:bug: Fixing authority account mutability

clients/csharp/Solana.Unity.Bolt.Test/ECSTest.cs

@@ -108,11 +108,11 @@ namespace ECSTest {
 
         public static async Task ApplySimpleMovementSystemUpOnEntity1(Framework framework) {
             var apply = new ApplyAccounts() {
-                CpiAuth = WorldProgram.CPI_AUTH_ADDRESS,
+                CpiAuth = WorldProgram.FindCpiAuthPda(),
                 Authority = framework.Wallet.Account.PublicKey,
                 BoltSystem = framework.SystemSimpleMovement,
                 World = framework.WorldPda,
-                Buffer = WorldProgram.FindBufferPda(),
+                Buffer = WorldProgram.FindBufferPda(framework.Wallet.Account.PublicKey),
             };
             var instruction = WorldProgram.Apply(apply, Bolt.World.SerializeArgs(new { direction = "Up" }));
             instruction.Keys.Add(AccountMeta.ReadOnly(framework.ExampleComponentPosition, false));

clients/csharp/Solana.Unity.Bolt/WorldProgram/Bolt/DestroyComponent.cs

@@ -30,7 +30,7 @@ namespace Bolt {
         public static async Task<DestroyComponentInstruction> DestroyComponent(PublicKey authority, PublicKey receiver, PublicKey entity, PublicKey componentProgram, PublicKey componentPda) {
             var componentProgramData = WorldProgram.FindComponentProgramDataPda(componentProgram);
             var destroyComponent = new DestroyComponentAccounts() {
-                CpiAuth = WorldProgram.CPI_AUTH_ADDRESS,
+                CpiAuth = WorldProgram.FindCpiAuthPda(),
                 Authority = authority,
                 Receiver = receiver,
                 Entity = entity,

clients/csharp/Solana.Unity.Bolt/WorldProgram/Bolt/InitializeComponent.cs

@@ -30,7 +30,7 @@ namespace Bolt {
 
         public static async Task<InitializeComponentInstruction> InitializeComponent(PublicKey payer, PublicKey entity, PublicKey componentId, PublicKey componentPda, PublicKey authority = null) {
             var initializeComponent = new InitializeComponentAccounts() {
-                CpiAuth = WorldProgram.CPI_AUTH_ADDRESS,
+                CpiAuth = WorldProgram.FindCpiAuthPda(),
                 Payer = payer,
                 Entity = entity,
                 Data = componentPda,

clients/csharp/Solana.Unity.Bolt/WorldProgram/Generated.cs

@@ -513,7 +513,7 @@ namespace World
             {
                 programId ??= new(ID);
                 List<Solana.Unity.Rpc.Models.AccountMeta> keys = new()
-                {Solana.Unity.Rpc.Models.AccountMeta.Writable(accounts.Buffer, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.BoltSystem, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.Authority, true), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.CpiAuth, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.World, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.SystemProgram, false)};
+                {Solana.Unity.Rpc.Models.AccountMeta.Writable(accounts.Buffer, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.BoltSystem, false), Solana.Unity.Rpc.Models.AccountMeta.Writable(accounts.Authority, true), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.CpiAuth, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.World, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.SystemProgram, false)};
                 byte[] _data = new byte[1200];
                 int offset = 0;
                 _data.WriteU64(16258613031726085112UL, offset);
@@ -531,7 +531,7 @@ namespace World
             {
                 programId ??= new(ID);
                 List<Solana.Unity.Rpc.Models.AccountMeta> keys = new()
-                {Solana.Unity.Rpc.Models.AccountMeta.Writable(accounts.Buffer, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.BoltSystem, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.Authority, true), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.CpiAuth, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.World, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.SessionToken, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.SystemProgram, false)};
+                {Solana.Unity.Rpc.Models.AccountMeta.Writable(accounts.Buffer, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.BoltSystem, false), Solana.Unity.Rpc.Models.AccountMeta.Writable(accounts.Authority, true), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.CpiAuth, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.World, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.SessionToken, false), Solana.Unity.Rpc.Models.AccountMeta.ReadOnly(accounts.SystemProgram, false)};
                 byte[] _data = new byte[1200];
                 int offset = 0;
                 _data.WriteU64(7459768094276011477UL, offset);

clients/csharp/Solana.Unity.Bolt/WorldProgram/World.cs

@@ -15,8 +15,6 @@ namespace World
     {
         public partial class WorldProgram
         {
-            public static readonly PublicKey CPI_AUTH_ADDRESS = new("B2f2y3QTBv346wE6nWKor72AUhUvFF6mPk7TWCF2QVhi");
-
             public static Solana.Unity.Rpc.Models.TransactionInstruction AddEntity(AddEntityAccounts accounts, PublicKey programId = null)
             {
                 programId ??= new(ID);
@@ -29,14 +27,18 @@ namespace World
                 return AddEntity(accounts, System.Text.Encoding.UTF8.GetBytes(extraSeed), programId);
             }
 
