From a1835c0624e969af095d959d207e3b7f5dbf5eab Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Thu, 30 Oct 2025 16:29:26 -0700
Subject: [PATCH] More features

---
 backend/bdd/features/pki/acme/order.feature | 32 +++++++++++++++++++++
 backend/bdd/features/steps/pki_acme.py      |  7 +++++
 2 files changed, 39 insertions(+)

diff --git a/backend/bdd/features/pki/acme/order.feature b/backend/bdd/features/pki/acme/order.feature
index bf16c2b03..6632b39a8 100644
--- a/backend/bdd/features/pki/acme/order.feature
+++ b/backend/bdd/features/pki/acme/order.feature
@@ -22,6 +22,38 @@ Feature: Order
     Then the value order.body with jq .finalize should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/orders/(.+)/finalize
     Then the value order.body with jq all(.authorizations[]; startswith("{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/authorizations/")) should be equal to true
 
+  Scenario: Create a new order with SANs
+    Given I have an ACME cert profile as "acme_profile"
+    When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
+#     # TODO: make it I have an account already instead?
+    Then I register a new ACME account with email fangpen@infisical.com and EAB key id {acme_profile.eab_kid} with secret {acme_profile.eab_secret} as acme_account
+    When I create certificate signing request as csr
+    Then I add names to certificate signing request csr
+      """
+      {
+        "ORGANIZATION_NAME": "Infisical Inc",
+        "COMMON_NAME": "localhost"
+      }
+      """
+    Then I add subject alternative name to certificate signing request csr
+      """
+      [
+        "example.com",
+        "infisical.com"
+      ]
+      """
+    Then I create a RSA private key pair as cert_key
+    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    Then the value order.body with jq .identifiers should be equal to json
+      """
+      [
+        {"type": "dns", "value": "localhost"},
+        {"type": "dns", "value": "example.com"},
+        {"type": "dns", "value": "infisical.com"}
+      ]
+      """
+
   Scenario: Fetch an order
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
diff --git a/backend/bdd/features/steps/pki_acme.py b/backend/bdd/features/steps/pki_acme.py
index 6167faaa9..9e364e247 100644
--- a/backend/bdd/features/steps/pki_acme.py
+++ b/backend/bdd/features/steps/pki_acme.py
@@ -232,6 +232,13 @@ def step_impl(context: Context, var_path: str, jq_query: str, regex: str):
     )
 
 
+@then("the value {var_path} should be equal to json")
+def step_impl(context: Context, var_path: str):
+    value = eval_var(context, var_path)
+    expected_value = json.loads(context.text)
+    assert value == expected_value, f"{value!r} does not match {expected_value!r}"
+
+
 @then("the value {var_path} should be equal to {expected}")
 def step_impl(context: Context, var_path: str, expected: str):
     value = eval_var(context, var_path)