1import * as AWS from "@/AWS";
2import { Detector } from "@/AWS/GuardDuty/Detector.ts";
3import * as Provider from "@/Provider";
4import * as Test from "@/Test/Alchemy";
5import * as guardduty from "@distilled.cloud/aws/guardduty";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import { makeGuardDutyTestLease } from "./TestLease.ts";
9
10const { test, beforeAll, afterAll } = Test.make({
11 providers: AWS.providers(),
12});
13const testLease = makeGuardDutyTestLease();
14
15beforeAll(testLease.acquire, { timeout: 240_000 });
16afterAll(testLease.release);
17
18const firstDetectorId = guardduty
19 .listDetectors({})
20 .pipe(Effect.map((r) => r.DetectorIds?.[0]));
21
22// The GuardDuty detector is an account/region singleton. This test only runs
23// when the account has no detector — it must never disable a detector the user
24// already operates (capture-and-restore safety).
25test.provider(
26 "lifecycle: enable detector, update frequency, disable",
27 (stack) =>
28 Effect.gen(function* () {
29 const preexisting = yield* firstDetectorId;
30 if (preexisting) {
31 // Refuse to mutate a foreign detector; document and pass.
32 yield* Effect.logInfo(
33 `GuardDuty detector ${preexisting} already exists — skipping destructive lifecycle test`,
34 );
35 return;
36 }
37
38 yield* stack.destroy();
39
40 // Create — enable with six-hour publishing.
41 const created = yield* stack.deploy(
42 Effect.gen(function* () {
43 return yield* Detector("Detector", {
44 enable: true,
45 findingPublishingFrequency: "SIX_HOURS",
46 tags: { env: "test" },
47 });
48 }),
49 );
50 expect(created.detectorId).toBeTruthy();
51 expect(created.status).toBe("ENABLED");
52 expect(created.findingPublishingFrequency).toBe("SIX_HOURS");
53
54 // Out-of-band verification.
55 const live = yield* guardduty.getDetector({
56 DetectorId: created.detectorId,
57 });
58 expect(live.Status).toBe("ENABLED");
59 expect(live.FindingPublishingFrequency).toBe("SIX_HOURS");
60 expect(live.Tags?.["env"]).toBe("test");
61 expect(live.Tags?.["alchemy::id"]).toBe("Detector");
62
63 // Canonical list() coverage.
64 const provider = yield* Provider.findProvider(Detector);
65 const all = yield* provider.list();
66 expect(all.some((d) => d.detectorId === created.detectorId)).toBe(true);
67
68 // Update — change frequency + retag in place (no replacement).
69 const updated = yield* stack.deploy(
70 Effect.gen(function* () {
71 return yield* Detector("Detector", {
72 enable: true,
73 findingPublishingFrequency: "FIFTEEN_MINUTES",
74 tags: { env: "prod" },
75 });
76 }),
77 );
78 expect(updated.detectorId).toBe(created.detectorId);
79 const afterUpdate = yield* guardduty.getDetector({
80 DetectorId: created.detectorId,
81 });
82 expect(afterUpdate.FindingPublishingFrequency).toBe("FIFTEEN_MINUTES");
83 expect(afterUpdate.Tags?.["env"]).toBe("prod");
84
85 // Destroy — the detector is deleted and the region is clean again.
86 yield* stack.destroy();
87 const after = yield* firstDetectorId;
88 expect(after).toBeUndefined();
89 }),
90 {
91 tags: ["provider:aws", "provider:aws:guardduty", "live"],
92 timeout: 180_000,
93 },
94);