// revokeCertByKeyID processes an outer JWS as a revocation request that is
// authenticated by a KeyID and the associated account.
551116
func (wfe *WebFrontEndImpl) revokeCertByKeyID(
	ctx context.Context,
	outerJWS *jose.JSONWebSignature,
	request *http.Request,
	logEvent *web.RequestEvent) *probs.ProblemDetails {
	// For Key ID revocations we authenticate the outer JWS by using
	// `validJWSForAccount` similar to other WFE endpoints
	jwsBody, _, acct, prob := wfe.validJWSForAccount(outerJWS, request, ctx, logEvent)
	if prob != nil {
		return prob
	}
	// For Key ID revocations we decide if an account is able to revoke a specific
	// certificate by checking that the account has valid authorizations for all
	// of the names in the certificate or was the issuing account
	authorizedToRevoke := func(parsedCertificate *x509.Certificate) *probs.ProblemDetails {
		cert, err := wfe.SA.GetCertificate(ctx, core.SerialToString(parsedCertificate.SerialNumber))
		if err != nil {
			return probs.ServerInternal("Failed to retrieve certificate")
		}
		if cert.RegistrationID == acct.ID {
			return nil
		}
		valid, err := wfe.acctHoldsAuthorizations(ctx, acct.ID, parsedCertificate.DNSNames)
		if err != nil {
			return probs.ServerInternal("Failed to retrieve authorizations for names in certificate")
		}
		if !valid {
			return probs.Unauthorized(
				"The key ID specified in the revocation request does not hold valid authorizations for all names in the certificate to be revoked")
		}
		return nil
	}
	return wfe.processRevocation(ctx, jwsBody, acct.ID, authorizedToRevoke, request, logEvent)
}
1288563
func (k *KeyPairsClient) Revoke(ctx context.Context, orgID *identity.ID, output ProgressFunc) error {
	return k.worker(ctx, "revoke", orgID, output)
}
1153542
func (ckf *ComputedKeyFamily) revokeSigs(sigs []keybase1.SigID, tcl TypedChainLink) error {
	for _, s := range sigs {
		if len(s) == 0 {
			continue
		}
		if err := ckf.RevokeSig(s, tcl); err != nil {
			return err
		}
	}
	return nil
}
1028006
func (c *Client) Revoke(request *RevocationRequest) (*RevocationResponse, error) {
	ca, err := newCAClient(c.ctx, c.orgName)
	if err != nil {
		return nil, err
	}
	req := mspapi.RevocationRequest(*request)
	resp, err := ca.Revoke(&req)
	if err != nil {
		return nil, err
	}
	var revokedCerts []RevokedCert
	for i := range resp.RevokedCerts {
		revokedCerts = append(
			revokedCerts,
			RevokedCert{
				Serial: resp.RevokedCerts[i].Serial,
				AKI:    resp.RevokedCerts[i].AKI,
			})
	}

	return &RevocationResponse{
		RevokedCerts: revokedCerts,
		CRL:          resp.CRL,
	}, nil
}
577854
func (ckf *ComputedKeyFamily) Revoke(tcl TypedChainLink) (err error) {
	err = ckf.revokeSigs(tcl.GetRevocations(), tcl)
	if err == nil {
		err = ckf.revokeKids(tcl.GetRevokeKids(), tcl)
	}
	return err
}
751241
func (k *KeyringSectionV1) FindMEKByKeyID(id *identity.ID) (*primitive.MEKShare, error) {
	var mekshare *primitive.MEKShare
	for _, m := range k.Members {
		if *m.Body.EncryptingKeyID == *id {
			mekshare = &primitive.MEKShare{
				Key: m.Body.Key,
			}
			break
		}
	}

	if mekshare == nil {
		return nil, ErrMemberNotFound
	}

	return mekshare, nil
}
399609
func (c *Client) RevokeSecurityGroupEgress(p *RevokeSecurityGroupEgressParameter) (*Result, error) {
	obj, err := c.Request("revokeSecurityGroupEgress", convertParamToMap(p))
	if err != nil {
		return nil, err
	}
	return obj.(*Result), err
}
518750
func (s *SecurityGroupService) RevokeSecurityGroupEgress(p *RevokeSecurityGroupEgressParams) (*RevokeSecurityGroupEgressResponse, error) {
	resp, err := s.cs.newRequest("revokeSecurityGroupEgress", p.toURLValues())
	if err != nil {
		return nil, err
	}

	var r RevokeSecurityGroupEgressResponse
	if err := json.Unmarshal(resp, &r); err != nil {
		return nil, err
	}

