code: func (ssa *SQLStorageAuthority) GetValidOrderAuthorizations(
  	ctx context.Context,
  	req *sapb.GetValidOrderAuthorizationsRequest) (map[string]*core.Authorization, error) {
  	now := ssa.clk.Now()
  	// Select the full authorization data for all *valid, unexpired*
  	// authorizations that are owned by the correct account ID and associated with
  	// the given order ID
  	var auths []*core.Authorization
  	_, err := ssa.dbMap.WithContext(ctx).Select(
  		&auths,
  		fmt.Sprintf(`SELECT %s FROM %s AS authz
  	LEFT JOIN orderToAuthz
  	ON authz.ID = orderToAuthz.authzID
  	WHERE authz.registrationID = ? AND
  	authz.expires > ? AND
  	authz.status = ? AND
  	orderToAuthz.orderID = ?`, authzFields, authorizationTable),
  		*req.AcctID,
  		now,
  		string(core.StatusValid),
  		*req.Id)
  	if err != nil {
  		return nil, err
  	}
  
  	// Collapse & dedupe the returned authorizations into a mapping from name to
  	// authorization
  	byName := make(map[string]*core.Authorization)
  	for _, auth := range auths {
  		// We only expect to get back DNS identifiers
  		if auth.Identifier.Type != core.IdentifierDNS {
  			return nil, fmt.Errorf("unknown identifier type: %q on authz id %q", auth.Identifier.Type, auth.ID)
  		}
  		existing, present := byName[auth.Identifier.Value]
  		if !present || auth.Expires.After(*existing.Expires) {
  			// Retrieve challenges for the authz
  			auth.Challenges, err = ssa.getChallenges(ssa.dbMap.WithContext(ctx), auth.ID)
  			if err != nil {
  				return nil, err
  			}
  
  			byName[auth.Identifier.Value] = auth
  		}
  	}
  	return byName, nil
  }
docs: // GetValidOrderAuthorizations is used to find the valid, unexpired authorizations
  // associated with a specific order and account ID.