Return updated account object on DeactivateRegistration path (#8060)

Update the SA to re-query the database for the updated account after
deactivating it, and return this to the RA. Update the RA to pass this
value through to the WFE. Update the WFE to return this value, rather
than locally modifying the pre-deactivation account object, if it gets
one (for deployability).

Also remove the RA's requirement that the request object specify its
current status so that the request can be trimmed down to just an ID.
This proto change is backwards-compatible because the new
DeactivateRegistrationRequest's registrationID field has the same type
(int64) and field number (1) as corepb.Registration's id field.

Part of #5554

Author: aarongable

ra/proto/ra.pb.go

@@ -11,8 +11,8 @@ service RegistrationAuthority {
   rpc NewRegistration(core.Registration) returns (core.Registration) {}
   rpc UpdateRegistrationContact(UpdateRegistrationContactRequest) returns (core.Registration) {}
   rpc UpdateRegistrationKey(UpdateRegistrationKeyRequest) returns (core.Registration) {}
+  rpc DeactivateRegistration(DeactivateRegistrationRequest) returns (core.Registration) {}
   rpc PerformValidation(PerformValidationRequest) returns (core.Authorization) {}
-  rpc DeactivateRegistration(core.Registration) returns (google.protobuf.Empty) {}
   rpc DeactivateAuthorization(core.Authorization) returns (google.protobuf.Empty) {}
   rpc RevokeCertByApplicant(RevokeCertByApplicantRequest) returns (google.protobuf.Empty) {}
   rpc RevokeCertByKey(RevokeCertByKeyRequest) returns (google.protobuf.Empty) {}
@@ -51,6 +51,10 @@ message UpdateRegistrationKeyRequest {
   bytes jwk = 2;
 }
 
+message DeactivateRegistrationRequest {
+  int64 registrationID = 1;
+}
+
 message UpdateAuthorizationRequest {
   core.Authorization authz = 1;
   int64 challengeIndex = 2;

ra/proto/ra.proto

@@ -2171,23 +2171,17 @@ func (ra *RegistrationAuthorityImpl) AdministrativelyRevokeCertificate(ctx conte
 }
 
 // DeactivateRegistration deactivates a valid registration
-func (ra *RegistrationAuthorityImpl) DeactivateRegistration(ctx context.Context, reg *corepb.Registration) (*emptypb.Empty, error) {
-	if reg == nil || reg.Id == 0 {
+func (ra *RegistrationAuthorityImpl) DeactivateRegistration(ctx context.Context, req *rapb.DeactivateRegistrationRequest) (*corepb.Registration, error) {
+	if req == nil || req.RegistrationID == 0 {
 		return nil, errIncompleteGRPCRequest
 	}
-	// TODO(#5554): Remove this check: this is only enforcing that the WFE has
-	// told us the correct status. The SA will enforce that the current status is
-	// valid during its database update.
-	if reg.Status != string(core.StatusValid) {
-		return nil, berrors.MalformedError("only valid registrations can be deactivated")
-	}
-	_, err := ra.SA.DeactivateRegistration(ctx, &sapb.RegistrationID{Id: reg.Id})
+
+	updatedAcct, err := ra.SA.DeactivateRegistration(ctx, &sapb.RegistrationID{Id: req.RegistrationID})
 	if err != nil {
 		return nil, err
 	}
 
-	// TODO(#5554): Return the updated account object.
-	return &emptypb.Empty{}, nil
+	return updatedAcct, nil
 }
 
 // DeactivateAuthorization deactivates a currently valid authorization

ra/proto/ra_grpc.pb.go

@@ -988,18 +988,13 @@ func TestDeactivateRegistration(t *testing.T) {
 	defer cleanUp()
 
 	// Deactivate failure because incomplete registration provided
-	_, err := ra.DeactivateRegistration(context.Background(), &corepb.Registration{})
+	_, err := ra.DeactivateRegistration(context.Background(), &rapb.DeactivateRegistrationRequest{})
 	test.AssertDeepEquals(t, err, fmt.Errorf("incomplete gRPC request message"))
 
-	// Deactivate failure because registration status already deactivated
-	_, err = ra.DeactivateRegistration(context.Background(),
-		&corepb.Registration{Id: 1, Status: string(core.StatusDeactivated)})
-	test.AssertError(t, err, "DeactivateRegistration failed with a non-valid registration")
-
 	// Deactivate success with valid registration
-	_, err = ra.DeactivateRegistration(context.Background(),
-		&corepb.Registration{Id: 1, Status: string(core.StatusValid)})
+	got, err := ra.DeactivateRegistration(context.Background(), &rapb.DeactivateRegistrationRequest{RegistrationID: 1})
 	test.AssertNotError(t, err, "DeactivateRegistration failed")
+	test.AssertEquals(t, got.Status, string(core.StatusDeactivated))
 
 	// Check db to make sure account is deactivated
 	dbReg, err := ra.SA.GetRegistration(context.Background(), &sapb.RegistrationID{Id: 1})