Skip to content

Commit 980177e

Browse files
aarongableaarongable
committed
Update NewOrderAndAuthzs
1 parent 7bcc95a commit 980177e

File tree

3 files changed

+126
-35
lines changed

3 files changed

+126
-35
lines changed

‎sa/model.go‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
corepb "github.com/letsencrypt/boulder/core/proto"
2626
"github.com/letsencrypt/boulder/db"
2727
berrors "github.com/letsencrypt/boulder/errors"
28+
"github.com/letsencrypt/boulder/features"
2829
"github.com/letsencrypt/boulder/grpc"
2930
"github.com/letsencrypt/boulder/identifier"
3031
"github.com/letsencrypt/boulder/probs"
@@ -1258,24 +1259,47 @@ type authzValidity struct {
12581259

12591260
// getAuthorizationStatuses takes a sequence of authz IDs, and returns the
12601261
// status and expiration date of each of them.
1261-
func getAuthorizationStatuses(ctx context.Context, s db.Selector, ids []int64) ([]authzValidity, error) {
1262-
var params []interface{}
1262+
func getAuthorizationStatuses(ctx context.Context, s db.Selector, now time.Time, ids []int64) ([]authzValidity, error) {
1263+
var oldIDs, newIDs []interface{}
12631264
for _, id := range ids {
1264-
params = append(params, id)
1265+
if features.Get().ReadNewOrderSchema && looksLikeRandomID(id, now) {
1266+
newIDs = append(newIDs, id)
1267+
} else {
1268+
oldIDs = append(oldIDs, id)
1269+
}
12651270
}
1266-
var validities []authzValidity
1267-
_, err := s.Select(
1268-
ctx,
1269-
&validities,
1270-
fmt.Sprintf("SELECT identifierType, identifierValue, status, expires FROM authz2 WHERE id IN (%s)",
1271-
db.QuestionMarks(len(ids))),
1272-
params...,
1273-
)
1274-
if err != nil {
1275-
return nil, err
1271+
1272+
var oldValidities []authzValidity
1273+
if len(oldIDs) > 0 {
1274+
_, err := s.Select(
1275+
ctx,
1276+
&oldValidities,
1277+
fmt.Sprintf(
1278+
"SELECT identifierType, identifierValue, status, expires FROM authz2 WHERE id IN (%s)",
1279+
db.QuestionMarks(len(ids))),
1280+
oldIDs...,
1281+
)
1282+
if err != nil {
1283+
return nil, err
1284+
}
1285+
}
1286+
1287+
var newValidities []authzValidity
1288+
if len(newIDs) > 0 {
1289+
_, err := s.Select(
1290+
ctx,
1291+
&newValidities,
1292+
fmt.Sprintf(
1293+
"SELECT identifierType, identifierValue, status, expires FROM authorizations WHERE id IN (%s)",
1294+
db.QuestionMarks(len(ids))),
1295+
newIDs...,
1296+
)
1297+
if err != nil {
1298+
return nil, err
1299+
}
12761300
}
12771301

1278-
return validities, nil
1302+
return append(oldValidities, newValidities...), nil
12791303
}
12801304

12811305
// authzForOrder retrieves the authorization IDs for an order.

‎sa/sa.go‎

Lines changed: 87 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"crypto/x509"
66
"database/sql"
7+
"encoding/base64"
78
"encoding/json"
89
"errors"
910
"fmt"
@@ -576,7 +577,7 @@ func (ssa *SQLStorageAuthority) DeactivateAuthorization2(ctx context.Context, re
576577
}
577578

578579
// NewOrderAndAuthzs adds the given authorizations to the database, adds their
579-
// autogenerated IDs to the given order, and then adds the order to the db.
580+
// IDs to the given order, and then adds the order to the db.
580581
// This is done inside a single transaction to prevent situations where new
581582
// authorizations are created, but then their corresponding order is never
582583
// created, leading to "invisible" pending authorizations.
@@ -597,7 +598,45 @@ func (ssa *SQLStorageAuthority) NewOrderAndAuthzs(ctx context.Context, req *sapb
597598
output, err := db.WithTransaction(ctx, ssa.dbMap, func(tx db.Executor) (interface{}, error) {
598599
// First, insert all of the new authorizations and record their IDs.
599600
newAuthzIDs := make([]int64, 0)
600-
if features.Get().InsertAuthzsIndividually {
601+
if features.Get().WriteNewOrderSchema {
602+
for _, authz := range req.NewAuthzs {
603+
id, err := newRandomID(ssa.clk.Now())
604+
if err != nil {
605+
return nil, fmt.Errorf("generating authz ID: %w", err)
606+
}
607+
608+
token, err := base64.RawURLEncoding.DecodeString(authz.Token)
609+
if err != nil {
610+
return nil, fmt.Errorf("decoding challenge token: %w", err)
611+
}
612+
613+
var challenges uint8
614+
for _, challType := range authz.ChallengeTypes {
615+
challenges |= 1 << challTypeToUint[challType]
616+
}
617+
618+
am := authorizationsModel{
619+
ID: id,
620+
RegistrationID: authz.RegistrationID,
621+
IdentifierType: identifierTypeToUint[authz.Identifier.Type],
622+
IdentifierValue: authz.Identifier.Value,
623+
Created: ssa.clk.Now(),
624+
Expires: authz.Expires.AsTime(),
625+
Profile: req.NewOrder.CertificateProfileName,
626+
Challenges: challenges,
627+
Token: token,
628+
Status: statusToUint[core.StatusPending],
629+
ValidationIDs: nil, // Only set when validation is attempted
630+
}
631+
632+
err = tx.Insert(ctx, am)
633+
if err != nil {
634+
return nil, fmt.Errorf("inserting authorizations row: %w", err)
635+
}
636+
637+
newAuthzIDs = append(newAuthzIDs, id)
638+
}
639+
} else if features.Get().InsertAuthzsIndividually {
601640
for _, authz := range req.NewAuthzs {
602641
am, err := newAuthzReqToModel(authz)
603642
if err != nil {
@@ -645,18 +684,45 @@ func (ssa *SQLStorageAuthority) NewOrderAndAuthzs(ctx context.Context, req *sapb
645684
}
646685
}
647686

