From 708b8f9f65f7451699a985571905034743ecab3b Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Tue, 4 Nov 2025 11:32:23 -0800
Subject: [PATCH] Refine

---
 .../ee/services/pki-acme/pki-acme-service.ts  | 27 ++++++++++---------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index caf6c53cd..373063925 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -353,19 +353,22 @@ export const pkiAcmeServiceFactory = ({
       kmsId: certificateManagerKmsId
     });
     const eabSecret = await kmsDecryptor({ cipherTextBlob: profile.acmeConfig!.encryptedEabSecret! });
-    let eabPayload: Uint8Array<ArrayBufferLike> | undefined;
-    let eabProtectedHeader: JWSHeaderParameters | undefined;
-    try {
-      const result = await flattenedVerify(externalAccountBinding, eabSecret);
-      eabPayload = result.payload;
-      eabProtectedHeader = result.protectedHeader;
-    } catch (error) {
-      if (error instanceof errors.JWSInvalid) {
-        throw new AcmeMalformedError({ detail: "Invalid external account binding JWS payload" });
+    const { eabPayload, eabProtectedHeader } = await (async () => {
+      try {
+        const { payload: eabPayload, protectedHeader: eabProtectedHeader } = await flattenedVerify(
+          externalAccountBinding,
+          eabSecret
+        );
+        return { eabPayload, eabProtectedHeader };
+      } catch (error) {
+        if (error instanceof errors.JWSInvalid) {
+          throw new AcmeMalformedError({ detail: "Invalid external account binding JWS payload" });
+        }
+        logger.error(error, "Unexpected error while verifying EAB JWS payload");
+        throw new AcmeServerInternalError({ detail: "Failed to verify EAB JWS payload" });
       }
-      logger.error(error, "Unexpected error while verifying EAB JWS payload");
-      throw new AcmeServerInternalError({ detail: "Failed to verify EAB JWS payload" });
-    }
+    })();
+
     const { alg: eabAlg, kid: eabKid } = eabProtectedHeader!;
     if (!["HS256", "HS384", "HS512"].includes(eabAlg!)) {
       throw new AcmeMalformedError({ detail: "Invalid algorithm for external account binding JWS payload" });