WIP - Revocation reversal

Author: thiagoromanos

aries_cloudagent/anoncreds/base.py

@@ -186,5 +186,6 @@ async def update_revocation_list(
         curr_list: RevList,
         revoked: Sequence[int],
         options: Optional[dict] = None,
+        unrevoke: bool = False,
     ) -> RevListResult:
         """Update a revocation list on the registry."""

aries_cloudagent/anoncreds/default/did_besu/registry.py

@@ -879,23 +879,29 @@ async def update_revocation_list(
         curr_list: RevList,
         revoked: Sequence[int],
         options: Optional[dict] = None,
+        unrevoke: bool = False,
     ) -> RevListResult:
         """Update a revocation list."""
         delta, _ = await self.get_revocation_registry_delta(
             profile, curr_list.rev_reg_def_id, 0
         )
         delta_list = delta["value"]["revoked"] if delta["value"].get("revoked") else []
         newly_revoked_indices = list(revoked)
-        full_revoked_list = newly_revoked_indices + delta_list
+        if unrevoke:
+            full_revoked_list = set(delta_list) - set(newly_revoked_indices)
+        else:
+            full_revoked_list = newly_revoked_indices + delta_list
         rev_reg_entry = {
             "ver": "1.0",
             "value": {
                 "accum": curr_list.current_accumulator,
                 "prevAccum": prev_list.current_accumulator,
-                "revoked": full_revoked_list,
+                "revoked": list(full_revoked_list),
             },
         }
 
+        print(f"Entry: {rev_reg_entry}")
+
         await self._revoc_reg_entry_with_fix(
             profile, curr_list, rev_reg_def.type, rev_reg_entry
         )

aries_cloudagent/anoncreds/events.py

@@ -112,6 +112,7 @@ class RevListFinishedPayload(NamedTuple):
     rev_reg_id: str
     revoked: list
     options: dict
+    unrevoke: bool
 
 
 class RevListFinishedEvent(Event):
@@ -135,9 +136,10 @@ def with_payload(
         rev_reg_id: str,
         revoked: list,
         options: Optional[dict] = None,
+        unrevoke: Optional[bool] = None,
     ):
         """With payload."""
-        payload = RevListFinishedPayload(rev_reg_id, revoked, options)
+        payload = RevListFinishedPayload(rev_reg_id, revoked, options, unrevoke)
         return cls(payload)
 
     @property

aries_cloudagent/anoncreds/registry.py

@@ -176,9 +176,16 @@ async def update_revocation_list(
         curr_list: RevList,
         revoked: Sequence[int],
         options: Optional[dict] = None,
+        unrevoke: bool = False,
     ) -> RevListResult:
         """Update a revocation list on the registry."""
         registrar = await self._registrar_for_identifier(prev_list.issuer_id)
         return await registrar.update_revocation_list(
-            profile, rev_reg_def, prev_list, curr_list, revoked, options
+            profile,
+            rev_reg_def,
+            prev_list,
+            curr_list,
+            revoked,
+            options,
+            unrevoke,
         )

aries_cloudagent/anoncreds/revocation.py

@@ -536,6 +536,7 @@ async def update_revocation_list(
         curr: RevList,
         revoked: Sequence[int],
         options: Optional[dict] = None,
+        unrevoke: bool = False,
     ):
         """Publish and update to a revocation list."""
         options = options or {}
@@ -576,7 +577,7 @@ async def update_revocation_list(
 
         anoncreds_registry = self.profile.inject(AnonCredsRegistry)
         result = await anoncreds_registry.update_revocation_list(
-            self.profile, rev_reg_def, prev, curr, revoked, options
+            self.profile, rev_reg_def, prev, curr, revoked, options, unrevoke
         )
 
         # # TODO Handle `failed` state
@@ -1303,6 +1304,202 @@ async def revoke_pending_credentials(
             failed=[str(rev_id) for rev_id in sorted(failed_crids)],
         )
 
