More tests

backend/bdd/features/pki/acme/access-control.feature

@@ -1,6 +1,6 @@
 Feature: Access Control
 
-  Scenario Outline: Access across resources for a different account
+  Scenario Outline: Access across resources across different account
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account0
@@ -60,6 +60,72 @@ Feature: Access Control
       | order   | .authorizations[0].uri                    | auth_uri      | {auth_uri}                                                                          |                 |
       | order   | .authorizations[0].body.challenges[0].url | challenge_uri | {challenge_uri}                                                                     | {}              |
 
+  Scenario Outline: Access resources across a different profile
+    Given I have an ACME cert profile as "acme_profile"
+    When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
+    Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account0
+    Then I memorize acme_account0.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account0_id
+    When I create certificate signing request as csr
+    Then I add names to certificate signing request csr
+      """
+      {
+        "COMMON_NAME": "localhost"
+      }
+      """
+    Then I create a RSA private key pair as cert_key
+    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    # With original owner account under their profile, the invalid payload is going to trigger other errors instead of
+    # 404, this is to make sure that our URLs are actually correct
+    Then the value response.status_code should not be equal to 404
+    And I put away current ACME client as client0
+
+    Given I make a random slug as profile_slug
+    Given I use AUTH_TOKEN for authentication
+    When I send a "POST" request to "/api/v1/pki/certificate-profiles" with JSON payload
+      """
+      {
+        "projectId": "{PROJECT_ID}",
+        "slug": "{profile_slug}",
+        "description": "",
+        "enrollmentType": "acme",
+        "caId": "{CERT_CA_ID}",
+        "certificateTemplateId": "{CERT_TEMPLATE_ID}",
+        "acmeConfig": {}
+      }
+      """
+    Then the value response.status_code should be equal to 200
+    Then I memorize response with jq ".certificateProfile.id" as profile_id
+    When I send a "GET" request to "/api/v1/pki/certificate-profiles/{profile_id}/acme/eab-secret/reveal"
+    Then I memorize response with jq ".eabKid" as eab_kid
+    And I memorize response with jq ".eabSecret" as eab_secret
+    When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{profile_id}/directory
+    Then I register a new ACME account with email maidu@infisical.com and EAB key id "{eab_kid}" with secret "{eab_secret}" as acme_account1
+    Then I peak and memorize the next nonce as nonce
+    Then I memorize <src_var> with jq "<jq>" as <dest_var>
+    When I send a raw ACME request to "<url>"
+      """
+      {
+        "protected": {
+          "alg": "RS256",
+          "nonce": "{nonce}",
+          "url": "<url>",
+          "kid": "{acme_account1.uri}"
+        },
+        "raw_payload": "<payload>"
+      }
+      """
+    Then the value response.status_code should be equal to 404
+
+    Examples: Endpoints
+      | src_var | jq                                        | dest_var      | url                                                                                 | payload         |
+      | order   | .                                         | not_used      | {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/{account0_id}/orders |                 |
+      | order   | .                                         | not_used      | {order.uri}                                                                         |                 |
+      | order   | .                                         | not_used      | {order.uri}/finalize                                                                | {\"csr\": \"\"} |
+      | order   | .                                         | not_used      | {order.uri}/certificate                                                             |                 |
+      | order   | .authorizations[0].uri                    | auth_uri      | {auth_uri}                                                                          |                 |
+      | order   | .authorizations[0].body.challenges[0].url | challenge_uri | {challenge_uri}                                                                     | {}              |
+
   Scenario Outline: URL mismatch
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory

backend/bdd/features/pki/acme/account.feature

@@ -4,28 +4,28 @@ Feature: Account
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-    Then the value acme_account.uri with jq "." should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/(.+)
+    And the value acme_account.uri with jq "." should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/(.+)
 
   Scenario: Find an existing account
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-    Then I memorize acme_account.uri as account_uri
+    And I memorize acme_account.uri as account_uri
-    Then I find the existing ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
+    And I find the existing ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-    Then the value acme_account.uri should be equal to "{account_uri}"
+    And the value acme_account.uri should be equal to "{account_uri}"
 
   Scenario: Create a new account without EAB
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com without EAB
-    Then the value error with jq ".type" should be equal to "urn:ietf:params:acme:error:externalAccountRequired"
+    And the value error with jq ".type" should be equal to "urn:ietf:params:acme:error:externalAccountRequired"
 
   Scenario Outline: Scenario: Create a new account with bad EAB credentials
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "<eab_kid>" with secret "<eab_secret>" as acme_account
-    Then the value error with jq ".type" should be equal to "<error_type>"
+    And the value error with jq ".type" should be equal to "<error_type>"
-    Then the value error with jq ".detail" should be equal to "<error_msg>"
+    And the value error with jq ".detail" should be equal to "<error_msg>"
 
