Send nonce twice

backend/bdd/features/pki/acme/nonce.feature

@@ -6,7 +6,7 @@ Feature: Nonce
     Then the response status code should be "200"
     Then the response header "Replay-Nonce" should contains non-empty value
 
-  Scenario: Send bad nonce
+  Scenario: Send a bad nonce
     Given I have an ACME cert profile as "acme_profile"
     When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
     Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
@@ -27,3 +27,39 @@ Feature: Nonce
     Then the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:badNonce"
     Then the value response with jq ".status" should be equal to 400
     Then the value response with jq ".detail" should be equal to "Invalid nonce"
+
+  Scenario: Send the same nonce twice
+    Given I have an ACME cert profile as "acme_profile"
+    When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
+    Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
+    Then I memorize acme_account.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account_id
+    Then I peak and memorize the next nonce as nonce_value
+    When I send a raw ACME request to "/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/{account_id}/orders"
+    """
+    {
+      "protected": {
+        "alg": "RS256",
+        "nonce": "{nonce_value}",
+        "url": "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/{account_id}/orders",
+        "kid": "{acme_account.uri}"
+      },
+      "payload": {}
+    }
+    """
+    Then the value response.status_code should be equal to 200
+    When I send a raw ACME request to "/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/{account_id}/orders"
+    """
+    {
+      "protected": {
+        "alg": "RS256",
+        "nonce": "{nonce_value}",
+        "url": "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/{account_id}/orders",
+        "kid": "{acme_account.uri}"
+      },
+      "payload": {}
+    }
+    """
+    Then the value response.status_code should be equal to 400
+    Then the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:badNonce"
+    Then the value response with jq ".status" should be equal to 400
+    Then the value response with jq ".detail" should be equal to "Invalid nonce"

backend/bdd/features/steps/pki_acme.py

@@ -439,6 +439,12 @@ def step_impl(context: Context, var_path: str, jq_query, var_name: str):
     context.vars[var_name] = value
 
 
+@then("I peak and memorize the next nonce as {var_name}")
+def step_impl(context: Context, var_name: str):
+    acme_client = context.acme_client
+    context.vars[var_name] = json_util.encode_b64jose(list(acme_client.net._nonces)[0])
+
+
 @then("I memorize {var_path} as {var_name}")
 def step_impl(context: Context, var_path: str, var_name: str):
     value = eval_var(context, var_path)