Fix review feedbacks

backend/src/services/certificate-v3/certificate-v3-service.test.ts

@@ -30,6 +30,7 @@ import {
   extractCertificateRequestFromCSR
 } from "../certificate-common/certificate-csr-utils";
 import { certificateV3ServiceFactory, TCertificateV3ServiceFactory } from "./certificate-v3-service";
+import { TPkiAcmeAccountDALFactory } from "@app/ee/services/pki-acme/pki-acme-account-dal";
 
 vi.mock("../certificate-common/certificate-csr-utils", () => ({
   extractCertificateRequestFromCSR: vi.fn(),
@@ -69,6 +70,10 @@ describe("CertificateV3Service", () => {
     getTemplateV2ById: vi.fn()
   };
 
+  const mockAcmeAccountDAL: Pick<TPkiAcmeAccountDALFactory, "findById"> = {
+    findById: vi.fn()
+  };
+
   const mockInternalCaService: Pick<TInternalCertificateAuthorityServiceFactory, "signCertFromCa" | "issueCertFromCa"> =
     {
       signCertFromCa: vi.fn(),
@@ -132,6 +137,7 @@ describe("CertificateV3Service", () => {
       certificateAuthorityDAL: mockCertificateAuthorityDAL,
       certificateProfileDAL: mockCertificateProfileDAL,
       certificateTemplateV2Service: mockCertificateTemplateV2Service,
+      acmeAccountDAL: mockAcmeAccountDAL,
       internalCaService: mockInternalCaService,
       permissionService: mockPermissionService,
       certificateSyncDAL: {

backend/src/services/certificate-v3/certificate-v3-service.ts

@@ -64,12 +64,14 @@ import {
   TSignCertificateFromProfileDTO,
   TUpdateRenewalConfigDTO
 } from "./certificate-v3-types";
+import { TPkiAcmeAccountDALFactory } from "@app/ee/services/pki-acme/pki-acme-account-dal";
 
 type TCertificateV3ServiceFactoryDep = {
   certificateDAL: Pick<TCertificateDALFactory, "findOne" | "findById" | "updateById" | "transaction">;
   certificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
   certificateProfileDAL: Pick<TCertificateProfileDALFactory, "findByIdWithConfigs">;
+  acmeAccountDAL: Pick<TPkiAcmeAccountDALFactory, "findById">;
   certificateTemplateV2Service: Pick<
     TCertificateTemplateV2ServiceFactory,
     "validateCertificateRequest" | "getTemplateV2ById"
@@ -93,6 +95,7 @@ const validateProfileAndPermissions = async (
   actorAuthMethod: ActorAuthMethod,
   actorOrgId: string,
   certificateProfileDAL: Pick<TCertificateProfileDALFactory, "findByIdWithConfigs">,
+  acmeAccountDAL: Pick<TPkiAcmeAccountDALFactory, "findById">,
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">,
   requiredEnrollmentType: EnrollmentType
 ) => {
@@ -107,10 +110,16 @@ const validateProfileAndPermissions = async (
     });
   }
 
-  // XXX: NOT SURE IF THIS IS SECURE TO BY PASS THE PERMISSION CHECK FOR ACME ACCOUNTS
-  //      may need to consider this carefully
-  // TODO: check actor/profile ownership as well
   if (actor === ActorType.ACME_ACCOUNT && requiredEnrollmentType === EnrollmentType.ACME) {
+    const account = await acmeAccountDAL.findById(actorId);
+    if (!account) {
+      throw new NotFoundError({ message: "ACME account not found" });
+    }
+    if (account.profileId !== profile.id) {
+      throw new ForbiddenRequestError({
+        message: "ACME account is not associated with this profile"
+      });
+    }
     return profile;
   }
 
@@ -343,6 +352,7 @@ export const certificateV3ServiceFactory = ({
   certificateSecretDAL,
   certificateAuthorityDAL,
   certificateProfileDAL,
+  acmeAccountDAL,
   certificateTemplateV2Service,
   internalCaService,
   permissionService,
@@ -365,6 +375,7 @@ export const certificateV3ServiceFactory = ({
       actorAuthMethod,
       actorOrgId,
       certificateProfileDAL,
+      acmeAccountDAL,
       permissionService,
       EnrollmentType.API
     );