feat(compliance): add revoke_allow entrypoint for soft de-listing

contracts/compliance/src/lib.rs

@@ -157,6 +157,24 @@ impl ComplianceContract {
         Ok(())
     }
 
+    /// Remove the allowed status for an address without blocking it.
+    /// This is a soft de-listing: the address is removed from the allowlist
+    /// but not placed on the blocklist, so it can be re-allowed later.
+    pub fn revoke_allow(env: Env, admin: Address, address: Address) -> Result<(), ContractError> {
+        Self::require_admin(&env, &admin)?;
+        Self::require_not_paused(&env)?;
+        env.storage()
+            .persistent()
+            .remove(&DataKey::Allowed(address.clone()));
+        env.storage()
+            .persistent()
+            .remove(&DataKey::AllowedUntil(address.clone()));
+        Self::track_address(&env, &address);
+        env.events()
+            .publish((Symbol::new(&env, "address_revoked"),), address);
+        Ok(())
+    }
+
     pub fn pause(env: Env, admin: Address) -> Result<(), ContractError> {
         Self::require_admin(&env, &admin)?;
         env.storage().instance().set(&DataKey::Paused, &true);

contracts/compliance/tests/compliance_test.rs

@@ -132,6 +132,68 @@ fn clear_address_mutation_succeeds_after_unpause() {
     assert!(client.is_allowed(&address));
 }
 
+#[test]
+fn revoke_allow_removes_allowed_status() {
+    let (_env, admin, subject, client) = setup();
+    client.allow_address(&admin, &subject);
+    assert!(client.is_allowed(&subject));
+    client.revoke_allow(&admin, &subject);
+    assert!(!client.is_allowed(&subject));
+}
+
+#[test]
+fn revoke_allow_does_not_block() {
+    let (_env, admin, subject, client) = setup();
+    client.allow_address(&admin, &subject);
+    client.revoke_allow(&admin, &subject);
+    // Not allowed, but also not blocked — re-allow should work
+    client.allow_address(&admin, &subject);
+    assert!(client.is_allowed(&subject));
+}
+
+#[test]
+fn revoke_allow_removes_expiry() {
+    let (env, admin, subject, client) = setup();
+    let now = env.ledger().timestamp();
+    client.allow_address_until(&admin, &subject, &(now + 1000));
+    assert!(client.is_allowed(&subject));
+    client.revoke_allow(&admin, &subject);
+    assert!(!client.is_allowed(&subject));
+    // Re-allow permanently
+    client.allow_address(&admin, &subject);
+    assert!(client.is_allowed(&subject));
+}
+
+#[test]
+fn revoke_allow_returns_unauthorized_for_non_admin() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let non_admin = Address::generate(&env);
+    let address = Address::generate(&env);
+    let id = env.register_contract(None, ComplianceContract);
+    let client = ComplianceContractClient::new(&env, &id);
+    client.initialize(&admin);
+
+    let result = client.try_revoke_allow(&non_admin, &address);
+    assert_eq!(result, Err(Ok(ContractError::Unauthorized)));
+}
+
+#[test]
+fn revoke_allow_returns_contract_paused_when_paused() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let admin = Address::generate(&env);
+    let address = Address::generate(&env);
+    let id = env.register_contract(None, ComplianceContract);
+    let client = ComplianceContractClient::new(&env, &id);
+    client.initialize(&admin);
+    client.pause(&admin);
+
+    let result = client.try_revoke_allow(&admin, &address);
+    assert_eq!(result, Err(Ok(ContractError::ContractPaused)));
+}
+
 #[test]
 fn read_only_queries_not_blocked_by_pause() {
     let env = Env::default();