687+
allAuthzIds := append(req.NewOrder.V2Authorizations, newAuthzIDs...)
688+
648689
// Second, insert the new order.
649690
var orderID int64
650691
var err error
651692
created := ssa.clk.Now()
652-
if features.Get().MultipleCertificateProfiles {
693+
if features.Get().WriteNewOrderSchema {
694+
id, err := newRandomID(ssa.clk.Now())
695+
if err != nil {
696+
return nil, fmt.Errorf("generating order ID: %w", err)
697+
}
698+
699+
om := orders2Model{
700+
ID: id,
701+
RegistrationID: req.NewOrder.RegistrationID,
702+
Created: ssa.clk.Now(),
703+
Expires: req.NewOrder.Expires.AsTime(),
704+
AuthorizationIDs: allAuthzIds,
705+
Profile: req.NewOrder.CertificateProfileName,
706+
BeganProcessing: false, // Only set when finalization has begun
707+
Error: nil, // Only set if finalization fails
708+
CertificateSerial: "", // Only set if finalization succeeds
709+
}
710+
711+
err = tx.Insert(ctx, om)
712+
if err != nil {
713+
return nil, err
714+
}
715+
} else if features.Get().MultipleCertificateProfiles {
653716
omv2 := orderModelv2{
654717
RegistrationID: req.NewOrder.RegistrationID,
655718
Expires: req.NewOrder.Expires.AsTime(),
656719
Created: created,
657720
CertificateProfileName: &req.NewOrder.CertificateProfileName,
658721
}
659722
err = tx.Insert(ctx, &omv2)
723+
if err != nil {
724+
return nil, err
725+
}
660726
orderID = omv2.ID
661727
} else {
662728
omv1 := orderModelv1{
@@ -665,28 +731,29 @@ func (ssa *SQLStorageAuthority) NewOrderAndAuthzs(ctx context.Context, req *sapb
665731
Created: created,
666732
}
667733
err = tx.Insert(ctx, &omv1)
734+
if err != nil {
735+
return nil, err
736+
}
668737
orderID = omv1.ID
669738
}
670-
if err != nil {
671-
return nil, err
672-
}
673739

674-
// Third, insert all of the orderToAuthz relations.
675-
// Have to combine the already-associated and newly-created authzs.
676-
allAuthzIds := append(req.NewOrder.V2Authorizations, newAuthzIDs...)
677-
inserter, err := db.NewMultiInserter("orderToAuthz2", []string{"orderID", "authzID"}, "")
678-
if err != nil {
679-
return nil, err
680-
}
681-
for _, id := range allAuthzIds {
682-
err := inserter.Add([]interface{}{orderID, id})
740+
if !features.Get().WriteNewOrderSchema {
741+
// Third, insert all of the orderToAuthz relations.
742+
// Have to combine the already-associated and newly-created authzs.
743+
inserter, err := db.NewMultiInserter("orderToAuthz2", []string{"orderID", "authzID"}, "")
744+
if err != nil {
745+
return nil, err
746+
}
747+
for _, id := range allAuthzIds {
748+
err := inserter.Add([]interface{}{orderID, id})
749+
if err != nil {
750+
return nil, err
751+
}
752+
}
753+
_, err = inserter.Insert(ctx, tx)
683754
if err != nil {
684755
return nil, err
685756
}
686-
}
687-
_, err = inserter.Insert(ctx, tx)
688-
if err != nil {
689-
return nil, err
690757
}
691758

692759
// Fourth, insert the FQDNSet entry for the order.
@@ -705,7 +772,7 @@ func (ssa *SQLStorageAuthority) NewOrderAndAuthzs(ctx context.Context, req *sapb
705772
}
706773

707774
// Get the partial Authorization objects for the order
708-
authzValidityInfo, err := getAuthorizationStatuses(ctx, tx, allAuthzIds)
775+
authzValidityInfo, err := getAuthorizationStatuses(ctx, tx, ssa.clk.Now(), allAuthzIds)
709776
// If there was an error getting the authorizations, return it immediately
710777
if err != nil {
711778
return nil, err

‎sa/saro.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -549,7 +549,7 @@ func (ssa *SQLStorageAuthorityRO) GetOrder(ctx context.Context, req *sapb.OrderR
549549
order.V2Authorizations = v2AuthzIDs
550550

551551
// Get the partial Authorization objects for the order
552-
authzValidityInfo, err := getAuthorizationStatuses(ctx, tx, order.V2Authorizations)
552+
authzValidityInfo, err := getAuthorizationStatuses(ctx, tx, ssa.clk.Now(), order.V2Authorizations)
553553
// If there was an error getting the authorizations, return it immediately
554554
if err != nil {
555555
return nil, err

0 commit comments

Comments
 (0)