[Account.orders] should be a Uri.t option, not a list

[torinnd]

Re: https://github.com/mmaker/ocaml-letsencrypt/blob/eef905dceda483d6ea2b2c8d7c849887d9522128/src/acme_common.mli#L84

As per https://datatracker.ietf.org/doc/html/rfc8555#section-7.1.2 the Account object has a required field with a single uri where the listed orders are available. Letsencrypt doesn't implement this (see letsencrypt/boulder#3335) so the absence is handled by slamming the empty list in place (https://github.com/mmaker/ocaml-letsencrypt/blob/eef905dceda483d6ea2b2c8d7c849887d9522128/src/acme_common.ml#L307-L309). Other implementations (I've only tested https://smallstep.com/docs/step-ca/) may provide this field correctly as per the RFC, but the type mismatch will raise an error like
"couldn't find string list orders in <json_blob_containing_orders_field>" rather than proceeding.

I think the happy middle ground between RFC compliance and real-world functionality is to keep it optional, but correctly expect a [Uri.t] in the orders field. I'm not optimistic that I can offer a patch in the near future (my working copy uses [Async] instead of [Lwt], and I didn't take time to cleanly port the code), so I invite others to action this before I get to it.

[hannesm]

thanks for your report, I opened #28 that includes a fix as you suggested. could you look over the commit (f9bccd6) and let me know whether that is as you suggested?

[torinnd]

+1

That looks perfect!