Struct Authorization 

pub struct Authorization {
    pub id: String,
    pub order_id: String,
    pub identifier: Identifier,
    pub status: AuthzStatus,
    pub expires: i64,
    pub created_at: i64,
}

An ACME authorization (RFC 8555 §7.1.4). One authorization is created per order identifier when the order is created, starting in the pending state and carrying the challenges the client can satisfy to prove control of the identifier.

Storage Details

• identifier is persisted as a JSON {type, value} object.
• Timestamps are epoch seconds (matching orders/accounts/nonces) and rendered as RFC3339 strings in Authorization::to_json.
• The authorization URL is derived from the id + base URL (like the order’s finalize/certificate URLs), never stored.

Wildcards

A wildcard authorization stores its identifier in the wildcard form (*.example.com), while the ACME object shows the base name plus a separate "wildcard": true member (RFC 8555 §7.1.4). Storing the base name instead would collide: the canonical wildcard order ["example.com", "*.example.com"] creates two authorizations, and UNIQUE(order_id, identifier) compares the serialized JSON — both rows would be identical and the order would fail to persist. Deriving with Authorization::base_identifier costs a strip_prefix and no migration.

Fields

id: String

order_id: String

identifier: Identifier

status: AuthzStatus

expires: i64

created_at: i64

Implementations

impl Authorization

pub async fn create( order_id: &str, identifier: Identifier, expires: i64, database: &Database, ) -> Result<Authorization, Error>

Creates a new authorization for identifier in the pending state.

pub async fn find_by_id( id: &str, database: &Database, ) -> Result<Option<Authorization>, Error>

pub async fn find_by_order( order_id: &str, database: &Database, ) -> Result<Vec<Authorization>, Error>

Lists an order’s authorizations, oldest first (creation order), for the order object’s authorizations array and the all-valid readiness check.

pub async fn count_by_order( order_id: &str, database: &Database, ) -> Result<i64, Error>

How many authorizations an order has. crate::sqlite::order::Order::count_by_account’s counterpart, and for the same reason.

pub async fn find_ids_by_orders( order_ids: &[&str], database: &Database, ) -> Result<HashMap<String, Vec<String>>, Error>

The authorization ids of several orders at once, keyed by order id.

The listing paths need nothing but the ids — Order::to_json builds its authorizations URLs from them — and were calling Authorization::find_by_order once per row: 51 queries for a default page of 50. One IN (…) instead.

An order with no authorizations is simply absent from the map, which is what a caller wants: map.remove(id).unwrap_or_default().

pub async fn mark_valid(&mut self, database: &Database) -> Result<(), Error>

Moves the authorization to the valid state and keeps self in sync (the same persist-and-sync pattern as crate::sqlite::order::Order::finalize).

pub async fn mark_invalid(&mut self, database: &Database) -> Result<(), Error>

Moves the authorization to the terminal invalid state, after one of its challenges failed validation (RFC 8555 §7.1.6).

No error is stored: the RFC puts the problem document on the challenge, and the authorization object has no error member — a client reads the reason from the challenge it triggered.

pub fn is_wildcard(&self) -> bool

Whether this authorization covers the wildcard of its identifier.

Derived from the stored value rather than stored separately — see the type’s doc comment for why the row keeps the *. prefix.

pub fn base_identifier(&self) -> &str

The name to actually prove control of: the identifier with any *. stripped.

A wildcard is proved by controlling the zone, so the DNS record lives at _acme-challenge.example.com, not at _acme-challenge.*.example.com.

pub fn to_json(&self, base_url: &str, challenges: &[Challenge]) -> Value

The RFC 8555 authorization object: identifier, status, expires (RFC3339), the challenges array (each rendered by Challenge::to_json), and wildcard when the authorization covers one.

Trait Implementations

impl Debug for Authorization

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.