-            public static PublicKey FindBufferPda() {
+            public static PublicKey FindCpiAuthPda() {
                 PublicKey.TryFindProgramAddress(new[]
                 {
-                    Encoding.UTF8.GetBytes("buffer"),
+                    Encoding.UTF8.GetBytes("cpi_auth"),
                 }, new PublicKey(ID), out var pda, out _);
                 return pda;
             }
 
+            public static PublicKey FindBufferPda(PublicKey account) {
+                return FindBufferPda(account, new PublicKey(ID));
+            }
+
             public static PublicKey FindSessionTokenPda(PublicKey sessionSigner, PublicKey authority)
             {
                 PublicKey.TryFindProgramAddress(new[]
@@ -233,8 +235,8 @@ namespace World
                 Solana.Unity.Rpc.Models.TransactionInstruction instruction;
                 if (sessionToken != null) {
                     var apply = new ApplyWithSessionAccounts() {
-                        CpiAuth = CPI_AUTH_ADDRESS,
-                        Buffer = FindBufferPda(),
+                        CpiAuth = WorldProgram.FindCpiAuthPda(),
+                        Buffer = FindBufferPda(authority),
                         BoltSystem = system,
                         Authority = authority,
                         World = world,
@@ -243,8 +245,8 @@ namespace World
                     instruction = ApplyWithSession(apply, args, programId);
                 } else {
                     var apply = new ApplyAccounts() {
-                        CpiAuth = CPI_AUTH_ADDRESS,
-                        Buffer = FindBufferPda(),
+                        CpiAuth = WorldProgram.FindCpiAuthPda(),
+                        Buffer = FindBufferPda(authority),
                         BoltSystem = system,
                         Authority = authority,
                         World = world,

clients/typescript/src/generated/idl/world.json

@@ -125,6 +125,7 @@
         },
         {
           "name": "authority",
+          "writable": true,
           "signer": true
         },
         {
@@ -167,6 +168,7 @@
         },
         {
           "name": "authority",
+          "writable": true,
           "signer": true
         },
         {
@@ -521,6 +523,19 @@
         218
       ]
     },
+    {
+      "name": "SessionToken",
+      "discriminator": [
+        233,
+        4,
+        115,
+        14,
+        46,
+        21,
+        1,
+        15
+      ]
+    },
     {
       "name": "World",
       "discriminator": [
@@ -597,6 +612,30 @@
         ]
       }
     },
+    {
+      "name": "SessionToken",
+      "type": {
+        "kind": "struct",
+        "fields": [
+          {
+            "name": "authority",
+            "type": "pubkey"
+          },
+          {
+            "name": "target_program",
+            "type": "pubkey"
+          },
+          {
+            "name": "session_signer",
+            "type": "pubkey"
+          },
+          {
+            "name": "valid_until",
+            "type": "i64"
+          }
+        ]
+      }
+    },
     {
       "name": "World",
       "type": {

clients/typescript/src/generated/instructions/apply.ts

@@ -7,7 +7,7 @@
 
 import * as beet from "@metaplex-foundation/beet";
 import * as web3 from "@solana/web3.js";
-import { CPI_AUTH_ADDRESS } from "../../world/transactions";
+import { FindCpiAuthPda } from "../../index";
 
 /**
  * @category Instructions
@@ -98,7 +98,7 @@ export function createApplyInstruction(
       isSigner: false,
     },
     {
-      pubkey: CPI_AUTH_ADDRESS,
+      pubkey: FindCpiAuthPda(),
       isWritable: false,
       isSigner: false,
     },

clients/typescript/src/generated/instructions/initializeComponent.ts

@@ -7,7 +7,7 @@
 
 import * as beet from "@metaplex-foundation/beet";
 import * as web3 from "@solana/web3.js";
-import { CPI_AUTH_ADDRESS } from "../../world/transactions";
+import { FindCpiAuthPda } from "../../index";
 
