More test cases

backend/bdd/features/pki/acme/account.feature

@@ -24,6 +24,21 @@ Feature: Account
       | bad                                  | Cg==                         | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature |
       | {acme_profile.eab_kid}               | Cg==                         | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature |
       | {acme_profile.eab_kid}               | YmFkLXNjcmV0Cg==             | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature |
+      | {acme_profile.eab_kid}               | ABC{acme_profile.eab_secret} | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature |
       | bad                                  | {acme_profile.eab_secret}    | urn:ietf:params:acme:error:externalAccountRequired | External account binding KID mismatch          |
       | 4bc7959c-fe2d-4447-ae91-0cd893667af6 | {acme_profile.eab_secret}    | urn:ietf:params:acme:error:externalAccountRequired | External account binding KID mismatch          |
-      | {acme_profile.eab_kid}               | ABC{acme_profile.eab_secret} | urn:ietf:params:acme:error:externalAccountRequired | Invalid external account binding JWS signature |
+
+  Scenario Outline: Scenario: Create a new account with bad EAB url
+    Given I have an ACME cert profile as "acme_profile"
+    When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
+    When I use a different new-account URL "<url>" for EAB signature
+    Then I register a new ACME account with email fangpen@infisical.com and EAB key id "<eab_kid>" with secret "<eab_secret>" as acme_account
+    Then the value error with jq ".type" should be equal to "urn:ietf:params:acme:error:externalAccountRequired"
+    Then the value error with jq ".detail" should be equal to "External account binding URL mismatch"
+
+    Examples: Bad URLs
+      | url                                                                            |
+      | {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/new-account-bad          |
+      | {BASE_URL}/acme/new-account                                                    |
+      | https://example.com/api/v1/pki/acme/profiles/{acme_profile.id}/new-account-bad |
+      | bad                                                                            |

backend/bdd/features/steps/pki_acme.py

@@ -232,17 +232,28 @@ def step_impl(context: Context):
     assert payload == replaced, f"{payload} != {replaced}"
 
 
+@when('I use a different new-account URL "{url}" for EAB signature')
+def step_impl(context: Context, url: str):
+    context.alt_eab_url = replace_vars(url, context.vars)
+
+
 @then(
     'I register a new ACME account with email {email} and EAB key id "{kid}" with secret "{secret}" as {account_var}'
 )
 def step_impl(context: Context, email: str, kid: str, secret: str, account_var: str):
     acme_client = context.acme_client
     account_public_key = acme_client.net.key.public_key()
+    if hasattr(context, "alt_eab_url"):
+        eab_directory = messages.Directory.from_json(
+            {"newAccount": context.alt_eab_url}
+        )
+    else:
+        eab_directory = acme_client.directory
     eab = messages.ExternalAccountBinding.from_data(
         account_public_key=account_public_key,
         kid=replace_vars(kid, context.vars),
         hmac_key=replace_vars(secret, context.vars),
-        directory=acme_client.directory,
+        directory=eab_directory,
         hmac_alg="HS256",
     )
     registration = messages.NewRegistration.from_data(