1import * as AWS from "@/AWS";
2import { Domain } from "@/AWS/DataZone";
3import * as Test from "@/Test/Alchemy";
4import * as datazone from "@distilled.cloud/aws/datazone";
5import * as iam from "@distilled.cloud/aws/iam";
6import { expect } from "alchemy-test";
7import * as Data from "effect/Data";
8import * as Effect from "effect/Effect";
9import * as Schedule from "effect/Schedule";
10
11const { test } = Test.make({ providers: AWS.providers() });
12
13// A deleted domain is reported by GetDomain as AccessDeniedException, not
14// ResourceNotFoundException — DataZone checks domain-scoped auth before
15// existence. Both mean "absent".
16const findDomain = (identifier: string) =>
17 datazone.getDomain({ identifier }).pipe(
18 Effect.catchTag("ResourceNotFoundException", () =>
19 Effect.succeed(undefined),
20 ),
21 Effect.catchTag("AccessDeniedException", () => Effect.succeed(undefined)),
22 );
23
24class StillExists extends Data.TaggedError("StillExists")<{
25 readonly what: string;
26}> {}
27
28// Domain deletion is asynchronous (typically ~1 minute) — poll until gone.
29const assertDomainGone = (identifier: string) =>
30 findDomain(identifier).pipe(
31 Effect.flatMap((d) =>
32 d === undefined || d.status === "DELETED" || d.status === "DELETING"
33 ? Effect.void
34 : Effect.fail(new StillExists({ what: `domain ${identifier}` })),
35 ),
36 Effect.retry({
37 while: (e) => e._tag === "StillExists",
38 schedule: Schedule.max([
39 Schedule.fixed("5 seconds"),
40 Schedule.recurs(10),
41 ]),
42 }),
43 );
44
45test.provider(
46 "create domain with managed role, update description, delete",
47 (stack) =>
48 Effect.gen(function* () {
49 yield* stack.destroy();
50
51 // 1. Deploy a domain (auto-created execution role).
52 const result = yield* stack.deploy(
53 Effect.gen(function* () {
54 const domain = yield* Domain("TestDomain", {
55 description: "alchemy datazone domain test",
56 tags: { Environment: "test" },
57 });
58 return {
59 domainId: domain.domainId,
60 domainArn: domain.domainArn,
61 name: domain.name,
62 status: domain.status,
63 portalUrl: domain.portalUrl,
64 roleName: domain.roleName,
65 domainExecutionRole: domain.domainExecutionRole,
66 };
67 }),
68 );
69
70 expect(result.domainId).toMatch(/^dzd/);
71 expect(result.domainArn).toContain(":domain/");
72 expect(result.status).toBe("AVAILABLE");
73
74 // out-of-band: domain is AVAILABLE and tags are branded.
75 const created = yield* findDomain(result.domainId);
76 expect(created).toBeDefined();
77 expect(created!.status).toBe("AVAILABLE");
78 expect(created!.name).toBe(result.name);
79 expect(created!.tags?.Environment).toBe("test");
80 expect(created!.tags?.["alchemy::id"]).toBe("TestDomain");
81
82 // out-of-band: the managed execution role exists.
83 expect(result.roleName).toBeDefined();
84 const role = yield* iam
85 .getRole({ RoleName: result.roleName! })
86 .pipe(Effect.map((r) => r.Role));
87 expect(role.Arn).toBe(result.domainExecutionRole);
88 expect(created!.domainExecutionRole).toBe(result.domainExecutionRole);
89
90 // 2. Update the description — converges via updateDomain, same domain.
91 const updated = yield* stack.deploy(
92 Effect.gen(function* () {
93 const domain = yield* Domain("TestDomain", {
94 description: "alchemy datazone domain test (updated)",
95 tags: { Environment: "test", Update: "yes" },
96 });
97 return { domainId: domain.domainId };
98 }),
99 );
100 expect(updated.domainId).toBe(result.domainId);
101
102 const observed = yield* findDomain(result.domainId);
103 expect(observed!.description).toBe(
104 "alchemy datazone domain test (updated)",
105 );
106 expect(observed!.tags?.Update).toBe("yes");
107
108 // 3. Destroy — domain and managed role are removed.
109 yield* stack.destroy();
110 yield* assertDomainGone(result.domainId);
111
112 const roleGone = yield* iam.getRole({ RoleName: result.roleName! }).pipe(
113 Effect.map(() => false),
114 Effect.catchTag("NoSuchEntityException", () => Effect.succeed(true)),
115 );
116 expect(roleGone).toBe(true);
117 }),
118 {
119 tags: ["provider:aws", "provider:aws:datazone", "provider:aws:iam", "live"],
120 timeout: 480_000,
121 },
122);