fix lint

internal/apps/openflare/tls/obtain_helpers.go

@@ -0,0 +1,74 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package tls
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/tls/acme"
+	"github.com/Rain-kl/Wavelet/internal/model"
+)
+
+func resolveAcmeAccount(ctx context.Context, cert *model.TLSCertificate) (*model.AcmeAccount, error) {
+	acmeAccount, err := model.GetAcmeAccountByID(ctx, cert.AcmeAccountID)
+	if err == nil {
+		return acmeAccount, nil
+	}
+	acmeAccount, err = model.GetDefaultAcmeAccount(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get ACME account: %w", err)
+	}
+	cert.AcmeAccountID = acmeAccount.ID
+	if err := model.SaveTLSCertificate(ctx, cert); err != nil {
+		return nil, err
+	}
+	return acmeAccount, nil
+}
+
+func persistAcmeAccountUpdates(
+	ctx context.Context,
+	cert *model.TLSCertificate,
+	acmeAccount *model.AcmeAccount,
+	newAccountURL, newPrivateKeyPEM, acmePrivateKey string,
+) error {
+	accountChanged := (newPrivateKeyPEM != "" && acmePrivateKey != newPrivateKeyPEM) ||
+		(newAccountURL != "" && acmeAccount.URL != newAccountURL)
+	if !accountChanged {
+		return nil
+	}
+	if newPrivateKeyPEM != "" && acmePrivateKey != newPrivateKeyPEM {
+		sealedKey, sealErr := sealSensitive(newPrivateKeyPEM)
+		if sealErr != nil {
+			return fmt.Errorf("failed to seal ACME account key: %w", sealErr)
+		}
+		acmeAccount.PrivateKey = sealedKey
+	}
+	if newAccountURL != "" {
+		acmeAccount.URL = newAccountURL
+	}
+	if acmeAccount.ID == 0 {
+		if dbErr := model.CreateAcmeAccountRecord(ctx, acmeAccount); dbErr != nil {
+			return fmt.Errorf("failed to create ACME account: %w", dbErr)
+		}
+	} else if dbErr := model.SaveAcmeAccount(ctx, acmeAccount); dbErr != nil {
+		return fmt.Errorf("failed to save ACME account: %w", dbErr)
+	}
+	cert.AcmeAccountID = acmeAccount.ID
+	return model.SaveTLSCertificate(ctx, cert)
+}
+
+func saveObtainedCertificate(ctx context.Context, cert *model.TLSCertificate, result *acme.CertificateResult) error {
+	sealedKey, err := sealSensitive(result.KeyPEM)
+	if err != nil {
+		return fmt.Errorf("failed to seal certificate key: %w", err)
+	}
+	cert.CertPEM = result.CertPEM
+	cert.KeyPEM = sealedKey
+	cert.NotBefore = result.NotBefore
+	cert.NotAfter = result.NotAfter
+	cert.ApplyStatus = tlsApplyStatusReady
+	cert.ApplyMessage = ""
+	return model.SaveTLSCertificate(ctx, cert)
+}