+    async def unrevoke_pending_credentials(
+        self,
+        revoc_reg_id: str,
+        *,
+        additional_crids: Optional[Sequence[int]] = None,
+        limit_crids: Optional[Sequence[int]] = None,
+    ) -> RevokeResult:
+        """UnRevoke a set of credentials in a revocation registry.
+
+        Args:
+            revoc_reg_id: ID of the revocation registry
+            additional_crids: sequences of additional credential indexes to revoke
+            limit_crids: a sequence of credential indexes to limit revocation to
+                If None, all pending revocations will be published.
+                If given, the intersection of pending and limit crids will be published.
+
+        Returns:
+            Tuple with the update revocation list, list of cred rev ids not revoked
+
+        """
+        updated_list = None
+        failed_crids = set()
+        max_attempt = 5
+        attempt = 0
+
+        while True:
+            attempt += 1
+            if attempt >= max_attempt:
+                raise AnonCredsRevocationError(
+                    "Repeated conflict attempting to update registry"
+                )
+            try:
+                async with self.profile.session() as session:
+                    rev_reg_def_entry = await session.handle.fetch(
+                        CATEGORY_REV_REG_DEF, revoc_reg_id
+                    )
+                    rev_list_entry = await session.handle.fetch(
+                        CATEGORY_REV_LIST, revoc_reg_id
+                    )
+                    rev_reg_def_private_entry = await session.handle.fetch(
+                        CATEGORY_REV_REG_DEF_PRIVATE, revoc_reg_id
+                    )
+            except AskarError as err:
+                raise AnonCredsRevocationError(
+                    "Error retrieving revocation registry"
+                ) from err
+
+            if (
+                not rev_reg_def_entry
+                or not rev_list_entry
+                or not rev_reg_def_private_entry
+            ):
+                raise AnonCredsRevocationError(
+                    (
+                        "Missing required revocation registry data: "
+                        "revocation registry definition"
+                        if not rev_reg_def_entry
+                        else ""
+                    ),
+                    "revocation list" if not rev_list_entry else "",
+                    (
+                        "revocation registry private definition"
+                        if not rev_reg_def_private_entry
+                        else ""
+                    ),
+                )
+
+            try:
+                async with self.profile.session() as session:
+                    cred_def_entry = await session.handle.fetch(
+                        CATEGORY_CRED_DEF, rev_reg_def_entry.value_json["credDefId"]
+                    )
+            except AskarError as err:
+                raise AnonCredsRevocationError(
+                    f"Error retrieving cred def {rev_reg_def_entry.value_json['credDefId']}"  # noqa: E501
+                ) from err
+
+            try:
+                # TODO This is a little rough; stored tails location will have public uri
+                # but library needs local tails location
+                rev_reg_def = RevRegDef.deserialize(rev_reg_def_entry.value_json)
+                rev_reg_def.value.tails_location = self.get_local_tails_path(
+                    rev_reg_def
+                )
+                cred_def = CredDef.deserialize(cred_def_entry.value_json)
+                rev_reg_def_private = RevocationRegistryDefinitionPrivate.load(
+                    rev_reg_def_private_entry.value_json
+                )
+            except AnoncredsError as err:
+                raise AnonCredsRevocationError(
+                    "Error loading revocation registry definition"
+                ) from err
+
+            rev_crids = set()
+            failed_crids = set()
+            max_cred_num = rev_reg_def.value.max_cred_num
+            rev_info = rev_list_entry.value_json
+            cred_revoc_ids = (rev_info["pending"] or []) + (additional_crids or [])
+            rev_list = RevList.deserialize(rev_info["rev_list"])
+
+            for rev_id in cred_revoc_ids:
+                if rev_id < 1 or rev_id > max_cred_num:
+                    LOGGER.error(
+                        "Skipping requested credential revocation"
+                        "on rev reg id %s, cred rev id=%s not in range",