 /**
  * @category Instructions
@@ -89,7 +89,7 @@ export function createInitializeComponentInstruction(
       isSigner: false,
     },
     {
-      pubkey: CPI_AUTH_ADDRESS,
+      pubkey: FindCpiAuthPda(),
       isWritable: false,
       isSigner: false,
     },

clients/typescript/src/generated/types/world.ts

@@ -98,6 +98,7 @@ export type World = {
         },
         {
           name: "authority";
+          writable: true;
           signer: true;
         },
         {
@@ -131,6 +132,7 @@ export type World = {
         },
         {
           name: "authority";
+          writable: true;
           signer: true;
         },
         {
@@ -383,6 +385,10 @@ export type World = {
       name: "registry";
       discriminator: [47, 174, 110, 246, 184, 182, 252, 218];
     },
+    {
+      name: "sessionToken";
+      discriminator: [233, 4, 115, 14, 46, 21, 1, 15];
+    },
     {
       name: "world";
       discriminator: [145, 45, 170, 174, 122, 32, 155, 124];
@@ -450,6 +456,30 @@ export type World = {
         ];
       };
     },
+    {
+      name: "sessionToken";
+      type: {
+        kind: "struct";
+        fields: [
+          {
+            name: "authority";
+            type: "pubkey";
+          },
+          {
+            name: "targetProgram";
+            type: "pubkey";
+          },
+          {
+            name: "sessionSigner";
+            type: "pubkey";
+          },
+          {
+            name: "validUntil";
+            type: "i64";
+          },
+        ];
+      };
+    },
     {
       name: "world";
       type: {

clients/typescript/src/index.ts

@@ -99,9 +99,16 @@ export function FindComponentProgramDataPda({
   )[0];
 }
 
-export function FindBufferPda() {
+export function FindBufferPda(owner: PublicKey) {
   return PublicKey.findProgramAddressSync(
-    [Buffer.from("buffer")], // TODO: Everyone will share the same buffer. We need to optimize this to derive a different buffer for each user or transaction.
+    [Buffer.from("buffer"), owner.toBuffer()],
+    WORLD_PROGRAM_ID,
+  )[0];
+}
+
+export function FindCpiAuthPda() {
+  return PublicKey.findProgramAddressSync(
+    [Buffer.from("cpi_auth")],
     WORLD_PROGRAM_ID,
   )[0];
 }

clients/typescript/src/world/transactions.ts

@@ -18,6 +18,7 @@ import {
   BN,
   FindComponentProgramDataPda,
   FindBufferPda,
+  FindCpiAuthPda,
 } from "../index";
 import web3 from "@solana/web3.js";
 import {
@@ -35,10 +36,6 @@ import {
 } from "../generated";
 import { type Idl, Program } from "@coral-xyz/anchor";
 
-export const CPI_AUTH_ADDRESS = new web3.PublicKey(
-  "B2f2y3QTBv346wE6nWKor72AUhUvFF6mPk7TWCF2QVhi",
-);
-
 export async function InitializeRegistry({
   payer,
   connection,
@@ -366,7 +363,7 @@ export async function DestroyComponent({
       componentProgram,
       componentProgramData,
       receiver,
-      cpiAuth: CPI_AUTH_ADDRESS,
+      cpiAuth: FindCpiAuthPda(),
     })
     .instruction();
   const transaction = new Transaction().add(instruction);
@@ -492,12 +489,12 @@ async function createApplySystemInstruction({
     return program.methods
       .applyWithSession(SerializeArgs(args))
       .accounts({
-        buffer: FindBufferPda(),
+        buffer: FindBufferPda(authority ?? PROGRAM_ID),
         authority: authority ?? PROGRAM_ID,
         boltSystem: systemId,
         sessionToken: session.token,
         world,
-        cpiAuth: CPI_AUTH_ADDRESS,
+        cpiAuth: FindCpiAuthPda(),
       })
       .remainingAccounts(remainingAccounts)
       .instruction();
@@ -505,11 +502,11 @@ async function createApplySystemInstruction({
     return program.methods
       .apply(SerializeArgs(args))
       .accounts({
-        buffer: FindBufferPda(),
+        buffer: FindBufferPda(authority ?? PROGRAM_ID),
         authority: authority ?? PROGRAM_ID,
         boltSystem: systemId,
         world,
-        cpiAuth: CPI_AUTH_ADDRESS,
+        cpiAuth: FindCpiAuthPda(),
       })
       .remainingAccounts(remainingAccounts)
       .instruction();

