From acbf0015cb0881fd6ae446618a78b7ff4893dc97 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Mon, 27 Oct 2025 18:28:30 -0700
Subject: [PATCH] Add missing downgrade

---
 .../src/db/migrations/20251027234547_add-pki-acme.ts  | 11 ++++++++++-
 backend/src/db/schemas/pki-acme-enrollment-configs.ts |  3 +++
 backend/src/db/schemas/pki-certificate-profiles.ts    |  4 ++--
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/backend/src/db/migrations/20251027234547_add-pki-acme.ts b/backend/src/db/migrations/20251027234547_add-pki-acme.ts
index 255d6a9a4..01483938b 100644
--- a/backend/src/db/migrations/20251027234547_add-pki-acme.ts
+++ b/backend/src/db/migrations/20251027234547_add-pki-acme.ts
@@ -21,7 +21,8 @@ export async function up(knex: Knex): Promise<void> {
       t.foreign("acmeConfigId").references("id").inTable(TableName.PkiAcmeEnrollmentConfig).onDelete("SET NULL");
       t.index("acmeConfigId");
     });
-    // TODO: should update (or add?) the constraints to check at least one of the enrollment config id is set
+    // TODO: should update (or add?) the constraints to check at least one of
+    //       the enrollment config id is set and it matches the enrollment type?
   }
 
   // Create PkiAcmeAccount table
@@ -120,6 +121,14 @@ export async function up(knex: Knex): Promise<void> {
 export async function down(knex: Knex): Promise<void> {
   // Drop tables in reverse dependency order
 
+  if (await knex.schema.hasColumn(TableName.PkiCertificateProfile, "acmeConfigId")) {
+    await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
+      t.dropForeign(["acmeConfigId"]);
+      t.dropIndex("acmeConfigId");
+      t.dropColumn("acmeConfigId");
+    });
+  }
+
   // Drop PkiAcmeChallenge first (depends on PkiAcmeAuth)
   if (await knex.schema.hasTable(TableName.PkiAcmeChallenge)) {
     await knex.schema.dropTable(TableName.PkiAcmeChallenge);
diff --git a/backend/src/db/schemas/pki-acme-enrollment-configs.ts b/backend/src/db/schemas/pki-acme-enrollment-configs.ts
index 19058b00b..f0592319b 100644
--- a/backend/src/db/schemas/pki-acme-enrollment-configs.ts
+++ b/backend/src/db/schemas/pki-acme-enrollment-configs.ts
@@ -5,10 +5,13 @@
 
 import { z } from "zod";
 
+import { zodBuffer } from "@app/lib/zod";
+
 import { TImmutableDBKeys } from "./models";
 
 export const PkiAcmeEnrollmentConfigsSchema = z.object({
   id: z.string().uuid(),
+  encryptedEabSecret: zodBuffer,
   createdAt: z.date(),
   updatedAt: z.date()
 });
diff --git a/backend/src/db/schemas/pki-certificate-profiles.ts b/backend/src/db/schemas/pki-certificate-profiles.ts
index 8141363bd..04560bec6 100644
--- a/backend/src/db/schemas/pki-certificate-profiles.ts
+++ b/backend/src/db/schemas/pki-certificate-profiles.ts
@@ -17,9 +17,9 @@ export const PkiCertificateProfilesSchema = z.object({
   enrollmentType: z.string(),
   estConfigId: z.string().uuid().nullable().optional(),
   apiConfigId: z.string().uuid().nullable().optional(),
-  acmeConfigId: z.string().uuid().nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date()
+  updatedAt: z.date(),
+  acmeConfigId: z.string().uuid().nullable().optional()
 });
 
 export type TPkiCertificateProfiles = z.infer<typeof PkiCertificateProfilesSchema>;