awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-06 15:27:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add test to reproduce the problem

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-11-20 09:38:04 -08:00
parent b251cf4802
commit d190fb15c9
2 changed files with 48 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/bdd/features/pki/acme/account.feature
+21 -2
View File
@@ -11,8 +11,27 @@ Feature: Account
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
And I memorize acme_account.uri as account_uri
And I find the existing ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
And the value acme_account.uri should be equal to "{account_uri}"
And I find the existing ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as retrieved_account
And the value retrieved_account.uri should be equal to "{account_uri}"
# Note: This is a very special case for cert-manager.
# There's a bug in their ACME client implementation, they don't take the account KID value they have
# and relying on a '{"onlyReturnExisting": true}' new-account request to find out their KID value.
# But the problem is, that new-account request doesn't come with EAB. And while the get existing account operation
# fails, they just discard the error and proceed to request a new order. Since no KID provided, their ACME
# client will send JWK instead. As a result, we are seeing KID not provide in header error for the new-order
# endpoint.
#
# To solve the problem, we lose the check for EAB a bit for the onlyReturnExisting new account request
# ref: https://github.com/cert-manager/cert-manager/issues/7388#issuecomment-3535630925
Scenario: Create a new account with EAB then retrieve it without EAB
Given I have an ACME cert profile as "acme_profile"
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
And I memorize acme_account.uri as account_uri
And I find the existing ACME account without EAB as retrieved_account
And the value error with should be absent
And the value retrieved_account.uri should be equal to "{account_uri}"
Scenario: Create a new account without EAB
Given I have an ACME cert profile as "acme_profile"