clients/typescript/test/low-level/ecs.ts

@@ -6,10 +6,9 @@ import {
   FindComponentProgramDataPda,
   FindEntityPda,
   SerializeArgs,
-  CPI_AUTH_ADDRESS,
 } from "../../lib";
 import { Direction } from "../framework";
-import { FindBufferPda } from "../../src";
+import { FindBufferPda, FindCpiAuthPda } from "../../src";
 
 export function ecs(framework) {
   describe("ECS", () => {
@@ -106,7 +105,7 @@ export function ecs(framework) {
           data: framework.componentVelocityEntity1Pda,
           componentProgram: componentId,
           authority: framework.provider.wallet.publicKey,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -127,7 +126,7 @@ export function ecs(framework) {
           data: framework.componentPositionEntity1Pda,
           componentProgram: componentId,
           authority: framework.worldProgram.programId,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -148,7 +147,7 @@ export function ecs(framework) {
           data: componentPda,
           componentProgram: componentId,
           authority: framework.worldProgram.programId,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -169,7 +168,7 @@ export function ecs(framework) {
           data: framework.componentPositionEntity4Pda,
           componentProgram: componentId,
           authority: framework.worldProgram.programId,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -190,11 +189,11 @@ export function ecs(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs({ direction: Direction.Up }))
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemSimpleMovement.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -226,11 +225,11 @@ export function ecs(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs({ direction: Direction.Right }))
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemSimpleMovement.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -261,11 +260,11 @@ export function ecs(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemFly.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -296,11 +295,11 @@ export function ecs(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemApplyVelocity.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -350,11 +349,11 @@ export function ecs(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemApplyVelocity.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -407,11 +406,11 @@ export function ecs(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemFly.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -458,7 +457,7 @@ export function ecs(framework) {
           component: framework.componentVelocityEntity1Pda,
           componentProgramData: componentProgramData,
           receiver: keypair.publicKey,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);

clients/typescript/test/low-level/permissioning/component.ts

@@ -4,8 +4,8 @@ import {
   FindEntityPda,
   FindComponentPda,
   SerializeArgs,
-  CPI_AUTH_ADDRESS,
   FindBufferPda,
+  FindCpiAuthPda,
 } from "../../../lib";
 import { assert, expect } from "chai";
 
@@ -48,7 +48,7 @@ export function component(framework) {
           data: component,
           componentProgram: componentId,
           authority: framework.provider.wallet.publicKey,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -66,11 +66,11 @@ export function component(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(keypair.publicKey),
           authority: keypair.publicKey,
           boltSystem: framework.systemFly.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -117,11 +117,11 @@ export function component(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemFly.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {

clients/typescript/test/low-level/permissioning/world.ts

@@ -1,8 +1,8 @@
 import { expect } from "chai";
 import {
   anchor,
-  CPI_AUTH_ADDRESS,
   FindBufferPda,
+  FindCpiAuthPda,
   SerializeArgs,
 } from "../../../lib";
 
@@ -129,11 +129,11 @@ export function world(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemFly.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -178,11 +178,11 @@ export function world(framework) {
       const instruction = await framework.worldProgram.methods
         .apply(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(framework.provider.wallet.publicKey),
           authority: framework.provider.wallet.publicKey,
           boltSystem: framework.systemFly.programId,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {

clients/typescript/test/low-level/session.ts

@@ -7,8 +7,8 @@ import {
   SessionProgram,
   FindSessionTokenPda,
   BN,
-  CPI_AUTH_ADDRESS,
   FindBufferPda,
+  FindCpiAuthPda,
 } from "../../lib";
 import { Keypair } from "@solana/web3.js";
 
@@ -33,7 +33,7 @@ export function session(framework) {
           authority: framework.provider.wallet.publicKey,
           targetProgram: framework.worldProgram.programId,
           sessionToken,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -54,7 +54,7 @@ export function session(framework) {
           payer: sessionSigner.publicKey,
           entity: entity,
           world: framework.worldPda,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -75,7 +75,7 @@ export function session(framework) {
           data: component,
           componentProgram: componentId,
           authority: framework.worldProgram.programId,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -91,12 +91,12 @@ export function session(framework) {
       const instruction = await framework.worldProgram.methods
         .applyWithSession(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(sessionSigner.publicKey),
           authority: sessionSigner.publicKey,
           boltSystem: framework.systemFly.programId,
           world: framework.worldPda,
           sessionToken,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {
@@ -144,7 +144,7 @@ export function session(framework) {
           payer: sessionSigner.publicKey,
           world: framework.worldPda,
           entity: entityWithAuthority,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -165,7 +165,7 @@ export function session(framework) {
           data: componentWithAuthority,
           componentProgram: componentId,
           authority: framework.provider.wallet.publicKey,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .instruction();
       const transaction = new anchor.web3.Transaction().add(instruction);
@@ -181,12 +181,12 @@ export function session(framework) {
       const instruction = await framework.worldProgram.methods
         .applyWithSession(SerializeArgs())
         .accounts({
-          buffer: FindBufferPda(),
+          buffer: FindBufferPda(sessionSigner.publicKey),
           authority: sessionSigner.publicKey,
           boltSystem: framework.systemFly.programId,
           world: framework.worldPda,
           sessionToken,
-          cpiAuth: CPI_AUTH_ADDRESS,
+          cpiAuth: FindCpiAuthPda(),
         })
         .remainingAccounts([
           {

