece]

@anumukul fix the pipeline

[1nonlypiece]

@anumukul

[1nonlypiece]

@anumukul

[anumukul]

@1nonlypiece I have resolved the conflicts please review

[1nonlypiece]

@anumukul please resolve the conflicts

[anumukul]

@1nonlypiece please review

[anumukul]

@1nonlypiece please merge it