spel-authority

Policy-free primitives for single-holder on-chain authority slots in SPEL libraries: AuthorityCandidate (validates a transfer-time claim against on-chain evidence) and AuthoritySlot (initialize / assert / transfer / nominate / accept / renounce state for one holder and at most one nominee).

This crate has no notion of "admin" or "freeze authority" — no instruction handlers, no policy on who can transfer or renounce. Downstream libraries (admin-authority, freeze-authority) compose these primitives into their own config types and layer their own policy on top.

See CONTEXT.md for the full glossary and docs/adr for design decisions.

Example

A downstream library wraps AuthoritySlot in its own named config type and layers its own transfer policy on top. The crate is named spel-authority, the package rename below is what makes use authority:: resolve:

[dependencies]
authority = { git = "https://github.com/mmlado/spel-authority.git", tag = "v0.2.0", package = "spel-authority" }

use authority::{AuthorityCandidate, AuthoritySlot, AuthorityError};

struct AdminConfig {
    slot: AuthoritySlot,
}

impl AdminConfig {
    fn initialize(admin: AccountId) -> Result<Self, AuthorityError> {
        Ok(Self { slot: AuthoritySlot::initialize(admin)? })
    }

    fn transfer(
        &mut self,
        current: &AccountWithMetadata,
        candidate: AuthorityCandidate,
        new_account: &AccountWithMetadata,
    ) -> Result<(), AuthorityError> {
        self.slot.assert(current)?;
        let next = candidate.validate(new_account)?;
        self.slot.transfer_to(next)?;
        Ok(())
    }
}

AuthoritySlot itself never decides who may call transfer — that check (self.slot.assert(current)) is the consuming library's job.

Versioning and stability

Semantic versioning covers two surfaces: the crate's public Rust API, and AuthoritySlot's 64-byte borsh encoding (holder, then nominee), which is an on-chain wire format that downstream config types embed. While the version is 0.x, a minor bump may change either, and each such change is called out in the changelog.

The spel-framework dependency pins the upstream v0.7.0 tag. The crate stays at 0.x while SPEL does, since SPEL types are part of its public API.

License

Dual-licensed under MIT and Apache 2.0 at the consumer's option.