Add missing downgrade

backend/src/db/migrations/20251027234547_add-pki-acme.ts

@@ -21,7 +21,8 @@ export async function up(knex: Knex): Promise<void> {
       t.foreign("acmeConfigId").references("id").inTable(TableName.PkiAcmeEnrollmentConfig).onDelete("SET NULL");
       t.index("acmeConfigId");
     });
-    // TODO: should update (or add?) the constraints to check at least one of the enrollment config id is set
+    // TODO: should update (or add?) the constraints to check at least one of
+    //       the enrollment config id is set and it matches the enrollment type?
   }
 
   // Create PkiAcmeAccount table
@@ -120,6 +121,14 @@ export async function up(knex: Knex): Promise<void> {
 export async function down(knex: Knex): Promise<void> {
   // Drop tables in reverse dependency order
 
+  if (await knex.schema.hasColumn(TableName.PkiCertificateProfile, "acmeConfigId")) {
+    await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
+      t.dropForeign(["acmeConfigId"]);
+      t.dropIndex("acmeConfigId");
+      t.dropColumn("acmeConfigId");
+    });
+  }
+
   // Drop PkiAcmeChallenge first (depends on PkiAcmeAuth)
   if (await knex.schema.hasTable(TableName.PkiAcmeChallenge)) {
     await knex.schema.dropTable(TableName.PkiAcmeChallenge);

backend/src/db/schemas/pki-acme-enrollment-configs.ts

@@ -5,10 +5,13 @@
 
 import { z } from "zod";
 
+import { zodBuffer } from "@app/lib/zod";
+
 import { TImmutableDBKeys } from "./models";
 
 export const PkiAcmeEnrollmentConfigsSchema = z.object({
   id: z.string().uuid(),
+  encryptedEabSecret: zodBuffer,
   createdAt: z.date(),
   updatedAt: z.date()
 });

backend/src/db/schemas/pki-certificate-profiles.ts

@@ -17,9 +17,9 @@ export const PkiCertificateProfilesSchema = z.object({
   enrollmentType: z.string(),
   estConfigId: z.string().uuid().nullable().optional(),
   apiConfigId: z.string().uuid().nullable().optional(),
-  acmeConfigId: z.string().uuid().nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date()
+  updatedAt: z.date(),
+  acmeConfigId: z.string().uuid().nullable().optional()
 });
 
 export type TPkiCertificateProfiles = z.infer<typeof PkiCertificateProfilesSchema>;