Add tests for external CA template check with dns names

backend/bdd/features/pki/acme/external-ca.feature

@@ -369,3 +369,177 @@ Feature: External CA
       | subject                      |
       | {"COMMON_NAME": "localhost"} |
       | {}                           |
+
+  Scenario Outline: Issue a certificate with bad CSR disallowed by the template
+    Given I create a Cloudflare connection as cloudflare
+    Then I memorize cloudflare with jq ".appConnection.id" as app_conn_id
+    Given I create a external ACME CA with the following config as ext_ca
+      """
+      {
+        "dnsProviderConfig": {
+            "provider": "cloudflare",
+            "hostedZoneId": "MOCK_ZONE_ID"
+        },
+        "directoryUrl": "{PEBBLE_URL}",
+        "accountEmail": "fangpen@infisical.com",
+        "dnsAppConnectionId": "{app_conn_id}",
+        "eabKid": "",
+        "eabHmacKey": ""
+      }
+      """
+    Then I memorize ext_ca with jq ".id" as ext_ca_id
+    Given I create a certificate template with the following config as cert_template
+      """
+      {
+        "subject": [
+          {
+            "type": "common_name",
+            "allowed": [
+              "example.com"
+            ]
+          }
+        ],
+        "sans": [
+          {
+            "type": "dns_name",
+            "allowed": [
+              "infisical.com"
+            ]
+          }
+        ],
+        "keyUsages": {
+          "required": [],
+          "allowed": [
+            "digital_signature",
+            "key_encipherment",
+            "non_repudiation",
+            "data_encipherment",
+            "key_agreement",
+            "key_cert_sign",
+            "crl_sign",
+            "encipher_only",
+            "decipher_only"
+          ]
+        },
+        "extendedKeyUsages": {
+          "required": [],
+          "allowed": [
+            "client_auth",
+            "server_auth",
+            "code_signing",
+            "email_protection",
+            "ocsp_signing",
+            "time_stamping"
+          ]
+        },
+        "algorithms": {
+          "signature": [
+            "SHA256-RSA",
+            "SHA512-RSA",
+            "SHA384-ECDSA",
+            "SHA384-RSA",
+            "SHA256-ECDSA",
+            "SHA512-ECDSA"
+          ],
+          "keyAlgorithm": [
+            "RSA-2048",
+            "RSA-4096",
+            "ECDSA-P384",
+            "RSA-3072",
+            "ECDSA-P256",
+            "ECDSA-P521"
+          ]
+        },
+        "validity": {
+          "max": "365d"
+        }
+      }
+      """
+    Then I memorize cert_template with jq ".certificateTemplate.id" as cert_template_id
+    Given I create an ACME profile with ca {ext_ca_id} and template {cert_template_id} as "acme_profile"
+    When I have an ACME client connecting to "{BASE_URL}/api/v1/cert-manager/acme/profiles/{acme_profile.id}/directory"
+    Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
+    When I create certificate signing request as csr
+    Then I add names to certificate signing request csr
+      """
+      <subject>
+      """
+    Then I add subject alternative name to certificate signing request csr
+      """
+      <san>
+      """
+    And I create a RSA private key pair as cert_key
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I pass all challenges with type http-01 for order in order
+    Given I intercept outgoing requests
+      """
+      [
+        {
+          "scope": "https://api.cloudflare.com:443",
+          "method": "POST",
+          "path": "/client/v4/zones/MOCK_ZONE_ID/dns_records",
+          "status": 200,
+          "response": {
+              "result": {
+                  "id": "A2A6347F-88B5-442D-9798-95E408BC7701",
+                  "name": "Mock Account",
+                  "type": "standard",
+                  "settings": {
+                      "enforce_twofactor": false,
+                      "api_access_enabled": null,
+                      "access_approval_expiry": null,
+                      "abuse_contact_email": null,
+                      "user_groups_ui_beta": false
+                  },
+                  "legacy_flags": {
+                      "enterprise_zone_quota": {
+                          "maximum": 0,
+                          "current": 0,
+                          "available": 0
+                      }
+                  },
+                  "created_on": "2013-04-18T00:41:02.215243Z"
+              },
+              "success": true,
+              "errors": [],
+              "messages": []
+          },
+          "responseIsBinary": false
+        },
+        {
+          "scope": "https://api.cloudflare.com:443",
+          "method": "GET",
+          "path": {
+            "regex": "/client/v4/zones/[^/]+/dns_records\\?"
+          },
+          "status": 200,
+          "response": {
+            "result": [],
+            "success": true,
+            "errors": [],
+            "messages": [],
+            "result_info": {
+              "page": 1,
+              "per_page": 100,
+              "count": 0,
+              "total_count": 0,
+              "total_pages": 1
+            }
+          },
+          "responseIsBinary": false
+        }
+      ]
+      """
+    Then I poll and finalize the ACME order order as finalized_order
+    And the value error.typ should be equal to "urn:ietf:params:acme:error:badCSR"
+    And the value error.detail should be equal to "<err_detail>"
+
+    Examples:
+      | subject                        | san                            | err_detail                                                                |
+      | {"COMMON_NAME": "localhost"}   | []                             | Invalid CSR: common_name value 'localhost' is not in allowed values list  |
+      | {"COMMON_NAME": "localhost"}   | ["infisical.com"]              | Invalid CSR: common_name value 'localhost' is not in allowed values list  |
+      | {}                             | ["localhost"]                  | Invalid CSR: dns_name SAN value 'localhost' is not in allowed values list |
+      | {}                             | ["infisical.com", "localhost"] | Invalid CSR: dns_name SAN value 'localhost' is not in allowed values list |
+      | {"COMMON_NAME": "example.com"} | ["infisical.com", "localhost"] | Invalid CSR: dns_name SAN value 'localhost' is not in allowed values list |
+

backend/bdd/features/steps/pki_acme.py

@@ -993,8 +993,12 @@ def step_impl(context: Context, uri: str, resp_var: str):
 def step_impl(context: Context, var_path: str, finalized_var: str):
     order = eval_var(context, var_path, as_json=False)
     acme_client = context.acme_client
-    finalized_order = acme_client.poll_and_finalize(order)
+    try:
-    context.vars[finalized_var] = finalized_order
+        finalized_order = acme_client.poll_and_finalize(order)
+        context.vars[finalized_var] = finalized_order
+    except Exception as exp:
+        logger.error(f"Failed to finalize order: {exp}", exc_info=True)
+        context.vars["error"] = exp
 
 
 @then("I parse the full-chain certificate from order {order_var_path} as {cert_var}")