From 78203116e93378f369f25f52802df123d6a2b272 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Tue, 3 Feb 2026 21:31:48 +0100
Subject: [PATCH]

---
 src/http_management.ml |  4 +++-
 tools/offline.ml       | 19 +++++++++++++++++--
 tools/offline_impl.ml  | 12 ++++++++++++
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/src/http_management.ml b/src/http_management.ml
index a1fa3bc4..31ada445 100644
--- a/src/http_management.ml
+++ b/src/http_management.ml
@@ -351,7 +351,9 @@ module Auditors_disable = struct
     | None -> Error "auditor not found"
     | Some last_date ->
         let cmp = Timestamp.compare last_date validity_end |> Option.get in
-        if cmp > 0 then Error "more recent management auditor already present"
+        if cmp > 0 then
+          Error
+            "database has more recent auditor data for this auditor public key"
         else
           let+ () =
             Pg.disable_auditor db_conn ~auditor_pub ~change_date:validity_end
diff --git a/tools/offline.ml b/tools/offline.ml
index 589685f0..2b6c2aa2 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -136,6 +136,22 @@ let enable_auditor_cmd =
   enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
     ~validity_start
 
+let disable_auditor_cmd =
+  let doc = "Disable auditor." in
+  let auditor_pub =
+    Arg.(required & opt (some eddsa_pub) None & info [ "auditor_pub" ])
+  in
+  let validity_end =
+    Arg.(required & opt (some timestamp) None & info [ "validity_end" ])
+  in
+  Cmd.make (Cmd.info "disable-auditor" ~doc)
+  @@
+  let+ output = output
+  and+ master_key = master_key
+  and+ auditor_pub = auditor_pub
+  and+ validity_end = validity_end in
+  disable_auditor ~output ~master_key ~auditor_pub ~validity_end
+
 let global_fees_cmd =
   let doc = "Provides global fee configuration." in
   let start_date =
@@ -193,6 +209,7 @@ let cli =
       revoke_denom_cmd;
       revoke_signkey_cmd;
       enable_auditor_cmd;
+      disable_auditor_cmd;
       global_fees_cmd;
     ]
 
@@ -200,8 +217,6 @@ let main () = Cmd.eval_result cli
 let () = if !Sys.interactive then () else exit (main ())
 
 (* TODO all management operations:
-     /management/auditors
-     /management/auditors/$AUDITOR_PUB/disable
      /management/wire-fee
      /management/wire
      /management/wire/disable
diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml
index 4dcde9c9..5915cd5d 100644
--- a/tools/offline_impl.ml
+++ b/tools/offline_impl.ml
@@ -155,3 +155,15 @@ let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
   let* s = Api.encode Api.AuditorSetupMessage.jsont v in
   let* () = write_file output s in
   Ok ()
+
+let disable_auditor ~output ~master_key ~auditor_pub ~validity_end =
+  let open Crypto in
+  let* key = read_master_key_file master_key in
+  let master_sig =
+    let open Bin_sig.MasterDelAuditor in
+    sign_f ~f:(EddsaSignature.sign ~key) { end_date= validity_end; auditor_pub }
+  in
+  let v = Api.AuditorTeardownMessage.{ master_sig; validity_end } in
+  let* s = Api.encode Api.AuditorTeardownMessage.jsont v in
+  let* () = write_file output s in
+  Ok ()