From d7cf08790b2b62f752e3f7d07cb7087dd971b48b Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Tue, 11 Nov 2025 17:17:55 -0800
Subject: [PATCH] More tests

---
 backend/bdd/features/environment.py           |  7 +++++++
 .../bdd/features/pki/acme/challenge.feature   | 21 +++++++++++++++++++
 backend/bdd/features/steps/pki_acme.py        |  8 ++-----
 .../pki-acme/pki-acme-challenge-service.ts    |  1 +
 .../ee/services/pki-acme/pki-acme-errors.ts   |  2 +-
 5 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/backend/bdd/features/environment.py b/backend/bdd/features/environment.py
index 52615036a..631128f8b 100644
--- a/backend/bdd/features/environment.py
+++ b/backend/bdd/features/environment.py
@@ -2,6 +2,8 @@ import json
 import os
 
 import pathlib
+import typing
+
 import httpx
 from behave.runner import Context
 from dotenv import load_dotenv
@@ -198,3 +200,8 @@ def before_all(context: Context):
             "AUTH_TOKEN": AUTH_TOKEN,
         }
     context.http_client = httpx.Client(base_url=BASE_URL)
+
+
+def after_feature(context: Context, feature: typing.Any):
+    if hasattr(context, "web_server"):
+        context.web_server.shutdown_and_server_close()
diff --git a/backend/bdd/features/pki/acme/challenge.feature b/backend/bdd/features/pki/acme/challenge.feature
index c747d5d06..35790cc5f 100644
--- a/backend/bdd/features/pki/acme/challenge.feature
+++ b/backend/bdd/features/pki/acme/challenge.feature
@@ -93,3 +93,24 @@ Feature: Challenge
       """
     Then the value response.status_code should be equal to 200
     And the value response with jq ".status" should be equal to "pending"
+
+    # finalize should not be allowed when all auths are not valid yet
+    And I memorize response.headers with jq ".["replay-nonce"]" as nonce
+    When I send a raw ACME request to "{order.body.finalize}"
+      """
+      {
+        "protected": {
+          "alg": "RS256",
+          "nonce": "{nonce}",
+          "url": "{order.body.finalize}",
+          "kid": "{acme_account.uri}"
+        },
+        "payload": {
+          "csr": "{csr_pem}"
+        }
+      }
+      """
+    Then the value response.status_code should be equal to 400
+    Then the value response with jq ".status" should be equal to 400
+    Then the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:orderNotReady"
+    Then the value response with jq ".detail" should be equal to "ACME order is not ready"
diff --git a/backend/bdd/features/steps/pki_acme.py b/backend/bdd/features/steps/pki_acme.py
index d05472ba2..170ada1de 100644
--- a/backend/bdd/features/steps/pki_acme.py
+++ b/backend/bdd/features/steps/pki_acme.py
@@ -1,7 +1,6 @@
 import json
 import logging
 import re
-import threading
 import urllib.parse
 
 import acme.client
@@ -632,11 +631,8 @@ def serve_challenge(
     )
     # TODO: make port configurable
     servers = standalone.HTTP01DualNetworkedServers(("0.0.0.0", 8087), {resource})
-    # Start client standalone web server.
-    web_server = threading.Thread(name="web_server", target=servers.serve_forever)
-    web_server.daemon = True
-    web_server.start()
-    context.web_server = web_server
+    servers.serve_forever()
+    context.web_server = servers
 
 
 def notify_challenge_ready(context: Context, challenge: messages.ChallengeBody):
diff --git a/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts b/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
index 61bd0c110..8bfe360d4 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
@@ -107,6 +107,7 @@ export const pkiAcmeChallengeServiceFactory = ({
             if (fetchError.code === "ENOTFOUND" || fetchError.message.includes("ENOTFOUND")) {
               return new AcmeDnsFailureError({ message: "Hostname could not be resolved (DNS failure)" });
             }
+            logger.error(exp, "Unknown error validating ACME challenge response");
             return new AcmeServerInternalError({ message: "Unknown error validating ACME challenge response" });
           }
         } else if (exp instanceof DOMException) {
diff --git a/backend/src/ee/services/pki-acme/pki-acme-errors.ts b/backend/src/ee/services/pki-acme/pki-acme-errors.ts
index 837dec8be..9053be391 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-errors.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-errors.ts
@@ -468,7 +468,7 @@ export class AcmeOrderNotReadyError extends AcmeError {
     super({
       type: AcmeErrorType.OrderNotReady,
       message,
-      status: 403,
+      status: 400,
       error
     });
     this.name = "AcmeOrderNotReadyError";