1import * as AWS from "@/AWS";
2import * as Core from "@/Test/Core";
3import * as Test from "@/Test/Alchemy";
4import { describe, expect } from "alchemy-test";
5import * as Data from "effect/Data";
6import * as Effect from "effect/Effect";
7import * as Schedule from "effect/Schedule";
8import * as HttpClient from "effect/http/HttpClient";
9import * as HttpClientRequest from "effect/http/HttpClientRequest";
10import CodeDeployTestFunctionLive, { CodeDeployTestFunction } from "./handler";
11
12const testOptions = { providers: AWS.providers() };
13const { test, beforeAll, afterAll } = Test.make(testOptions);
14const sharedStack = Core.scratchStack(testOptions, "CodeDeployBindings");
15
16// Lambda function URL cold-start (DNS, IAM propagation, init) can take well
17// over 60s on a fresh deploy under parallel-suite load.
18const readinessPolicy = Schedule.max([
19 Schedule.fixed("2 seconds"),
20 Schedule.recurs(75),
21]);
22
23let baseUrl: string;
24
25class TransientUpstream extends Data.TaggedError("TransientUpstream")<{
26 readonly status: number;
27 readonly body: string;
28}> {}
29
30// Retry transient 5xx from the shared Lambda fixture (cold re-init, IAM
31// propagation on the freshly attached codedeploy policy surfaced as a 500
32// by the handler's `Effect.orDie`). Genuine 4xx/assertion failures return
33// immediately.
34const send = (request: HttpClientRequest.HttpClientRequest) =>
35 HttpClient.execute(request).pipe(
36 Effect.flatMap((response) =>
37 response.status >= 500
38 ? response.text.pipe(
39 Effect.flatMap((body) =>
40 Effect.fail(
41 new TransientUpstream({ status: response.status, body }),
42 ),
43 ),
44 )
45 : Effect.succeed(response),
46 ),
47 Effect.retry({
48 while: (e) => e._tag === "TransientUpstream",
49 schedule: Schedule.max([
50 Schedule.exponential("500 millis"),
51 Schedule.recurs(6),
52 ]),
53 }),
54 );
55
56const getJson = (url: string) =>
57 send(HttpClientRequest.get(url)).pipe(Effect.flatMap((r) => r.json));
58
59const postJson = (url: string, body: unknown) =>
60 send(
61 HttpClientRequest.post(url).pipe(HttpClientRequest.bodyJsonUnsafe(body)),
62 ).pipe(Effect.flatMap((r) => r.json));
63
64const post = (url: string) =>
65 send(HttpClientRequest.post(url)).pipe(Effect.flatMap((r) => r.json));
66
67/**
68 * A route answered with a typed error tag. The tag being present proves the
69 * binding produced a typed failure (untyped errors crash into a 500), and it
70 * not being an authorization tag proves the IAM grant covered the call.
71 */
72const expectTypedNonAuthz = (body: any) => {
73 expect(typeof body.errorTag).toBe("string");
74 expect(body.errorTag).not.toBe("AccessDeniedException");
75};
76
77/** A route that either succeeded or failed with a typed, authorized tag. */
78const expectAuthorized = (body: any) => {
79 if (body.errorTag !== undefined) expectTypedNonAuthz(body);
80};
81
82// A syntactically plausible, nonexistent deployment id/target id.
83const FAKE_DEPLOYMENT_ID = "d-AAAAAAAAA";
84const FAKE_TARGET_ID = "alchemy-test-nonexistent-function";
85
86describe.sequential(
87 "CodeDeploy Bindings",
88 {
89 tags: [
90 "provider:aws",
91 "provider:aws:batch",
92 "provider:aws:codedeploy",
93 "provider:aws:iam",
94 "provider:aws:lambda",
95 "live",
96 ],
97 },
98 () => {
99 beforeAll(
100 Effect.gen(function* () {
101 yield* Effect.logInfo("CodeDeploy test setup: destroying previous");
102 yield* sharedStack.destroy();
103
104 yield* Effect.logInfo("CodeDeploy test setup: deploying fixture");
105 const { functionUrl } = yield* sharedStack.deploy(
106 Effect.gen(function* () {
107 return yield* CodeDeployTestFunction;
108 }).pipe(Effect.provide(CodeDeployTestFunctionLive)),
109 );
110
111 expect(functionUrl).toBeTruthy();
112 baseUrl = functionUrl!.replace(/\/+$/, "");
113 const readinessUrl = `${baseUrl}/deployment/list`;
114
115 yield* Effect.logInfo(
116 `CodeDeploy test setup: probing readiness at ${readinessUrl}`,
117 );
118 // Ready = the function answers 200 AND the freshly attached codedeploy
119 // policy has propagated (an AccessDeniedException errorTag means IAM
120 // is still converging — keep probing).