	// If we have a async client, we need to wait for the async result
	if s.cs.async {
		b, err := s.cs.GetAsyncJobResult(r.JobID, s.cs.timeout)
		if err != nil {
			if err == AsyncTimeoutErr {
				return &r, err
			}
			return nil, err
		}

		if err := json.Unmarshal(b, &r); err != nil {
			return nil, err
		}
	}

	return &r, nil
}
1368367
func (client *Client) DetachKeyPair(args *DetachKeyPairArgs) (err error) {
	response := common.Response{}
	err = client.Invoke("DetachKeyPair", args, &response)
	if err != nil {
		return err
	}
	return nil
}
905565
func (a *AuthServer) GetCertAuthority(id services.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (services.CertAuthority, error) {
	return a.GetCache().GetCertAuthority(id, loadSigningKeys, opts...)
}
233832
func (g *GPG) KeysById(id uint64) []openpgp.Key {
	return append(g.secring.KeysById(id), g.pubring.KeysById(id)...)
}
756054
func (c *ACMEClient) Revoke(name string) error {
	storage, err := c.config.StorageFor(c.config.CAUrl)
	if err != nil {
		return err
	}

	siteExists, err := storage.SiteExists(name)
	if err != nil {
		return err
	}

	if !siteExists {
		return errors.New("no certificate and key for " + name)
	}

	siteData, err := storage.LoadSite(name)
	if err != nil {
		return err
	}

	err = c.acmeClient.RevokeCertificate(siteData.Cert)
	if err != nil {
		return err
	}

	err = storage.DeleteSite(name)
	if err != nil {
		return errors.New("certificate revoked, but unable to delete certificate file: " + err.Error())
	}

	return nil
}
1364645
func (u *Client) RevokeToken(accessToken string) error {
	segments := strings.Split(accessToken, ".")

	if len(segments) < 2 {
		return errors.New("access token missing segments")
	}

	jsonPayload, err := base64.RawURLEncoding.DecodeString(segments[1])

	if err != nil {
		return errors.New("could not base64 decode token payload")
	}

	payload := make(map[string]interface{})
	json.Unmarshal(jsonPayload, &payload)
	jti, ok := payload["jti"].(string)

	if !ok {
		return errors.New("could not parse jti from payload")
	}

	request, err := http.NewRequest(http.MethodDelete, u.AuthURL+"/oauth/token/revoke/"+jti, nil)
	if err != nil {
		return err
	}
	request.Header.Set("Authorization", "Bearer "+accessToken)
	resp, err := u.Client.Do(request)
	if err != nil {
		return err
	}
	defer resp.Body.Close()

	if resp.StatusCode >= http.StatusBadRequest {
		body, err := ioutil.ReadAll(resp.Body)
		if err != nil {
			return err
		}
		return fmt.Errorf("Received HTTP %d error while revoking token from auth server: %q", resp.StatusCode, body)
	}

	return nil
}
381743
func (api *CloudAPIV2) RevokeCredentials(args params.Entities) (params.ErrorResults, error) {
	results := params.ErrorResults{
		Results: make([]params.ErrorResult, len(args.Entities)),
	}
	authFunc, err := api.getCredentialsAuthFunc()
	if err != nil {
		return results, err
	}
	for i, arg := range args.Entities {
		tag, err := names.ParseCloudCredentialTag(arg.Tag)
		if err != nil {
			results.Results[i].Error = common.ServerError(err)
			continue
		}
		// NOTE(axw) if we add ACLs for cloud credentials, we'll need
		// to change this auth check.
		if !authFunc(tag.Owner()) {
			results.Results[i].Error = common.ServerError(common.ErrPerm)
			continue
		}

