[Solana] Add RMN Curser role, independent from RMN owner

chains/evm/deployment/tokens/tokenimpl/helpers.go

@@ -1,6 +1,7 @@
 package tokenimpl
 
 import (
+	"context"
 	"fmt"
 	"math/big"
 
@@ -38,6 +39,22 @@ func revokeDefaultAdminRoleBurnMintERC20(b cldf_ops.Bundle, chain evm.Chain, tok
 	return []contract.WriteOutput{report.Output}, nil
 }
 
+func hasDefaultAdminRoleBurnMintERC20(ctx context.Context, chain evm.Chain, token, user common.Address) (bool, error) {
+	tokenContract, err := bnm_erc20_bindings.NewBurnMintERC20(token, chain.Client)
+	if err != nil {
+		return false, fmt.Errorf("failed to instantiate BurnMintERC20 contract: %w", err)
+	}
+	role, err := tokenContract.DEFAULTADMINROLE(&bind.CallOpts{Context: ctx})
+	if err != nil {
+		return false, fmt.Errorf("failed to get default admin role constant: %w", err)
+	}
+	hasRole, err := tokenContract.HasRole(&bind.CallOpts{Context: ctx}, role, user)
+	if err != nil {
+		return false, fmt.Errorf("failed to check default admin role for %s: %w", user.Hex(), err)
+	}
+	return hasRole, nil
+}
+
 func grantDefaultAdminRoleBurnMintERC20(b cldf_ops.Bundle, chain evm.Chain, token, user common.Address) ([]contract.WriteOutput, error) {
 	tokenContract, err := bnm_erc20_bindings.NewBurnMintERC20(token, chain.Client)
 	if err != nil {

chains/evm/deployment/tokens/tokenimpl/impl.go

@@ -1,6 +1,7 @@
 package tokenimpl
 
 import (
+	"context"
 	"math/big"
 
 	"github.com/ethereum/go-ethereum/common"
@@ -46,6 +47,11 @@ type Token interface {
 	// role from user. Callers should consult SupportsAdminRole first.
 	RevokeAdminRole(b cldf_ops.Bundle, chain evm.Chain, token, user common.Address) ([]contract.WriteOutput, error)
 
+	// HasAdminRole checks whether user has the default-admin or contract-specific
+	// admin role. Returns an error for token types whose Capabilities.SupportsAdminRole
+	// is false; callers should consult that flag first.
+	HasAdminRole(ctx context.Context, chain evm.Chain, token, user common.Address) (bool, error)
+
 	// GrantAdminRole grants the default-admin or contract-specific
 	// admin role to user. Returns an error for token types whose
 	// Capabilities.SupportsAdminRole is false; callers should consult

chains/evm/deployment/tokens/tokenimpl/token_burn_mint_erc20.go

@@ -1,6 +1,7 @@
 package tokenimpl
 
 import (
+	"context"
 	"fmt"
 	"math/big"
 
@@ -35,6 +36,10 @@ func (tokenBurnMintERC20) RevokeAdminRole(b operations.Bundle, chain evm.Chain,
 	return revokeDefaultAdminRoleBurnMintERC20(b, chain, token, user)
 }
 
+func (tokenBurnMintERC20) HasAdminRole(ctx context.Context, chain evm.Chain, token, user common.Address) (bool, error) {
+	return hasDefaultAdminRoleBurnMintERC20(ctx, chain, token, user)
+}
+
 func (tokenBurnMintERC20) GrantAdminRole(b operations.Bundle, chain evm.Chain, token, externalAdmin common.Address) ([]contract.WriteOutput, error) {
 	return grantDefaultAdminRoleBurnMintERC20(b, chain, token, externalAdmin)
 }

chains/evm/deployment/tokens/tokenimpl/token_burn_mint_erc20_with_drip_v1_0_0.go

@@ -1,6 +1,7 @@
 package tokenimpl
 
 import (
+	"context"
 	"fmt"
 	"math/big"
 
@@ -38,6 +39,10 @@ func (tokenBurnMintERC20WithDripV1_0_0) RevokeAdminRole(b operations.Bundle, cha
 	return revokeDefaultAdminRoleBurnMintERC20(b, chain, token, externalAdmin)
 }
 
+func (tokenBurnMintERC20WithDripV1_0_0) HasAdminRole(ctx context.Context, chain evm.Chain, token, user common.Address) (bool, error) {
+	return hasDefaultAdminRoleBurnMintERC20(ctx, chain, token, user)
+}
+
 func (tokenBurnMintERC20WithDripV1_0_0) GrantAdminRole(b operations.Bundle, chain evm.Chain, token, externalAdmin common.Address) ([]contract.WriteOutput, error) {
 	return grantDefaultAdminRoleBurnMintERC20(b, chain, token, externalAdmin)
 }

chains/evm/deployment/tokens/tokenimpl/token_burn_mint_erc20_with_drip_v1_5_0.go

@@ -1,6 +1,7 @@
 package tokenimpl
 
 import (
+	"context"
 	"fmt"
 	"math/big"
 
@@ -34,6 +35,10 @@ func (tokenBurnMintERC20WithDripV1_5_0) RevokeAdminRole(b operations.Bundle, cha
 	return revokeDefaultAdminRoleBurnMintERC20(b, chain, token, externalAdmin)
 }
 
