1import * as ACME from "@/ACME";
2import * as Cloudflare from "@/Cloudflare";
3import * as Test from "@/Test/Alchemy";
4import { expect } from "alchemy-test";
5import * as Effect from "effect/Effect";
6import * as Layer from "effect/Layer";
7import * as Schedule from "effect/Schedule";
8import * as HttpClient from "effect/http/HttpClient";
9import Stack from "./fixtures/issue-zerossl-stack.ts";
10import { ZONE_NAME } from "./fixtures/shared.ts";
11
12/**
13 * Runtime issuance from inside a deployed Worker: the account bound by
14 * `ACME.IssueCertificate`, DNS-01 through `Cloudflare.DNS.WriteDns`.
15 *
16 * The CA is ZeroSSL (production). Let's Encrypt staging returned TLS errors
17 * from Workers during bring-up, so this runs only with
18 * `ACME_TEST_ZEROSSL=1` and `ZERO_SSL_KEY`; `IssueCertificate.local.test.ts`
19 * covers the same Worker against staging from local workerd.
20 */
21const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
22 providers: Layer.mergeAll(Cloudflare.providers(), ACME.providers()),
23});
24
25const enabled =
26 process.env.ACME_TEST_ZEROSSL === "1" &&
27 (process.env.ZERO_SSL_KEY !== undefined ||
28 process.env.ZEROSSL_ACCESS_KEY !== undefined);
29
30// No `beforeAll.skipIf`: deploy only when enabled, else hand the (skipped)
31// test an empty handle.
32const stack = beforeAll(
33 enabled ? deploy(Stack) : Effect.succeed({ url: "" } as { url: string }),
34);
35afterAll.skipIf(!enabled || !!process.env.NO_DESTROY)(destroy(Stack));
36
37const NAME = `alchemy-acme-worker.${ZONE_NAME}`;
38
39test.skipIf(!enabled)(
40 "a Worker issues a certificate at runtime through the bound account",
41 Effect.gen(function* () {
42 const { url } = yield* stack;
43 const client = yield* HttpClient.HttpClient;
44
45 // The first requests ride out workers.dev propagation.
46 // A fresh workers.dev hostname answers 404 for a few seconds.
47 const ok = yield* client.get(`${url}/`).pipe(
48 Effect.filterOrFail(
49 (r) => r.status === 200,
50 (r) => new Error(`not ready: ${r.status}`),
51 ),
52 Effect.retry({ schedule: Schedule.spaced("2 seconds"), times: 8 }),
53 );
54 expect(ok.status).toBe(200);
55
56 const response = yield* client.get(`${url}/issue?name=${NAME}`);
57 const text = yield* response.text;
58 expect(text, `status ${response.status}: ${text.slice(0, 2000)}`).toMatch(
59 /^\{/,
60 );
61 const body = JSON.parse(text) as {
62 issuer?: string;
63 notAfter?: string;
64 dnsNames?: string[];
65 hasKey?: boolean;
66 chainLength?: number;
67 error?: string;
68 };
69 expect(body.error).toBeUndefined();
70 expect(response.status).toBe(200);
71 expect(body.issuer).toContain("ZeroSSL");
72 expect(body.dnsNames).toEqual([NAME]);
73 expect(body.hasKey).toBe(true);
74 expect(body.chainLength).toBeGreaterThan(1);
75 const now = yield* Effect.sync(() => Date.now());
76 expect(Date.parse(body.notAfter!)).toBeGreaterThan(now);
77 }),
78 {
79 tags: [
80 "provider:acme",
81 "provider:acme:account",
82 "provider:cloudflare",
83 "provider:cloudflare:dns",
84 "provider:cloudflare:worker",
85 "provider:cloudflare:zone",
86 "provider:zerossl",
87 "live",
88 ],
89 timeout: 240_000,
90 },
91);