1import * as AWS from "@/AWS";
2import { Alias, Key } from "@/AWS/PaymentCryptography";
3import * as Test from "@/Test/Alchemy";
4import * as paymentcryptography from "@distilled.cloud/aws/payment-cryptography";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { reapLeakedKeys } from "./reapKeys.ts";
8
9const { test } = Test.make({ providers: AWS.providers() });
10
11// Keys cannot be hard-deleted (DeleteKey only schedules deletion after a
12// mandatory >=3 day window) and the scratch stacks keep state in memory, so
13// a crashed gated run leaves ACTIVE keys nothing can reclaim. This ungated
14// sweep runs in every CI pass and schedules deletion for any alchemy-tagged
15// test key that is not already DELETE_PENDING. It is skipped when the gate
16// is ON so it can never race an actively-running gated suite (which reaps
17// its own keys via `Effect.ensuring` instead).
18test.provider.skipIf(!!process.env.AWS_TEST_PAYMENTCRYPTO)(
19 "reap: schedule deletion for keys leaked by crashed gated runs",
20 () => reapLeakedKeys(),
21 { tags: ["provider:aws", "provider:aws:paymentcryptography", "live"] },
22);
23
24// Ungated typed-error probes: prove the distilled error unions carry the
25// not-found tag the provider's read/delete paths depend on. These run in
26// every CI pass at near-zero cost, unlike the gated lifecycle below.
27test.provider(
28 "getKey on a nonexistent identifier fails with ResourceNotFoundException",
29 () =>
30 Effect.gen(function* () {
31 const error = yield* Effect.flip(
32 paymentcryptography.getKey({
33 KeyIdentifier: "alias/alchemy-nonexistent-payment-key-probe",
34 }),
35 );
36 expect(error._tag).toBe("ResourceNotFoundException");
37 }),
38 { tags: ["provider:aws", "provider:aws:paymentcryptography", "live"] },
39);
40
41test.provider(
42 "getAlias on a nonexistent alias fails with ResourceNotFoundException",
43 () =>
44 Effect.gen(function* () {
45 const error = yield* Effect.flip(
46 paymentcryptography.getAlias({
47 AliasName: "alias/alchemy-nonexistent-payment-alias-probe",
48 }),
49 );
50 expect(error._tag).toBe("ResourceNotFoundException");
51 }),
52 { tags: ["provider:aws", "provider:aws:paymentcryptography", "live"] },
53);
54
55const dataKeyAttributes = {
56 keyAlgorithm: "AES_128",
57 keyClass: "SYMMETRIC_KEY",
58 keyUsage: "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY",
59 keyModesOfUse: {
60 encrypt: true,
61 decrypt: true,
62 wrap: true,
63 unwrap: true,
64 },
65} as const;
66
67// Keys bill monthly while they exist, so the live lifecycle is gated behind
68// AWS_TEST_PAYMENTCRYPTO=1 and always destroys what it created (with the
69// minimum 3-day deletion window).
70test.provider.skipIf(!process.env.AWS_TEST_PAYMENTCRYPTO)(
71 "create key + alias, toggle enabled, destroy",
72 (stack) =>
73 Effect.gen(function* () {
74 yield* stack.destroy();
75
76 const deployed = yield* stack.deploy(
77 Effect.gen(function* () {
78 const key = yield* Key("DataKey", {
79 keyAttributes: dataKeyAttributes,
80 tags: { fixture: "payment-cryptography-key" },
81 });
82 const alias = yield* Alias("DataKeyAlias", { keyArn: key.keyArn });
83 return { key, alias };
84 }),
85 );
86
87 expect(deployed.key.keyArn).toContain(":key/");
88 expect(deployed.key.keyState).toBe("CREATE_COMPLETE");
89 expect(deployed.key.enabled).toBe(true);
90 expect(deployed.key.exportable).toBe(false);
91 expect(deployed.key.keyCheckValue).toBeTruthy();
92 expect(deployed.alias.aliasName).toMatch(/^alias\//);
93 expect(deployed.alias.keyArn).toBe(deployed.key.keyArn);
94
95 // Out-of-band verification via distilled.
96 const observed = yield* paymentcryptography.getKey({
97 KeyIdentifier: deployed.key.keyArn,
98 });
99 expect(observed.Key.KeyState).toBe("CREATE_COMPLETE");
100 expect(observed.Key.Enabled).toBe(true);
101 expect(observed.Key.KeyAttributes.KeyAlgorithm).toBe("AES_128");
102 expect(observed.Key.KeyAttributes.KeyUsage).toBe(
103 "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY",
104 );
105 const observedAlias = yield* paymentcryptography.getAlias({
106 AliasName: deployed.alias.aliasName,
107 });
108 expect(observedAlias.Alias.KeyArn).toBe(deployed.key.keyArn);
109
110 // Update in place: disable the key (StopKeyUsage) — same ARN.
111 const updated = yield* stack.deploy(
112 Effect.gen(function* () {
113 const key = yield* Key("DataKey", {
114 keyAttributes: dataKeyAttributes,
115 enabled: false,
116 tags: { fixture: "payment-cryptography-key", phase: "two" },
117 });
118 const alias = yield* Alias("DataKeyAlias", { keyArn: key.keyArn });
119 return { key, alias };
120 }),
121 );
122 expect(updated.key.keyArn).toBe(deployed.key.keyArn);
123 expect(updated.key.enabled).toBe(false);
124 const observedDisabled = yield* paymentcryptography.getKey({
125 KeyIdentifier: deployed.key.keyArn,
126 });
127 expect(observedDisabled.Key.Enabled).toBe(false);
128
129 // Destroy — the key schedules deletion (DELETE_PENDING) and the alias
130 // is removed immediately.
131 yield* stack.destroy();
132 const stateAfter = yield* paymentcryptography
133 .getKey({ KeyIdentifier: deployed.key.keyArn })
134 .pipe(
135 Effect.map((r) => r.Key.KeyState),
136 Effect.catchTag("ResourceNotFoundException", () =>
137 Effect.succeed("gone" as const),
138 ),
139 );
140 expect(["DELETE_PENDING", "DELETE_COMPLETE", "gone"]).toContain(
141 stateAfter,
142 );
143 const aliasError = yield* Effect.flip(
144 paymentcryptography.getAlias({
145 AliasName: deployed.alias.aliasName,
146 }),
147 );
148 expect(aliasError._tag).toBe("ResourceNotFoundException");
149 }).pipe(
150 // Belt-and-braces teardown: even if the body fails before its trailing
151 // destroy (or the engine's destroy fails), schedule deletion for any
152 // key this stack created so a failed run still leaves the key at
153 // worst DELETE_PENDING (the best achievable state — the deletion
154 // window is mandatory). Idempotent: a no-op when destroy already ran.
155 Effect.ensuring(reapLeakedKeys([stack.name])),
156 ),
157 {
158 tags: ["provider:aws", "provider:aws:paymentcryptography", "live"],
159 timeout: 120_000,
160 },
161);