121 yield* HttpClient.get(readinessUrl).pipe(
122 Effect.flatMap((response) =>
123 response.status === 200
124 ? response.json
125 : Effect.fail(
126 new Error(`Function not ready: ${response.status}`),
127 ),
128 ),
129 Effect.flatMap((body: any) =>
130 body.errorTag === undefined
131 ? Effect.succeed(body)
132 : Effect.fail(new Error(`IAM not propagated: ${body.errorTag}`)),
133 ),
134 Effect.retry({ schedule: readinessPolicy }),
135 );
136 }),
137 { timeout: 300_000 },
138 );
139
140 afterAll.skipIf(!!process.env.NO_DESTROY)(sharedStack.destroy(), {
141 timeout: 240_000,
142 });
143
144 describe("CreateDeployment", () => {
145 test.provider(
146 "answers the typed RevisionRequiredException without a revision",
147 (_stack) =>
148 Effect.gen(function* () {
149 // No revision — CodeDeploy rejects with the TYPED
150 // RevisionRequiredException, which proves the name injection,
151 // the binding wiring, and the IAM grant all work.
152 const body = (yield* post(`${baseUrl}/deployment/create`)) as any;
153 expect(body.errorTag).toBe("RevisionRequiredException");
154 }),
155 );
156 });
157
158 describe("ListDeployments + GetDeployment + BatchGetDeployments", () => {
159 test.provider(
160 "lists (empty) and answers typed for unknown ids",
161 (_stack) =>
162 Effect.gen(function* () {
163 const listed = (yield* getJson(
164 `${baseUrl}/deployment/list`,
165 )) as any;
166 expect(listed.errorTag).toBeUndefined();
167 expect(listed.deployments).toEqual([]);
168
169 const got = (yield* getJson(
170 `${baseUrl}/deployment/get?id=${FAKE_DEPLOYMENT_ID}`,
171 )) as any;
172 expectTypedNonAuthz(got);
173
174 const batch = (yield* getJson(
175 `${baseUrl}/deployment/batch-get?id=${FAKE_DEPLOYMENT_ID}`,
176 )) as any;
177 expectAuthorized(batch);
178 }),
179 );
180 });
181
182 describe("StopDeployment + ContinueDeployment + PutLifecycleEventHookExecutionStatus", () => {
183 test.provider("answer typed for unknown deployments", (_stack) =>
184 Effect.gen(function* () {
185 const stopped = (yield* postJson(`${baseUrl}/deployment/stop`, {
186 id: FAKE_DEPLOYMENT_ID,
187 })) as any;
188 expectTypedNonAuthz(stopped);
189
190 const continued = (yield* postJson(`${baseUrl}/deployment/continue`, {
191 id: FAKE_DEPLOYMENT_ID,
192 })) as any;
193 expectTypedNonAuthz(continued);
194
195 const hook = (yield* postJson(`${baseUrl}/hook/status`, {
196 deploymentId: FAKE_DEPLOYMENT_ID,
197 executionId: "00000000-0000-0000-0000-000000000000",
198 })) as any;
199 expectTypedNonAuthz(hook);
200 }),
201 );
202 });
203
204 describe("Deployment targets", () => {
205 test.provider("target bindings answer typed for unknown ids", (_stack) =>
206 Effect.gen(function* () {
207 const got = (yield* getJson(
208 `${baseUrl}/target/get?deploymentId=${FAKE_DEPLOYMENT_ID}&targetId=${FAKE_TARGET_ID}`,
209 )) as any;
210 expectTypedNonAuthz(got);
211
212 const listed = (yield* getJson(
213 `${baseUrl}/target/list?deploymentId=${FAKE_DEPLOYMENT_ID}`,
214 )) as any;
215 expectTypedNonAuthz(listed);
216
217 const batch = (yield* getJson(
218 `${baseUrl}/target/batch-get?deploymentId=${FAKE_DEPLOYMENT_ID}&targetId=${FAKE_TARGET_ID}`,
219 )) as any;
220 expectTypedNonAuthz(batch);
221 }),
222 );
223 });
224
225 describe("Revisions", () => {
226 test.provider(
227 "register + get + list + batch-get against the bound application",
228 (_stack) =>
229 Effect.gen(function* () {
230 // Registering an S3 revision records metadata only — the bundle
231 // is not fetched until deployment, so this succeeds.
232 const registered = (yield* post(
233 `${baseUrl}/revision/register`,
234 )) as any;
235 expectAuthorized(registered);
236
237 const got = (yield* getJson(`${baseUrl}/revision/get`)) as any;
238 expectAuthorized(got);
239
240 const listed = (yield* getJson(`${baseUrl}/revision/list`)) as any;
241 expect(listed.errorTag).toBeUndefined();
242
243 const batch = (yield* getJson(
244 `${baseUrl}/revision/batch-get`,
245 )) as any;
246 expectAuthorized(batch);
247 }),
248 );
249 });
250 },
251);