+                        revoc_reg_id,
+                        rev_id,
+                    )
+                    failed_crids.add(rev_id)
+                elif rev_id >= rev_info["next_index"]:
+                    LOGGER.warning(
+                        "Skipping requested credential revocation"
+                        "on rev reg id %s, cred rev id=%s not yet issued",
+                        revoc_reg_id,
+                        rev_id,
+                    )
+                    failed_crids.add(rev_id)
+                elif rev_list.revocation_list[rev_id] == 0:
+                    LOGGER.warning(
+                        "Skipping requested credential unrevocation"
+                        "on rev reg id %s, cred rev id=%s is not revoked",
+                        revoc_reg_id,
+                        rev_id,
+                    )
+                    failed_crids.add(rev_id)
+                else:
+                    rev_crids.add(rev_id)
+
+            if not rev_crids:
+                break
+
+            if limit_crids is None:
+                skipped_crids = set()
+            else:
+                skipped_crids = rev_crids - set(limit_crids)
+            rev_crids = rev_crids - skipped_crids
+
+            try:
+                updated_list = await asyncio.get_event_loop().run_in_executor(
+                    None,
+                    lambda: rev_list.to_native().update(
+                        cred_def=cred_def.to_native(),
+                        rev_reg_def=rev_reg_def.to_native(),
+                        rev_reg_def_private=rev_reg_def_private,
+                        issued=list(rev_crids),
+                        revoked=None,
+                        timestamp=int(time.time()),
+                    ),
+                )
+            except AnoncredsError as err:
+                raise AnonCredsRevocationError(
+                    "Error updating revocation registry"
+                ) from err
+
+            try:
+                async with self.profile.transaction() as txn:
+                    rev_info_upd = await txn.handle.fetch(
+                        CATEGORY_REV_LIST, revoc_reg_id, for_update=True
+                    )
+                    if not rev_info_upd:
+                        LOGGER.warning(
+                            "Revocation registry missing, skipping update: {}",
+                            revoc_reg_id,
+                        )
+                        updated_list = None
+                        break
+                    tags = rev_info_upd.tags
+                    rev_info_upd = rev_info_upd.value_json
+                    if rev_info_upd != rev_info:
+                        # handle concurrent update to the registry by retrying
+                        continue
+                    rev_info_upd["rev_list"] = updated_list.to_dict()
+                    rev_info_upd["pending"] = (
+                        list(skipped_crids) if skipped_crids else None
+                    )
+                    tags["pending"] = json.dumps(True if skipped_crids else False)
+                    await txn.handle.replace(
+                        CATEGORY_REV_LIST,
+                        revoc_reg_id,
+                        value_json=rev_info_upd,
+                        tags=tags,
+                    )
+                    await txn.commit()
+            except AskarError as err:
+                raise AnonCredsRevocationError(
+                    "Error saving revocation registry"
+                ) from err
+            break
+
+        return RevokeResult(
+            prev=rev_list,
+            curr=RevList.from_native(updated_list) if updated_list else None,
+            revoked=list(rev_crids),
+            failed=[str(rev_id) for rev_id in sorted(failed_crids)],
+        )
+
     async def mark_pending_revocations(self, rev_reg_def_id: str, *crids: int):
         """Cred rev ids stored to publish later."""
         async with self.profile.transaction() as txn:

aries_cloudagent/anoncreds/revocation_setup.py

@@ -107,5 +107,8 @@ async def on_rev_reg_def(self, profile: Profile, event: RevRegDefFinishedEvent):
     async def on_rev_list(self, profile: Profile, event: RevListFinishedEvent):
         """Handle rev list finished."""
         await notify_revocation_published_event(
-            profile, event.payload.rev_reg_id, event.payload.revoked
+            profile,
+            event.payload.rev_reg_id,
+            event.payload.revoked,
+            event.payload.unrevoke,
         )