From 8ee700bd39521a8249c33c38d92032b3c08c07b4 Mon Sep 17 00:00:00 2001 From: Fang-Pen Lin Date: Thu, 6 Nov 2025 19:22:08 -0800 Subject: [PATCH] More test cases --- backend/bdd/features/pki/acme/account.feature | 17 ++++++++++++++++- backend/bdd/features/steps/pki_acme.py | 13 ++++++++++++- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/backend/bdd/features/pki/acme/account.feature b/backend/bdd/features/pki/acme/account.feature index 051c0459e..c10d93d9d 100644 --- a/backend/bdd/features/pki/acme/account.feature +++ b/backend/bdd/features/pki/acme/account.feature @@ -24,6 +24,21 @@ Feature: Account | bad | Cg== | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature | | {acme_profile.eab_kid} | Cg== | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature | | {acme_profile.eab_kid} | YmFkLXNjcmV0Cg== | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature | + | {acme_profile.eab_kid} | ABC{acme_profile.eab_secret} | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature | | bad | {acme_profile.eab_secret} | urn:ietf:params:acme:error:externalAccountRequired | External account binding KID mismatch | | 4bc7959c-fe2d-4447-ae91-0cd893667af6 | {acme_profile.eab_secret} | urn:ietf:params:acme:error:externalAccountRequired | External account binding KID mismatch | - | {acme_profile.eab_kid} | ABC{acme_profile.eab_secret} | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature | + + Scenario Outline: Scenario: Create a new account with bad EAB url + Given I have an ACME cert profile as "acme_profile" + When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory + When I use a different new-account URL "" for EAB signature + Then I register a new ACME account with email fangpen@infisical.com and EAB key id "" with secret "" as acme_account + Then the value error with jq ".type" should be equal to "urn:ietf:params:acme:error:externalAccountRequired" + Then the value error with jq ".detail" should be equal to "External account binding URL mismatch" + + Examples: Bad URLs + | url | + | {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/new-account-bad | + | {BASE_URL}/acme/new-account | + | https://example.com/api/v1/pki/acme/profiles/{acme_profile.id}/new-account-bad | + | bad | diff --git a/backend/bdd/features/steps/pki_acme.py b/backend/bdd/features/steps/pki_acme.py index 0a753a827..c4da1f91a 100644 --- a/backend/bdd/features/steps/pki_acme.py +++ b/backend/bdd/features/steps/pki_acme.py @@ -232,17 +232,28 @@ def step_impl(context: Context): assert payload == replaced, f"{payload} != {replaced}" +@when('I use a different new-account URL "{url}" for EAB signature') +def step_impl(context: Context, url: str): + context.alt_eab_url = replace_vars(url, context.vars) + + @then( 'I register a new ACME account with email {email} and EAB key id "{kid}" with secret "{secret}" as {account_var}' ) def step_impl(context: Context, email: str, kid: str, secret: str, account_var: str): acme_client = context.acme_client account_public_key = acme_client.net.key.public_key() + if hasattr(context, "alt_eab_url"): + eab_directory = messages.Directory.from_json( + {"newAccount": context.alt_eab_url} + ) + else: + eab_directory = acme_client.directory eab = messages.ExternalAccountBinding.from_data( account_public_key=account_public_key, kid=replace_vars(kid, context.vars), hmac_key=replace_vars(secret, context.vars), - directory=acme_client.directory, + directory=eab_directory, hmac_alg="HS256", ) registration = messages.NewRegistration.from_data(