     Examples: Bad Credentials
       | eab_kid                              | eab_secret                   | error_type                                         | error_msg                                      |
@@ -39,10 +39,10 @@ Feature: Account
   Scenario Outline: Scenario: Create a new account with bad EAB url
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
-    When I use a different new-account URL "<url>" for EAB signature
+    And I use a different new-account URL "<url>" for EAB signature
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-    Then the value error with jq ".type" should be equal to "urn:ietf:params:acme:error:externalAccountRequired"
+    And the value error with jq ".type" should be equal to "urn:ietf:params:acme:error:externalAccountRequired"
-    Then the value error with jq ".detail" should be equal to "External account binding URL mismatch"
+    And the value error with jq ".detail" should be equal to "External account binding URL mismatch"
 
     Examples: Bad URLs
       | url                                                                            |

backend/bdd/features/pki/acme/auth.feature

@@ -12,11 +12,11 @@ Feature: Authorization
       }
       """
     Then I create a RSA private key pair as cert_key
-    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
-    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
-    Then the value order.authorizations[0].uri with jq "." should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/authorizations/(.+)
+    And the value order.authorizations[0].uri with jq "." should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/authorizations/(.+)
-    Then the value order.authorizations[0].body with jq ".status" should be equal to "pending"
+    And the value order.authorizations[0].body with jq ".status" should be equal to "pending"
-    Then the value order.authorizations[0].body with jq ".challenges | map(pick(.type, .status)) | sort_by(.type)" should be equal to json
+    And the value order.authorizations[0].body with jq ".challenges | map(pick(.type, .status)) | sort_by(.type)" should be equal to json
       """
         [
           {
@@ -25,8 +25,8 @@ Feature: Authorization
           }
         ]
       """
-    Then the value order.authorizations[0].body with jq ".challenges | map(.status) | sort" should be equal to ["pending"]
+    And the value order.authorizations[0].body with jq ".challenges | map(.status) | sort" should be equal to ["pending"]
-    Then the value order.authorizations[0].body with jq ".identifier" should be equal to json
+    And the value order.authorizations[0].body with jq ".identifier" should be equal to json
       """
       {
         "type": "dns",

backend/bdd/features/pki/acme/cert-profile.feature

@@ -2,7 +2,7 @@ Feature: ACME Cert Profile
 
   Scenario: Create a cert profile
     Given I make a random slug as profile_slug
-    Given I use AUTH_TOKEN for authentication
+    And I use AUTH_TOKEN for authentication
     When I send a "POST" request to "/api/v1/pki/certificate-profiles" with JSON payload
       """
       {
@@ -16,15 +16,15 @@ Feature: ACME Cert Profile
       }
       """
     Then the value response.status_code should be equal to 200
-    Then the value response with jq ".certificateProfile.id" should be present
+    And the value response with jq ".certificateProfile.id" should be present
-    Then the value response with jq ".certificateProfile.slug" should be equal to "{profile_slug}"
+    And the value response with jq ".certificateProfile.slug" should be equal to "{profile_slug}"
-    Then the value response with jq ".certificateProfile.caId" should be equal to "{CERT_CA_ID}"
+    And the value response with jq ".certificateProfile.caId" should be equal to "{CERT_CA_ID}"
-    Then the value response with jq ".certificateProfile.certificateTemplateId" should be equal to "{CERT_TEMPLATE_ID}"
+    And the value response with jq ".certificateProfile.certificateTemplateId" should be equal to "{CERT_TEMPLATE_ID}"
-    Then the value response with jq ".certificateProfile.enrollmentType" should be equal to "acme"
+    And the value response with jq ".certificateProfile.enrollmentType" should be equal to "acme"
 
   Scenario: Reveal EAB secret
     Given I make a random slug as profile_slug
-    Given I use AUTH_TOKEN for authentication
+    And I use AUTH_TOKEN for authentication
     When I send a "POST" request to "/api/v1/pki/certificate-profiles" with JSON payload
       """
       {
@@ -41,8 +41,8 @@ Feature: ACME Cert Profile
     And I memorize response with jq ".certificateProfile.id" as profile_id
     When I send a "GET" request to "/api/v1/pki/certificate-profiles/{profile_id}/acme/eab-secret/reveal"
     Then the value response.status_code should be equal to 200
-    Then the value response with jq ".eabKid" should be equal to "{profile_id}"
+    And the value response with jq ".eabKid" should be equal to "{profile_id}"
-    Then the value response with jq ".eabSecret" should be present
+    And the value response with jq ".eabSecret" should be present
     And I memorize response with jq ".eabKid" as eab_kid
     And I memorize response with jq ".eabSecret" as eab_secret
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{profile_id}/directory

