Fix #360 #361 #377 #391: voting auth, cast_vote event, pending-transfer query, admin resume tests

[JamesVictor-O]

Summary

Resolves four open issues assigned to me in a single combined changeset. All 338 tests pass.

Issue #377 — voting::set_params removes dead _admin parameter

• Problem: _admin: Address was passed to voting::set_params but never used — no require_auth() was called, creating a misleading signature.
• Fix: Remove the parameter entirely. Authorization is enforced exclusively by lib.rs::assert_admin, which calls admin.require_auth() before delegating to voting::set_params. Keeping a dead parameter was not defense-in-depth; it was dead code.

Issue #391 — cast_vote event now includes voter balance and vote weight

• Problem: The campaign_vote_cast event only emitted (campaign_id, voter, approve). Off-chain indexers could not independently verify the weighted tally without fetching historical RPC balances.
• Fix: Event data is now (approve, balance, vote_weight) — providing the voter's token balance and the resulting weight in-event, making the tally fully reproducible from logs alone.

Issue #361 — Add has_pending_campaign_transfer view function

• Problem: No on-chain query path existed to discover whether a campaign has a pending ownership transfer. The pending creator had to learn the campaign ID out-of-band.
• Fix: Added pub fn has_pending_campaign_transfer(env: Env, campaign_id: u32) -> bool — returns true if pending_creator != None, false for unknown IDs. Enables off-chain tooling to index pending transfers without iterating all campaigns.

Issue #360 — Missing admin-path tests for resume_campaign

• Problem: Existing tests only exercised the creator resuming their own campaign. The admin bypass path had no test coverage, leaving potential regressions invisible.
• Fix: Added three new tests in issues_test.rs:
  • test_resume_by_admin — admin (not the creator) can lift an auto-pause
  • test_resume_unauthorized_fails — random address is correctly rejected with NotAuthorized
  • test_resume_after_campaign_transfer_uses_new_creator — after ownership transfer, the NEW creator holds the resume right; original creator is rejected

Test plan

• cargo test — all 338 tests pass
• test_resume_by_admin passes (admin can resume)
• test_resume_unauthorized_fails passes (stranger rejected)
• test_resume_after_campaign_transfer_uses_new_creator passes (new creator resumes, old creator fails)
• test_set_voting_params_emits_event still passes (no double-auth regression)
• test_vote_on_campaign_basic_flow event payload includes (approve, balance, vote_weight)

Closes #360
Closes #361
Closes #377
Closes #391

🤖 Generated with Claude Code

[drips-wave]

@JamesVictor-O Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[sshdopey]

Auto-review failed (API error). Leaving PR for human review.

[sshdopey]

Auto-review failed (API error). Leaving PR for human review.