crates/programs/world/src/lib.rs

@@ -260,12 +260,12 @@ pub mod world {
         if !ctx.accounts.authority.is_signer && ctx.accounts.authority.key != &ID {
             return Err(WorldError::InvalidAuthority.into());
         }
-        bolt_component::cpi::initialize(ctx.accounts.build(&[World::cpi_auth_seeds().as_slice()]))?;
+        bolt_component::cpi::initialize(ctx.accounts.build(&[World::cpi_auth_seeds().as_array().as_slice()]))?;
         Ok(())
     }
 
     pub fn destroy_component(ctx: Context<DestroyComponent>) -> Result<()> {
-        bolt_component::cpi::destroy(ctx.accounts.build(&[World::cpi_auth_seeds().as_slice()]))?;
+        bolt_component::cpi::destroy(ctx.accounts.build(&[World::cpi_auth_seeds().as_array().as_slice()]))?;
         Ok(())
     }
 
@@ -297,7 +297,7 @@ pub mod world {
         #[account()]
         pub bolt_system: UncheckedAccount<'info>,
         /// CHECK: authority check
-        #[account()]
+        #[account(mut)]
         pub authority: Signer<'info>,
         #[account()]
         /// CHECK: cpi auth check
@@ -347,7 +347,7 @@ pub mod world {
         #[account()]
         pub bolt_system: UncheckedAccount<'info>,
         /// CHECK: authority check
-        #[account()]
+        #[account(mut)]
         pub authority: Signer<'info>,
         #[account()]
         /// CHECK: cpi auth check
@@ -458,7 +458,7 @@ fn apply_impl<'info>(
                     from: authority.to_account_info(),
                     to: buffer.to_account_info(),
                 },
-                &[World::buffer_seeds().as_slice()],
+                &[World::buffer_seeds(authority.key).as_array().as_slice()],
             ),
             lamports,
             size as u64,
@@ -480,7 +480,7 @@ fn apply_impl<'info>(
                     cpi_auth: cpi_auth.to_account_info(),
                     component: component.to_account_info(),
                 },
-                &[World::cpi_auth_seeds().as_slice()],
+                &[World::cpi_auth_seeds().as_array().as_slice()],
             ),
             *bolt_system.key,
         )?;
@@ -493,7 +493,7 @@ fn apply_impl<'info>(
                     buffer: buffer.to_account_info(),
                     component: component.to_account_info(),
                 },
-                &[World::cpi_auth_seeds().as_slice()],
+                &[World::cpi_auth_seeds().as_array().as_slice()],
             ),
         )?;
     }
@@ -517,7 +517,7 @@ fn apply_impl<'info>(
                     cpi_auth: cpi_auth.to_account_info(),
                     component: component.to_account_info(),
                 },
-                &[World::cpi_auth_seeds().as_slice()],
+                &[World::cpi_auth_seeds().as_array().as_slice()],
             ),
             program.key(),
         )?;
@@ -534,7 +534,7 @@ fn apply_impl<'info>(
                     buffer: buffer.to_account_info(),
                     component: component.to_account_info(),
                 },
-                &[World::cpi_auth_seeds().as_slice()],
+                &[World::cpi_auth_seeds().as_array().as_slice()],
             ),
         )?;
     }
@@ -777,6 +777,37 @@ pub struct WorldSystems {
     pub approved_systems: BTreeSet<Pubkey>,
 }
 
