Revoke attestation authorization flow

[Birdmannn]

Attestation Revoke Flow - Implementation Summary

What Was Done

Implemented the attestation revoke flow with issuer-or-admin authorization and event publishing.

Implementation Details

Method Signature

pub fn revoke_attestation(
    env: Env,
    caller: Address,
    attestation_id: u64,
) -> Result<(), ReputationError>

Key Features

1. Caller Authentication

   • Requires caller.require_auth() before any operations

2. Authorization Check

   • Allows revocation by the original issuer OR the contract admin
   • Returns NotAuthorized error for unauthorized callers

3. Revocation Logic

   • Loads the attestation from storage
   • Checks if already revoked (returns AlreadyRevoked error)
   • Sets revoked = true on the attestation
   • Persists the updated attestation with TTL extension

4. Event Publishing

   • Publishes AttestationRevokedEvent with:
     • attestation_id: The ID of the revoked attestation
     • revoked_by: The address that performed the revocation

Event Definition

#[contractevent(topics = ["attestation", "revoked"])]
pub struct AttestationRevokedEvent {
    pub attestation_id: u64,
    pub revoked_by: Address,
}

Tests (13 total)

Existing Tests (12)

• Initialization, attestation issuance, profile management, etc.

New Test Added (1)

test_revoke_attestation_publishes_event

• Verifies that AttestationRevokedEvent is published when an attestation is revoked
• Checks event structure and topics

Revocation Tests Coverage

1. ✅ test_revoke_attestation_by_issuer - Issuer can revoke their own attestations
2. ✅ test_revoke_attestation_by_admin - Admin can revoke any attestation
3. ✅ test_revoke_attestation_unauthorized - Unauthorized callers receive NotAuthorized
4. ✅ test_revoke_already_revoked_attestation - Cannot revoke already revoked attestations
5. ✅ test_revoke_attestation_publishes_event - Event is published on revocation

Test Results

cargo test -p quid-reputation

Result: ✅ 13 tests passed

Acceptance Criteria

• ✅ Issuers can revoke their own attestations
• ✅ Admin can revoke issued attestations
• ✅ Unauthorized callers receive NotAuthorized error
• ✅ Caller authentication required
• ✅ Attestation marked as revoked and persisted
• ✅ AttestationRevokedEvent published
• ✅ All tests pass
• ✅ No warnings or clippy issues

Code Flow

1. Require caller authentication
2. Load attestation from storage
3. Check if already revoked → Error if true
4. Verify caller is issuer OR admin → Error if neither
5. Set attestation.revoked = true
6. Persist updated attestation
7. Extend TTL
8. Publish AttestationRevokedEvent
9. Return Ok(())

Closes #198

[drips-wave]

@Birdmannn Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Kaylahray]

Hello @Birdmannn Please resolve conflicts n workflow

[Kaylahray]

Hi @Birdmannn I merged your first PR and now this has conflict