+func (tokenBurnMintERC20WithDripV1_5_0) HasAdminRole(ctx context.Context, chain evm.Chain, token, user common.Address) (bool, error) {
+	return hasDefaultAdminRoleBurnMintERC20(ctx, chain, token, user)
+}
+
 func (tokenBurnMintERC20WithDripV1_5_0) GrantAdminRole(b operations.Bundle, chain evm.Chain, token, externalAdmin common.Address) ([]contract.WriteOutput, error) {
 	return grantDefaultAdminRoleBurnMintERC20(b, chain, token, externalAdmin)
 }

chains/evm/deployment/tokens/tokenimpl/token_burn_mint_erc677.go

@@ -1,6 +1,7 @@
 package tokenimpl
 
 import (
+	"context"
 	"fmt"
 	"math/big"
 
@@ -37,6 +38,10 @@ func (tokenBurnMintERC677) RevokeAdminRole(_ operations.Bundle, _ evm.Chain, _,
 	return nil, fmt.Errorf("admin role revoke not supported for BurnMintERC677 token type")
 }
 
+func (tokenBurnMintERC677) HasAdminRole(_ context.Context, _ evm.Chain, _, _ common.Address) (bool, error) {
+	return false, fmt.Errorf("admin role checks not supported for BurnMintERC677 token type")
+}
+
 func (tokenBurnMintERC677) GrantAdminRole(_ operations.Bundle, _ evm.Chain, _, _ common.Address) ([]contract.WriteOutput, error) {
 	return nil, fmt.Errorf("admin role grant not supported for BurnMintERC677 token type")
 }

chains/evm/deployment/tokens/tokenimpl/token_erc20.go

@@ -1,6 +1,7 @@
 package tokenimpl
 
 import (
+	"context"
 	"fmt"
 	"math/big"
 
@@ -35,6 +36,10 @@ func (tokenERC20) RevokeAdminRole(_ operations.Bundle, _ evm.Chain, _, _ common.
 	return nil, fmt.Errorf("admin role not supported for plain ERC20 token")
 }
 
+func (tokenERC20) HasAdminRole(_ context.Context, _ evm.Chain, _, _ common.Address) (bool, error) {
+	return false, fmt.Errorf("admin role checks not supported for plain ERC20 token")
+}
+
 func (tokenERC20) GrantAdminRole(_ operations.Bundle, _ evm.Chain, _, _ common.Address) ([]contract.WriteOutput, error) {
 	return nil, fmt.Errorf("admin role granting not supported for plain ERC20 token")
 }

chains/evm/deployment/tokens/tokenimpl/token_tip20.go

@@ -1,9 +1,11 @@
 package tokenimpl
 
 import (
+	"context"
 	"fmt"
 	"math/big"
 
+	"github.com/ethereum/go-ethereum/accounts/abi/bind"
 	"github.com/ethereum/go-ethereum/common"
 
 	"github.com/smartcontractkit/chainlink-ccip/chains/evm/deployment/v1_0_0/operations/tip20"
@@ -42,6 +44,18 @@ func (tokenTIP20) RevokeAdminRole(b operations.Bundle, chain evm.Chain, token, u
 	return []contract.WriteOutput{report.Output}, nil
 }
 
+func (tokenTIP20) HasAdminRole(ctx context.Context, chain evm.Chain, token, user common.Address) (bool, error) {
+	tokenContract, err := tip20.NewTIP20Token(token, chain.Client)
+	if err != nil {
+		return false, fmt.Errorf("failed to instantiate TIP-20 token contract: %w", err)
+	}
+	hasRole, err := tokenContract.HasRole(&bind.CallOpts{Context: ctx}, user, tip20.DefaultAdminRole)
+	if err != nil {
+		return false, fmt.Errorf("failed to check TIP-20 admin role for %s: %w", user.Hex(), err)
+	}
+	return hasRole, nil
+}
+
 func (tokenTIP20) GrantAdminRole(b operations.Bundle, chain evm.Chain, token, user common.Address) ([]contract.WriteOutput, error) {
 	report, err := operations.ExecuteOperation(b, tip20.GrantAdminRole, chain, contract.FunctionInput[common.Address]{
 		ChainSelector: chain.Selector,

chains/evm/deployment/utils/datastore/datastore.go

@@ -9,6 +9,18 @@ import (
 	datastore_utils "github.com/smartcontractkit/chainlink-ccip/deployment/utils/datastore"
 )
 
+// ToNonZeroEVMAddress formats a datastore.AddressRef into an ethereum common.Address, ensuring the address is not the zero address.
+func ToNonZeroEVMAddress(ref datastore.AddressRef) (commonAddress common.Address, err error) {
+	addr, err := ToEVMAddress(ref)
+	if err != nil {
+		return common.Address{}, fmt.Errorf("failed to convert address ref to EVM address: %w", err)
+	}
+	if addr == (common.Address{}) {
+		return common.Address{}, fmt.Errorf("address is the zero address in ref: %s", datastore_utils.SprintRef(ref))
+	}
+	return addr, nil
+}
+
 // ToEVMAddress formats a datastore.AddressRef into an ethereum common.Address.
 func ToEVMAddress(ref datastore.AddressRef) (commonAddress common.Address, err error) {
 	if ref.Address == "" {