1import * as AWS from "@/AWS";
2import { SecurityConfig } from "@/AWS/OpenSearchServerless";
3import * as Test from "@/Test/Alchemy";
4import * as aoss from "@distilled.cloud/aws/opensearchserverless";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import * as Schedule from "effect/Schedule";
8
9const { test } = Test.make({ providers: AWS.providers() });
10
11const CONFIG_NAME = "alchemy-test-saml";
12
13// Self-signed X.509 certificate generated once with openssl and checked in as
14// a constant (per the fixture convention — never generated at test time).
15const SAML_CERT =
16 "MIICyjCCAbICCQCxJOzsFl758TANBgkqhkiG9w0BAQsFADAnMSUwIwYDVQQDDBxhbGNoZW15LXRlc3QtaWRwLmV4YW1wbGUuY29tMB4XDTI2MDcxNTE5MTUwMVoXDTM2MDcxMjE5MTUwMVowJzElMCMGA1UEAwwcYWxjaGVteS10ZXN0LWlkcC5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKH+HmxWlUHl6UusNhnk7Jhd7fmMgOLsE2J4cBIL7sGssnrq6yfkMiIboYs2OMPXMFP4FxxgLAOzBzOE+pNCXbIvq/seIvo/P1Mr3cuHRG88PuXOYizzzbVqa18CnyYZe5I9NDSxp+W96gkMVAY4rQ9ILrHyrF2/rTb5uCj6gcwsUPKWpBZUxWN3PCIWOY2kWchFqxBvxyJcXJ53a5h6kGWfaRID7YYTO6bvTPmDNOgLANTMW0GsfqTdzm7N6xfZWQB9E4WxTP+B84mprddITJRZiFxGn2mJB9If6/JbxqilLd7VgWZCFUuH+mfhUMivwgMz76uo+6cEetfKhxoUe8sCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAHqSFxKJRPdQVwrLvnAgO3UBvRkm8I2twcCWyHKVwL2YhbUdVJoqnr10Q56PkQ+XiC11OBicqbxdYXEoWySFZhvLLuf5ynEmVRqUHbnaqrMyqvtU1dHqjoq8Rptd80WWLZbRpOp+4WFGkV+qHp97e4Sd67Lclgnryos2svy54EBZAiBvEFecDqhrrVqRlR6VjgHOqrEy1FLsQeqGpsmzgW8EEobxEXc5Qkvz6+tgJDc5C6iYs+TNRryCObtnIxSEDoWPuYmu+mGDn5jntch3zGPjvhK9jgLufplcFgub/au3C2FyItkcf9UlxpIAVAxTx120sC809bkSZ3FtPmgBt7A==";
17
18const SAML_METADATA = `<?xml version="1.0" encoding="UTF-8"?>
19<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://alchemy-test-idp.example.com/saml">
20 <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
21 <md:KeyDescriptor use="signing">
22 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
23 <ds:X509Data>
24 <ds:X509Certificate>${SAML_CERT}</ds:X509Certificate>
25 </ds:X509Data>
26 </ds:KeyInfo>
27 </md:KeyDescriptor>
28 <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
29 <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://alchemy-test-idp.example.com/sso"/>
30 <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://alchemy-test-idp.example.com/sso"/>
31 </md:IDPSSODescriptor>
32</md:EntityDescriptor>`;
33
34const assertGone = (configId: string) =>
35 aoss.getSecurityConfig({ id: configId }).pipe(
36 Effect.flip,
37 Effect.map((e) => expect(e._tag).toBe("ResourceNotFoundException")),
38 Effect.retry({
39 schedule: Schedule.max([Schedule.fixed("2 seconds"), Schedule.recurs(5)]),
40 }),
41 );
42
43// Security configs are free and provision instantly, so the full lifecycle
44// runs ungated: create a SAML config (with a Duration-typed sessionTimeout),
45// no-op, update the description (config version bump), destroy, verify gone.
46test.provider(
47 "saml security config lifecycle: create, no-op, update, destroy, verify gone",
48 (stack) =>
49 Effect.gen(function* () {
50 // Clean slate in case a previous run died mid-flight.
51 yield* stack.destroy();
52
53 const deployConfig = (
54 description: string,
55 sessionTimeout: "2 hours" | "3 hours" = "2 hours",
56 ) =>
57 stack.deploy(
58 Effect.gen(function* () {
59 const config = yield* SecurityConfig("Saml", {
60 configName: CONFIG_NAME,
61 type: "saml",
62 description,
63 samlOptions: {
64 metadata: SAML_METADATA,
65 groupAttribute: "groups",
66 // Duration.Input — converted to wire minutes.
67 sessionTimeout,
68 },
69 });
70 return { config };
71 }),
72 );
73
74 // Create.
75 const created = yield* deployConfig("alchemy test saml config");
76 expect(created.config.configName).toBe(CONFIG_NAME);
77 expect(created.config.type).toBe("saml");
78 expect(created.config.configId).toContain(`saml/`);
79 expect(created.config.configId).toContain(`/${CONFIG_NAME}`);
80 const initialVersion = created.config.configVersion;
81
82 // Out-of-band verification via distilled — including the wire unit of
83 // the Duration-typed sessionTimeout (minutes).
84 const observed = yield* aoss.getSecurityConfig({
85 id: created.config.configId,
86 });
87 expect(observed.securityConfigDetail?.type).toBe("saml");
88 expect(observed.securityConfigDetail?.samlOptions?.sessionTimeout).toBe(
89 120,
90 );
91 expect(observed.securityConfigDetail?.samlOptions?.groupAttribute).toBe(
92 "groups",
93 );
94
95 // No-op redeploy: version must not change.
96 const noop = yield* deployConfig("alchemy test saml config");
97 expect(noop.config.configVersion).toBe(initialVersion);
98
99 // Update the SAML session timeout (a samlOptions change is what bumps
100 // the config version — description-only updates keep it, verified
101 // against the live API) and the description.
102 const updated = yield* deployConfig(
103 "alchemy test saml config v2",
104 "3 hours",
105 );
106 expect(updated.config.configVersion).not.toBe(initialVersion);
107 expect(updated.config.description).toBe("alchemy test saml config v2");
108 const observedUpdated = yield* aoss.getSecurityConfig({
109 id: updated.config.configId,
110 });
111 expect(
112 observedUpdated.securityConfigDetail?.samlOptions?.sessionTimeout,
113 ).toBe(180);
114
115 // Destroy and verify deletion out-of-band.
116 const configId = created.config.configId;
117 yield* stack.destroy();
118 yield* assertGone(configId);
119 }),
120 {
121 tags: ["provider:aws", "provider:aws:opensearchserverless", "live"],
122 timeout: 120_000,
123 },
124);