SolsticeProtocol

    pub identity: Account<'info, Identity>,        #[account(mut)]    pub user: Signer<'info>,        pub system_program: Program<'info, System>,} /// Close authentication session#[derive(Accounts)]pub struct CloseSession<'info> {    #[account(        mut,        close = user,        seeds = [b"session", user.key().as_ref(), &session.session_id],        bump = session.bump,        has_one = user @ crate::errors::ErrorCode::UnauthorizedAccess    )]    pub session: Account<'info, Session>,        #[account(mut)]    pub user: Signer<'info>,}

1. Line 112 pub user: Signer<'info>,: Requires this account to have signed the transaction.
2. Line 122 close = user,: Closes the account at the end of the instruction and refunds its lamports.
3. Line 123 seeds = [b"session", user.key().as_ref(), &session.session_id],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
4. Line 124 bump = session.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
5. Line 125 has_one = user @ crate::errors::ErrorCode::UnauthorizedAccess: Checks that a stored pubkey field matches the passed account.

        identity.is_verified = false;        identity.attributes_verified = 0;                msg!("Identity revoked for user: {:?}", ctx.accounts.user.key());        Ok(())    }     /// Create authentication session    pub fn create_session(        ctx: Context<CreateSession>,        session_id: [u8; 32],        expiry: i64,    ) -> Result<()> {        let session = &mut ctx.accounts.session;        let identity = &ctx.accounts.identity;        require!(identity.is_verified, ErrorCode::IdentityNotFound);        session.user = ctx.accounts.user.key();        session.session_id = session_id;        session.created_at = Clock::get()?.unix_timestamp;        session.expires_at = expiry;        session.is_active = true;        session.bump = ctx.bumps.session;                msg!("Session created for user: {:?}", ctx.accounts.user.key());

1. Line 124 msg!("Identity revoked for user: {:?}", ctx.accounts.user.key());: Logs to the program log, which is visible in explorers and the test output.
2. Line 136 require!(identity.is_verified, ErrorCode::IdentityNotFound);: An explicit validation that aborts the instruction with an error.
3. Line 139 session.created_at = Clock::get()?.unix_timestamp;: Reads on-chain time from the Clock sysvar.
4. Line 142 session.bump = ctx.bumps.session;: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.

/// /// # Returns/// * `Result<bool>` - True if proof is valid, error otherwisepub fn verify_groth16_proof(    proof_bytes: &[u8],    public_inputs_bytes: &[u8],    attribute_type: u8,) -> Result<bool> {    // Select verification key based on attribute type    let vk_struct = match attribute_type {        1 => &AGE_PROOF_VK,        2 => &NATIONALITY_PROOF_VK,        4 => &UNIQUENESS_PROOF_VK,        _ => return Err(error!(crate::errors::ErrorCode::InvalidPublicInputs)),    };     msg!("Verifying Groth16 proof for attribute type: {}", attribute_type);        // Validate input lengths    require!(proof_bytes.len() == 256, crate::errors::ErrorCode::InvalidProof);    require!(!public_inputs_bytes.is_empty(), crate::errors::ErrorCode::InvalidPublicInputs);    require!(public_inputs_bytes.len() % 32 == 0, crate::errors::ErrorCode::InvalidPublicInputs);        let num_inputs = public_inputs_bytes.len() / 32;

1. Line 29 msg!("Verifying Groth16 proof for attribute type: {}", attribute_type);: Logs to the program log, which is visible in explorers and the test output.
2. Line 32 require!(proof_bytes.len() == 256, crate::errors::ErrorCode::InvalidProof);: An explicit validation that aborts the instruction with an error.

    // nullifier = Poseidon(identity_commitment || secret)    // This matches the circuit implementation: component nullifier = Poseidon(2)        let nullifier = poseidon_hash(&[        identity_commitment,        secret    ])?;        msg!("Generated Poseidon nullifier for Sybil resistance");        Ok(nullifier)} /// Decompress identity data for verification/// This proves ownership of compressed data without revealing the full datapub fn verify_compressed_identity(    _compressed_identity: &CompressedIdentity,    proof: &[u8],) -> Result<bool> {    // Verify that the compressed state matches the Merkle root    // This uses a ZK proof to verify inclusion without revealing the data        require!(proof.len() > 0, crate::errors::ErrorCode::InvalidProof);

1. Line 129 msg!("Generated Poseidon nullifier for Sybil resistance");: Logs to the program log, which is visible in explorers and the test output.
2. Line 143 require!(proof.len() > 0, crate::errors::ErrorCode::InvalidProof);: An explicit validation that aborts the instruction with an error.