From 12b245b641968ea0df4d1155dddc5851c4025272 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Tue, 9 Dec 2025 17:31:43 -0800
Subject: [PATCH] More audit log stuff

---
 .../ee/services/audit-log/audit-log-types.ts  | 16 ++++++++++++---
 .../ee/services/pki-acme/pki-acme-service.ts  | 20 ++++++++++++++++++-
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts
index cd7d860fc..991198a1a 100644
--- a/backend/src/ee/services/audit-log/audit-log-types.ts
+++ b/backend/src/ee/services/audit-log/audit-log-types.ts
@@ -49,8 +49,8 @@ import { TWebhookPayloads } from "@app/services/webhook/webhook-types";
 import { WorkflowIntegration } from "@app/services/workflow-integration/workflow-integration-types";
 
 import { KmipPermission } from "../kmip/kmip-enum";
-import { ApprovalStatus } from "../secret-approval-request/secret-approval-request-types";
 import { AcmeIdentifierType } from "../pki-acme/pki-acme-schemas";
+import { ApprovalStatus } from "../secret-approval-request/secret-approval-request-types";
 
 export type TListProjectAuditLogDTO = {
   filter: {
@@ -582,7 +582,8 @@ export enum EventType {
   // PKI ACME
   CREATE_ACME_ACCOUNT = "create-acme-account",
   RETRIEVE_ACME_ACCOUNT = "retrieve-acme-account",
-  CREATE_ACME_ORDER = "create-acme-order"
+  CREATE_ACME_ORDER = "create-acme-order",
+  FINALIZE_ACME_ORDER = "finalize-acme-order"
 }
 
 export const filterableSecretEvents: EventType[] = [
@@ -4430,6 +4431,14 @@ interface CreateAcmeOrderEvent {
   };
 }
 
+interface FinalizeAcmeOrderEvent {
+  type: EventType.FINALIZE_ACME_ORDER;
+  metadata: {
+    orderId: string;
+    csr: string;
+  };
+}
+
 export type Event =
   | CreateSubOrganizationEvent
   | UpdateSubOrganizationEvent
@@ -4833,4 +4842,5 @@ export type Event =
   | ApprovalRequestGrantRevokeEvent
   | CreateAcmeAccountEvent
   | RetrieveAcmeAccountEvent
-  | CreateAcmeOrderEvent;
+  | CreateAcmeOrderEvent
+  | FinalizeAcmeOrderEvent;
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 16ae5e7bf..b192ac46d 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -613,6 +613,7 @@ export const pkiAcmeServiceFactory = ({
     //       if not, we may be able to reject it early with an unsupportedIdentifier error.
 
     // TODO: ideally, we should return an error with subproblems if we have multiple unsupported identifiers
+    const profile = await validateAcmeProfile(profileId);
     if (payload.identifiers.some((identifier) => identifier.type !== AcmeIdentifierType.DNS)) {
       throw new AcmeUnsupportedIdentifierError({ message: "Only DNS identifiers are supported" });
     }
@@ -686,7 +687,7 @@ export const pkiAcmeServiceFactory = ({
         tx
       );
       await auditLogService.createAuditLog({
-        projectId: account.profileId,
+        projectId: profile.projectId,
         actor: {
           type: ActorType.ACME_ACCOUNT,
           metadata: {
@@ -932,6 +933,23 @@ export const pkiAcmeServiceFactory = ({
         throw error;
       }
       order = updatedOrder;
+      await auditLogService.createAuditLog({
+        projectId: profile.projectId,
+        actor: {
+          type: ActorType.ACME_ACCOUNT,
+          metadata: {
+            profileId,
+            accountId
+          }
+        },
+        event: {
+          type: EventType.FINALIZE_ACME_ORDER,
+          metadata: {
+            orderId: updatedOrder.id,
+            csr: updatedOrder.csr!
+          }
+        }
+      });
     } else if (order.status !== AcmeOrderStatus.Valid) {
       throw new AcmeOrderNotReadyError({ message: "ACME order is not ready" });
     }