+pub struct BufferSeeds<'buffer, 'owner> {
+    pub buffer: &'buffer [u8],
+    pub owner: &'owner [u8],
+    pub bump: [u8; 1],
+}
+
+impl<'buffer, 'owner> BufferSeeds<'buffer, 'owner> {
+    pub fn new(buffer: &'buffer [u8], owner: &'owner [u8], bump: u8) -> Self {
+        Self { buffer, owner, bump: [bump] }
+    }
+
+    pub fn as_array(&self) -> [&[u8]; 3] {
+        [&self.buffer, &self.owner, &self.bump]
+    }
+}
+
+pub struct CpiAuthSeeds<'cpi_auth> {
+    pub cpi_auth: &'cpi_auth [u8],
+    pub bump: [u8; 1],
+}
+
+impl<'cpi_auth> CpiAuthSeeds<'cpi_auth> {
+    pub fn new(cpi_auth: &'cpi_auth [u8], bump: u8) -> Self {
+        Self { cpi_auth, bump: [bump] }
+    }
+
+    pub fn as_array(&self) -> [&[u8]; 2] {
+        [&self.cpi_auth, &self.bump]
+    }
+}
+
 impl World {
     pub fn seed() -> &'static [u8] {
         b"world"
@@ -790,16 +821,18 @@ impl World {
         Pubkey::find_program_address(&[World::seed(), &self.id.to_be_bytes()], &crate::ID)
     }
 
-    pub fn buffer_seeds() -> [&'static [u8]; 2] {
-        [b"buffer", &[255]] // 251 is the pre-computed bump for buffer.
+    pub fn buffer_seeds<'buffer, 'owner>(owner: &'owner Pubkey) -> BufferSeeds<'buffer, 'owner> {
+        let (_, bump) = Pubkey::find_program_address(&[b"buffer", owner.as_ref()], &crate::ID);
+        BufferSeeds::new(b"buffer", owner.as_ref(), bump)
     }
 
-    pub fn cpi_auth_seeds() -> [&'static [u8]; 2] {
-        [b"cpi_auth", &[251]] // 251 is the pre-computed bump for cpi_auth.
+    pub fn cpi_auth_seeds<'cpi_auth>() -> CpiAuthSeeds<'cpi_auth> {
+        let (_, bump) = Pubkey::find_program_address(&[b"cpi_auth"], &crate::ID);
+        CpiAuthSeeds::new(b"cpi_auth", bump)
     }
 
-    pub const fn cpi_auth_address() -> Pubkey {
-        Pubkey::from_str_const("B2f2y3QTBv346wE6nWKor72AUhUvFF6mPk7TWCF2QVhi") // This is the pre-computed address for cpi_auth.
+    pub fn cpi_auth_address() -> Pubkey {
+        Pubkey::find_program_address(&[b"cpi_auth"], &crate::ID).0
     }
 }
 
@@ -828,44 +861,3 @@ impl SystemWhitelist {
         8 + Registry::INIT_SPACE
     }
 }
-
-// /// Builds the context for updating a component.
-// pub fn build_update_context<'a, 'b, 'c, 'info>(
-//     component_program: AccountInfo<'info>,
-//     bolt_component: AccountInfo<'info>,
-//     authority: Signer<'info>,
-//     cpi_auth: UncheckedAccount<'info>,
-//     signer_seeds: &'a [&'b [&'c [u8]]],
-// ) -> CpiContext<'a, 'b, 'c, 'info, bolt_component::cpi::accounts::Update<'info>> {
-//     let authority = authority.to_account_info();
-//     let cpi_auth = cpi_auth.to_account_info();
-//     let cpi_program = component_program;
-//     bolt_component::cpi::accounts::Update {
-//         bolt_component,
-//         authority,
-//         cpi_auth,
-//     }
-//     .build_cpi_context(cpi_program, signer_seeds)
-// }
-
-// /// Builds the context for updating a component.
-// pub fn build_update_context_with_session<'a, 'b, 'c, 'info>(
-//     component_program: AccountInfo<'info>,
-//     bolt_component: AccountInfo<'info>,
-//     authority: Signer<'info>,
-//     cpi_auth: UncheckedAccount<'info>,
-//     session_token: UncheckedAccount<'info>,
-//     signer_seeds: &'a [&'b [&'c [u8]]],
-// ) -> CpiContext<'a, 'b, 'c, 'info, bolt_component::cpi::accounts::UpdateWithSession<'info>> {
-//     let authority = authority.to_account_info();
-//     let cpi_auth = cpi_auth.to_account_info();
-//     let cpi_program = component_program;
-//     let session_token = session_token.to_account_info();
-//     bolt_component::cpi::accounts::UpdateWithSession {
-//         bolt_component,
-//         authority,
-//         cpi_auth,
-//         session_token,
-//     }
-//     .build_cpi_context(cpi_program, signer_seeds)
-// }