skarbiec emergency revoke

Invocation#

skarbiec emergency revoke <grantee>

Purpose#

Take back an activated emergency grant: remove the grantee from exactly the items the activation added them to.

Required inputs and options#

• Requires the grantee named by an activated emergency grant.

Output and state effects#

• Re-encrypts every current and historical revision of each item in the grant's added_to list, trashed items included, onto the remaining recipients plus owner and recovery; an item shared with the grantee another way stays readable to them. Deletes the grant record, appends the emergency-revoke audit entry, and prints revoked_items, historical_versions, already_gone (items purged since), no_longer_reader (items the grantee had already lost) and exposed (every item the activation let them open). Re-encryption stops future reads; it cannot take back a value already read, so the exposed items are the ones to rotate.

Refusals#

• Refuses a grantee without a grant with the sentence emergency cancel uses. Refuses a pending grant with `the emergency grant for <grantee> is pending, so it has shared nothing to revoke; `skarbiec emergency cancel <grantee>` withdraws a grant that is still waiting`. Refuses a grant activated by a release that did not record its items, changing nothing, with a sentence that names every item the grantee reads and the two commands that take access back: `skarbiec revoke <item-id> <grantee>` for one item and `skarbiec recipient remove <grantee> --yes` for every item.