From 089157b237dba613f481fc5b1f10861b3ae8c0c7 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Tue, 4 Nov 2025 11:09:01 -0800
Subject: [PATCH] Update db schema, load cert from cert body instead

---
 ...acme.ts => 20251104234547_add-pki-acme.ts} |  0
 backend/src/db/schemas/pki-acme-challenges.ts |  1 +
 backend/src/db/schemas/pki-acme-orders.ts     | 10 +++---
 .../ee/services/pki-acme/pki-acme-service.ts  | 35 ++++++++-----------
 4 files changed, 20 insertions(+), 26 deletions(-)
 rename backend/src/db/migrations/{20251029234547_add-pki-acme.ts => 20251104234547_add-pki-acme.ts} (100%)

diff --git a/backend/src/db/migrations/20251029234547_add-pki-acme.ts b/backend/src/db/migrations/20251104234547_add-pki-acme.ts
similarity index 100%
rename from backend/src/db/migrations/20251029234547_add-pki-acme.ts
rename to backend/src/db/migrations/20251104234547_add-pki-acme.ts
diff --git a/backend/src/db/schemas/pki-acme-challenges.ts b/backend/src/db/schemas/pki-acme-challenges.ts
index 17282da06..18245bb76 100644
--- a/backend/src/db/schemas/pki-acme-challenges.ts
+++ b/backend/src/db/schemas/pki-acme-challenges.ts
@@ -12,6 +12,7 @@ export const PkiAcmeChallengesSchema = z.object({
   authId: z.string().uuid(),
   type: z.string(),
   status: z.string(),
+  error: z.string().nullable().optional(),
   validatedAt: z.date().nullable().optional(),
   createdAt: z.date(),
   updatedAt: z.date()
diff --git a/backend/src/db/schemas/pki-acme-orders.ts b/backend/src/db/schemas/pki-acme-orders.ts
index 67396f2d9..928753d8c 100644
--- a/backend/src/db/schemas/pki-acme-orders.ts
+++ b/backend/src/db/schemas/pki-acme-orders.ts
@@ -10,17 +10,15 @@ import { TImmutableDBKeys } from "./models";
 export const PkiAcmeOrdersSchema = z.object({
   id: z.string().uuid(),
   accountId: z.string().uuid(),
+  certificateId: z.string().uuid().nullable().optional(),
   notBefore: z.date().nullable().optional(),
   notAfter: z.date().nullable().optional(),
   expiresAt: z.date(),
+  csr: z.string().nullable().optional(),
+  error: z.string().nullable().optional(),
   status: z.string(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  csr: z.string().nullable().optional(),
-  certificate: z.string().nullable().optional(),
-  certificateChain: z.string().nullable().optional(),
-  error: z.string().nullable().optional(),
-  certificateId: z.string().uuid().nullable().optional()
+  updatedAt: z.date()
 });
 
 export type TPkiAcmeOrders = z.infer<typeof PkiAcmeOrdersSchema>;
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 8ec786ec9..546bd6757 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -599,32 +599,27 @@ export const pkiAcmeServiceFactory = ({
         // TODO: this should be the same transaction?
         let errorToReturn: Error | undefined;
         try {
-          const { certificate, certificateChain, certificateId } =
-            await certificateV3Service.signCertificateFromProfile({
-              actor: ActorType.ACME_ACCOUNT,
-              actorId: accountId,
-              actorAuthMethod: null,
-              actorOrgId,
-              profileId,
-              csr,
-              notBefore: order.notBefore ? new Date(order.notBefore) : undefined,
-              notAfter: order.notAfter ? new Date(order.notAfter) : undefined,
-              validity: {
-                // TODO: read config from the profile to get the expiration time instead
-                ttl: (24 * 60 * 60 * 1000).toString()
-              },
-              enrollmentType: EnrollmentType.ACME
-            });
+          const { certificateId } = await certificateV3Service.signCertificateFromProfile({
+            actor: ActorType.ACME_ACCOUNT,
+            actorId: accountId,
+            actorAuthMethod: null,
+            actorOrgId,
+            profileId,
+            csr,
+            notBefore: order.notBefore ? new Date(order.notBefore) : undefined,
+            notAfter: order.notAfter ? new Date(order.notAfter) : undefined,
+            validity: {
+              // TODO: read config from the profile to get the expiration time instead
+              ttl: (24 * 60 * 60 * 1000).toString()
+            },
+            enrollmentType: EnrollmentType.ACME
+          });
           // TODO: associate the certificate with the order
           await acmeOrderDAL.updateById(
             orderId,
             {
               status: AcmeOrderStatus.Valid,
               csr,
-              // TODO: we actually don't need to store the certificate and certificate chain here
-              //       It appears that the certificate and certificate chain are stored in the certificate_body table already
-              certificateChain,
-              certificate,
               certificateId
             },
             tx