From 49ad8ab630667d50ad351d1d353d928d91e4566b Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Mon, 3 Nov 2025 14:45:24 -0800
Subject: [PATCH] Return eab kid as well

---
 .../src/server/routes/v1/certificate-profiles-router.ts   | 5 +++--
 .../certificate-profile/certificate-profile-dal.ts        | 8 ++++++--
 .../certificate-profile/certificate-profile-service.ts    | 2 +-
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/backend/src/server/routes/v1/certificate-profiles-router.ts b/backend/src/server/routes/v1/certificate-profiles-router.ts
index 1a670c254..f85f8a677 100644
--- a/backend/src/server/routes/v1/certificate-profiles-router.ts
+++ b/backend/src/server/routes/v1/certificate-profiles-router.ts
@@ -506,20 +506,21 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       }),
       response: {
         200: z.object({
+          eabKid: z.string(),
           eabSecret: z.string()
         })
       }
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
-      const eabSecret = await server.services.certificateProfile.revealAcmeEabSecret({
+      const { eabKid, eabSecret } = await server.services.certificateProfile.revealAcmeEabSecret({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
         actorOrgId: req.permission.orgId,
         profileId: req.params.id
       });
-      return { eabSecret };
+      return { eabKid, eabSecret };
     }
   });
 };
diff --git a/backend/src/services/certificate-profile/certificate-profile-dal.ts b/backend/src/services/certificate-profile/certificate-profile-dal.ts
index beea084e3..f8f511ab4 100644
--- a/backend/src/services/certificate-profile/certificate-profile-dal.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-dal.ts
@@ -130,7 +130,8 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           db.ref("id").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigId"),
           db.ref("autoRenew").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigAutoRenew"),
           db.ref("renewBeforeDays").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigRenewBeforeDays"),
-          db.ref("id").withSchema(TableName.PkiAcmeEnrollmentConfig).as("acmeConfigId")
+          db.ref("id").withSchema(TableName.PkiAcmeEnrollmentConfig).as("acmeConfigId"),
+          db.ref("encryptedEabSecret").withSchema(TableName.PkiAcmeEnrollmentConfig).as("acmeConfigEncryptedEabSecret")
         )
         .where(`${TableName.PkiCertificateProfile}.id`, id)
         .first();
@@ -158,7 +159,10 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
         : undefined;
 
       const acmeConfig = result.acmeConfigId
-        ? ({ id: result.acmeConfigId } as TCertificateProfileWithConfigs["acmeConfig"])
+        ? ({
+            id: result.acmeConfigId,
+            encryptedEabSecret: result.acmeConfigEncryptedEabSecret
+          } as TCertificateProfileWithConfigs["acmeConfig"])
         : undefined;
 
       const certificateAuthority =
diff --git a/backend/src/services/certificate-profile/certificate-profile-service.ts b/backend/src/services/certificate-profile/certificate-profile-service.ts
index f896bb071..2e92c4b02 100644
--- a/backend/src/services/certificate-profile/certificate-profile-service.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-service.ts
@@ -832,7 +832,7 @@ export const certificateProfileServiceFactory = ({
       kmsId: certificateManagerKmsId
     });
     const eabSecret = await kmsDecryptor({ cipherTextBlob: profile.acmeConfig.encryptedEabSecret });
-    return eabSecret.toString();
+    return { eabKid: profile.id, eabSecret: eabSecret.toString() };
   };
 
   return {