Function verify_revocation

atomic-canonical/src/delegation.rs:484–510

Verify a revocation against the delegator's public key. Only the delegator may revoke, so the signature must be theirs and the `delegator` field must name that same key.

(
    document: &Value,
    delegator_public_key: &PublicKey,
)

/// Only the delegator may revoke, so the signature must be theirs and the
/// `delegator` field must name that same key.
pub fn verify_revocation(
    document: &Value,
    delegator_public_key: &PublicKey,
) -> Result<DelegationRevocation> {
    expect_type(document, TYPE_REVOCATION)?;
    proof::verify_value(document, delegator_public_key)?;

    let obj = as_object(document)?;
    let delegator = string_field(obj, "delegator")?;
    let delegator_id = IdentityId::from_did(&delegator)
        .map_err(|e| CanonicalError::Verification(format!("delegator DID is malformed: {e}")))?;
    if !delegator_id.matches_public_key(delegator_public_key) {
        return Err(CanonicalError::Verification(
            "revocation delegator DID does not match the verifying key".into(),
        ));
    }

    Ok(DelegationRevocation {
        delegation: string_field(obj, "delegation")?,
        delegator,
        revoked_at: timestamp_field(obj, "revokedAt")?,
        reason: obj
            .get("reason")
            .and_then(Value::as_str)
            .map(str::to_string),
    })
}

// ---------------------------------------------------------------------------
// Store-backed lookup