From 5366136693db5ad95e400998de31c4594346c842 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Tue, 28 Oct 2025 09:48:02 -0700
Subject: [PATCH] Try to fix constraint

---
 .../migrations/20251027234547_add-pki-acme.ts | 37 ++++++++++++++-----
 .../utils/dropConstraintIfExists.ts           |  2 +-
 2 files changed, 28 insertions(+), 11 deletions(-)

diff --git a/backend/src/db/migrations/20251027234547_add-pki-acme.ts b/backend/src/db/migrations/20251027234547_add-pki-acme.ts
index 01483938b..5352f71fa 100644
--- a/backend/src/db/migrations/20251027234547_add-pki-acme.ts
+++ b/backend/src/db/migrations/20251027234547_add-pki-acme.ts
@@ -1,6 +1,9 @@
 import { Knex } from "knex";
 import { TableName } from "../schemas";
 import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+import { dropConstraintIfExists } from "@app/db/migrations/utils/dropConstraintIfExists";
+
+const ENROLLMENT_TYPE_CHECK_CONSTRAINT = "pki_certificate_profiles_enrollmentType_check";
 
 export async function up(knex: Knex): Promise<void> {
   // Create PkiAcmeEnrollmentConfig table
@@ -21,8 +24,13 @@ export async function up(knex: Knex): Promise<void> {
       t.foreign("acmeConfigId").references("id").inTable(TableName.PkiAcmeEnrollmentConfig).onDelete("SET NULL");
       t.index("acmeConfigId");
     });
-    // TODO: should update (or add?) the constraints to check at least one of
-    //       the enrollment config id is set and it matches the enrollment type?
+  }
+
+  await dropConstraintIfExists(TableName.PkiCertificateProfile, ENROLLMENT_TYPE_CHECK_CONSTRAINT, knex);
+  if (await knex.schema.hasColumn(TableName.PkiCertificateProfile, "enrollmentType")) {
+    await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
+      t.string("enrollmentType").checkIn(["api", "est", "acme"], ENROLLMENT_TYPE_CHECK_CONSTRAINT).alter();
+    });
   }
 
   // Create PkiAcmeAccount table
@@ -121,14 +129,6 @@ export async function up(knex: Knex): Promise<void> {
 export async function down(knex: Knex): Promise<void> {
   // Drop tables in reverse dependency order
 
-  if (await knex.schema.hasColumn(TableName.PkiCertificateProfile, "acmeConfigId")) {
-    await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
-      t.dropForeign(["acmeConfigId"]);
-      t.dropIndex("acmeConfigId");
-      t.dropColumn("acmeConfigId");
-    });
-  }
-
   // Drop PkiAcmeChallenge first (depends on PkiAcmeAuth)
   if (await knex.schema.hasTable(TableName.PkiAcmeChallenge)) {
     await knex.schema.dropTable(TableName.PkiAcmeChallenge);
@@ -153,6 +153,23 @@ export async function down(knex: Knex): Promise<void> {
     await dropOnUpdateTrigger(knex, TableName.PkiAcmeAccount);
   }
 
+  // Change enrollmentType check constraint to only allow api and est
+  await dropConstraintIfExists(TableName.PkiCertificateProfile, ENROLLMENT_TYPE_CHECK_CONSTRAINT, knex);
+  if (await knex.schema.hasColumn(TableName.PkiCertificateProfile, "enrollmentType")) {
+    await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
+      t.string("enrollmentType").checkIn(["api", "est"], ENROLLMENT_TYPE_CHECK_CONSTRAINT).alter();
+    });
+  }
+
+  // Drop acmeConfigId column
+  if (await knex.schema.hasColumn(TableName.PkiCertificateProfile, "acmeConfigId")) {
+    await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
+      t.dropForeign(["acmeConfigId"]);
+      t.dropIndex("acmeConfigId");
+      t.dropColumn("acmeConfigId");
+    });
+  }
+
   // Drop PkiAcmeEnrollmentConfig
   if (await knex.schema.hasTable(TableName.PkiAcmeEnrollmentConfig)) {
     await knex.schema.dropTable(TableName.PkiAcmeEnrollmentConfig);
diff --git a/backend/src/db/migrations/utils/dropConstraintIfExists.ts b/backend/src/db/migrations/utils/dropConstraintIfExists.ts
index bfe487d49..93985ca76 100644
--- a/backend/src/db/migrations/utils/dropConstraintIfExists.ts
+++ b/backend/src/db/migrations/utils/dropConstraintIfExists.ts
@@ -3,4 +3,4 @@ import { Knex } from "knex";
 import { TableName } from "@app/db/schemas";
 
 export const dropConstraintIfExists = (tableName: TableName, constraintName: string, knex: Knex) =>
-  knex.raw(`ALTER TABLE ${tableName} DROP CONSTRAINT IF EXISTS ${constraintName};`);
+  knex.raw("ALTER TABLE ?? DROP CONSTRAINT IF EXISTS ??;", [tableName, constraintName]);