backend/bdd/features/pki/acme/challenge.feature

@@ -11,11 +11,11 @@ Feature: Challenge
         "COMMON_NAME": "localhost"
       }
       """
-    Then I create a RSA private key pair as cert_key
+    And I create a RSA private key pair as cert_key
-    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
-    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
-    Then I select challenge with type http-01 for domain localhost from order at order as challenge
+    And I select challenge with type http-01 for domain localhost from order at order as challenge
-    Then I serve challenge response for challenge at localhost
+    And I serve challenge response for challenge at localhost
-    Then I tell ACME server that challenge is ready to be verified
+    And I tell ACME server that challenge is ready to be verified
-    Then I poll and finalize the ACME order order as finalized_order
+    And I poll and finalize the ACME order order as finalized_order
-    Then the value finalized_order.body with jq ".status" should be equal to "valid"
+    And the value finalized_order.body with jq ".status" should be equal to "valid"

backend/bdd/features/pki/acme/dicrectory.feature

@@ -4,7 +4,7 @@ Feature: Directory
     Given I have an ACME cert profile as "acme_profile"
     When I send a "GET" request to "/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
     Then the response status code should be "200"
-    Then the response body should match JSON value
+    And the response body should match JSON value
       """
       {
         "newNonce": "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/new-nonce",

backend/bdd/features/pki/acme/nonce.feature

@@ -4,13 +4,13 @@ Feature: Nonce
     Given I have an ACME cert profile as "acme_profile"
     When I send a "HEAD" request to "/api/v1/pki/acme/profiles/{acme_profile.id}/new-nonce"
     Then the response status code should be "200"
-    Then the response header "Replay-Nonce" should contains non-empty value
+    And the response header "Replay-Nonce" should contains non-empty value
 
   Scenario Outline: Send a bad nonce to account endpoints
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-    Then I memorize acme_account.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account_id
+    And I memorize acme_account.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account_id
     When I create certificate signing request as csr
     Then I add names to certificate signing request csr
       """
@@ -19,9 +19,9 @@ Feature: Nonce
       }
       """
     Then I create a RSA private key pair as cert_key
-    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
-    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
-    Then I memorize <src_var> with jq "<jq>" as <dest_var>
+    And I memorize <src_var> with jq "<jq>" as <dest_var>
     When I send a raw ACME request to "<url>"
       """
       {
@@ -35,9 +35,9 @@ Feature: Nonce
       }
       """
     Then the value response.status_code should be equal to 400
-    Then the value response with jq ".status" should be equal to 400
+    And the value response with jq ".status" should be equal to 400
-    Then the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:badNonce"
+    And the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:badNonce"
-    Then the value response with jq ".detail" should be equal to "Invalid nonce"
+    And the value response with jq ".detail" should be equal to "Invalid nonce"
 
     Examples: Endpoints
       | src_var | jq                                        | dest_var      | url                                                                                |
@@ -53,7 +53,7 @@ Feature: Nonce
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-    Then I memorize acme_account.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account_id
+    And I memorize acme_account.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account_id
     When I create certificate signing request as csr
     Then I add names to certificate signing request csr
       """
@@ -62,9 +62,9 @@ Feature: Nonce
       }
       """
     Then I create a RSA private key pair as cert_key
-    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
-    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
-    Then I peak and memorize the next nonce as nonce_value
+    And I peak and memorize the next nonce as nonce_value
     When I send a raw ACME request to "/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/{account_id}/orders"
       """
       {
@@ -78,7 +78,7 @@ Feature: Nonce
       }
       """
     Then the value response.status_code should be equal to 200
-    Then I memorize <src_var> with jq "<jq>" as <dest_var>
+    And I memorize <src_var> with jq "<jq>" as <dest_var>
     When I send a raw ACME request to "<url>"
       """
       {
@@ -92,9 +92,9 @@ Feature: Nonce
       }
       """
     Then the value response.status_code should be equal to 400
-    Then the value response with jq ".status" should be equal to 400
+    And the value response with jq ".status" should be equal to 400
-    Then the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:badNonce"
+    And the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:badNonce"
-    Then the value response with jq ".detail" should be equal to "Invalid nonce"
+    And the value response with jq ".detail" should be equal to "Invalid nonce"
 