		models, err := api.credentialModels(tag)
		if err != nil {
			logger.Warningf("could not get models that use credential %v: %v", tag, err)
		}
		if len(models) > 0 {
			// For backward compatibility, we must proceed here regardless of whether the credential is used by any models,
			// but, at least, let's log it.
			logger.Warningf("credential %v will be deleted but it is still used by model%v", tag, modelsPretty(models))
		}

		if err := api.backend.RemoveCloudCredential(tag); err != nil {
			results.Results[i].Error = common.ServerError(err)
		}
	}
	return results, nil
}
812702
func (wfe *WebFrontEndImpl) RevokeCertificate(
	ctx context.Context,
	logEvent *web.RequestEvent,
	response http.ResponseWriter,
	request *http.Request) {

	// The ACME specification handles the verification of revocation requests
	// differently from other endpoints. For this reason we do *not* immediately
	// call `wfe.validPOSTForAccount` like all of the other endpoints.
	// For this endpoint we need to accept a JWS with an embedded JWK, or a JWS
	// with an embedded key ID, handling each case differently in terms of which
	// certificates are authorized to be revoked by the requester

	// Parse the JWS from the HTTP Request
	jws, prob := wfe.parseJWSRequest(request)
	if prob != nil {
		wfe.sendError(response, logEvent, prob, nil)
		return
	}

	// Figure out which type of authentication this JWS uses
	authType, prob := checkJWSAuthType(jws)
	if prob != nil {
		wfe.sendError(response, logEvent, prob, nil)
		return
	}

	// Handle the revocation request according to how it is authenticated, or if
	// the authentication type is unknown, error immediately
	if authType == embeddedKeyID {
		prob = wfe.revokeCertByKeyID(ctx, jws, request, logEvent)
		addRequesterHeader(response, logEvent.Requester)
	} else if authType == embeddedJWK {
		prob = wfe.revokeCertByJWK(ctx, jws, request, logEvent)
	} else {
		prob = probs.Malformed("Malformed JWS, no KeyID or embedded JWK")
	}
	if prob != nil {
		wfe.sendError(response, logEvent, prob, nil)
		return
	}
	response.WriteHeader(http.StatusOK)
}
134291
func (ssa *SQLStorageAuthority) RevokeAuthorizationsByDomain2(ctx context.Context, req *sapb.RevokeAuthorizationsByDomainRequest) (*corepb.Empty, error) {
	finalRevoked, pendingRevoked, err := ssa.RevokeAuthorizationsByDomain(
		ctx,
		core.AcmeIdentifier{
			Type:  core.IdentifierDNS,
			Value: *req.Domain,
		})
	if err != nil {
		return nil, err
	}

	var revokedTotal int64 = finalRevoked + pendingRevoked
	for {
		var ids []int64
		ids, err := ssa.getAuthorizationIDsByDomain2(ctx, *req.Domain)
		if err != nil {
			if err == sql.ErrNoRows {
				break
			}
			return nil, err
		}
		if len(ids) == 0 {
			break
		}
		if err = ssa.revokeAuthorizations2(ctx, ids); err != nil {
			return nil, err
		}
		revokedTotal += int64(len(ids))
	}
	// If no authorizations were revoked return a NotFoundError so that the caller
	// can decide whether that was an expected result or not. Some callers (e.g.
	// the admin-revoker tool) may wish to handle this case specifically.
	if revokedTotal == 0 {
		return nil, berrors.NotFoundError(
			"no authorizations to revoke for %q", *req.Domain)
	}
	return &corepb.Empty{}, nil
}
95796
func (c *Client) RevokeController(user, access string) error {
	return c.modifyControllerUser(params.RevokeControllerAccess, user, access)
}