From 3c887522ec94fcf73394bb234edeedfb4581e497 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Mon, 3 Nov 2025 18:39:09 -0800
Subject: [PATCH] Add cert foreign key

---
 backend/src/db/migrations/20251029234547_add-pki-acme.ts | 4 ++++
 backend/src/ee/services/pki-acme/pki-acme-service.ts     | 3 +--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/backend/src/db/migrations/20251029234547_add-pki-acme.ts b/backend/src/db/migrations/20251029234547_add-pki-acme.ts
index e76587159..f9db5c2ac 100644
--- a/backend/src/db/migrations/20251029234547_add-pki-acme.ts
+++ b/backend/src/db/migrations/20251029234547_add-pki-acme.ts
@@ -80,6 +80,10 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("accountId").notNullable();
       t.foreign("accountId").references("id").inTable(TableName.PkiAcmeAccount).onDelete("CASCADE");
 
+      // Foreign key to certificate
+      t.uuid("certificateId").nullable();
+      t.foreign("certificateId").references("id").inTable(TableName.Certificate).onDelete("CASCADE");
+
       t.timestamp("notBefore").nullable();
       t.timestamp("notAfter").nullable();
 
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 43c77b3d1..86c5607d3 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -319,7 +319,7 @@ export const pkiAcmeServiceFactory = ({
     const kmsDecryptor = await kmsService.decryptWithKmsKey({
       kmsId: certificateManagerKmsId
     });
-    const eabSecret = await kmsDecryptor({ cipherTextBlob: profile.acmeConfig!.encryptedEabSecret });
+    const eabSecret = await kmsDecryptor({ cipherTextBlob: profile.acmeConfig!.encryptedEabSecret! });
     try {
       const { payload: eabPayload, protectedHeader: eabProtectedHeader } = await flattenedVerify(
         externalAccountBinding,
@@ -393,7 +393,6 @@ export const pkiAcmeServiceFactory = ({
       emails: contact ?? []
     });
     // TODO: create audit log here
-    // TODO: check EAB authentication here
     return {
       status: 201,
       body: {