     Examples: Endpoints
       | src_var | jq                                        | dest_var      | url                                                                                |

backend/bdd/features/pki/acme/order.feature

@@ -12,13 +12,13 @@ Feature: Order
       }
       """
     Then I create a RSA private key pair as cert_key
-    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
-    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
-    Then the value order.uri with jq "." should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/orders/(.+)
+    And the value order.uri with jq "." should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/orders/(.+)
-    Then the value order.body with jq ".status" should be equal to "pending"
+    And the value order.body with jq ".status" should be equal to "pending"
-    Then the value order.body with jq ".identifiers" should be equal to [{"type": "dns", "value": "localhost"}]
+    And the value order.body with jq ".identifiers" should be equal to [{"type": "dns", "value": "localhost"}]
-    Then the value order.body with jq ".finalize" should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/orders/(.+)/finalize
+    And the value order.body with jq ".finalize" should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/orders/(.+)/finalize
-    Then the value order.body with jq "all(.authorizations[]; startswith("{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/authorizations/"))" should be equal to true
+    And the value order.body with jq "all(.authorizations[]; startswith("{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/authorizations/"))" should be equal to true
 
   Scenario: Create a new order with SANs
     Given I have an ACME cert profile as "acme_profile"
@@ -31,17 +31,17 @@ Feature: Order
         "COMMON_NAME": "localhost"
       }
       """
-    Then I add subject alternative name to certificate signing request csr
+    And I add subject alternative name to certificate signing request csr
       """
       [
         "example.com",
         "infisical.com"
       ]
       """
-    Then I create a RSA private key pair as cert_key
+    And I create a RSA private key pair as cert_key
-    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
-    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
-    Then the value order.body with jq ".identifiers | sort_by(.value)" should be equal to json
+    And the value order.body with jq ".identifiers | sort_by(.value)" should be equal to json
       """
       [
         {"type": "dns", "value": "example.com"},
@@ -62,19 +62,19 @@ Feature: Order
       }
       """
     Then I create a RSA private key pair as cert_key
-    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
-    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
-    Then I send an ACME post-as-get to order.uri as fetched_order
+    And I send an ACME post-as-get to order.uri as fetched_order
-    Then the value fetched_order with jq ".status" should be equal to "pending"
+    And the value fetched_order with jq ".status" should be equal to "pending"
-    Then the value fetched_order with jq ".identifiers" should be equal to [{"type": "dns", "value": "localhost"}]
+    And the value fetched_order with jq ".identifiers" should be equal to [{"type": "dns", "value": "localhost"}]
-    Then the value fetched_order with jq ".finalize" should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/orders/(.+)/finalize
+    And the value fetched_order with jq ".finalize" should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/orders/(.+)/finalize
-    Then the value fetched_order with jq "all(.authorizations[]; startswith("{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/authorizations/"))" should be equal to true
+    And the value fetched_order with jq "all(.authorizations[]; startswith("{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/authorizations/"))" should be equal to true
 
   Scenario Outline: Create an order with invalid identifier types
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-    Then I peak and memorize the next nonce as nonce
+    And I peak and memorize the next nonce as nonce
     When I send a raw ACME request to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/new-order"
     """
     {
@@ -92,22 +92,22 @@ Feature: Order
     }
     """
 
+    Then the value response.status_code should be equal to 400
+    And the value response with jq ".status" should be equal to 400
+    And the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:unsupportedIdentifier"
+    And the value response with jq ".detail" should be equal to "Only DNS identifiers are supported"
+
     Examples: Bad Identifier Types
       | identifier_type |
       | bad             |
       | ip              |
       | email           |
 
-    Then the value response.status_code should be equal to 400
-    Then the value response with jq ".status" should be equal to 400
-    Then the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:unsupportedIdentifier"
-    Then the value response with jq ".detail" should be equal to "Only DNS identifiers are supported"
-
   Scenario Outline: Create an order with invalid identifier values
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-    Then I peak and memorize the next nonce as nonce
+    And I peak and memorize the next nonce as nonce
     When I send a raw ACME request to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/new-order"
       """
       {
@@ -125,6 +125,11 @@ Feature: Order
       }
       """
 
+    Then the value response.status_code should be equal to 400
+    And the value response with jq ".status" should be equal to 400
+    And the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:unsupportedIdentifier"
+    And the value response with jq ".detail" should be equal to "Invalid DNS identifier"
+   
     Examples: Bad Identifier Vluaes
       | identifier_value |
       | 127.0.0.1        |
@@ -135,7 +140,3 @@ Feature: Order
       | !                |
       | https://evil.com |
 
-    Then the value response.status_code should be equal to 400
-    Then the value response with jq ".status" should be equal to 400
-    Then the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:unsupportedIdentifier"
-    Then the value response with jq ".detail" should be equal to "Invalid DNS identifier"