1import * as AWS from "@/AWS";
2import { Bucket } from "@/AWS/S3";
3import { AccessPoint } from "@/AWS/S3Control";
4import * as Test from "@/Test/Alchemy";
5import * as s3control from "@distilled.cloud/aws/s3-control";
6import { expect } from "alchemy-test";
7import * as Data from "effect/Data";
8import * as Effect from "effect/Effect";
9import * as Schedule from "effect/Schedule";
10
11const { test } = Test.make({ providers: AWS.providers() });
12
13const ACCOUNT_ID = "391965393224";
14
15const findAccessPoint = (name: string) =>
16 s3control
17 .getAccessPoint({ AccountId: ACCOUNT_ID, Name: name })
18 .pipe(
19 Effect.catchTag("NoSuchAccessPoint", () => Effect.succeed(undefined)),
20 );
21
22class AccessPointStillExists extends Data.TaggedError(
23 "AccessPointStillExists",
24)<{ readonly name: string }> {}
25
26const assertAccessPointDeleted = (name: string) =>
27 findAccessPoint(name).pipe(
28 Effect.flatMap((ap) =>
29 ap === undefined
30 ? Effect.void
31 : Effect.fail(new AccessPointStillExists({ name })),
32 ),
33 Effect.retry({
34 while: (e) => e._tag === "AccessPointStillExists",
35 schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(8)]),
36 }),
37 );
38
39test.provider(
40 "typed NoSuchAccessPoint tag on a nonexistent access point",
41 () =>
42 Effect.gen(function* () {
43 const result = yield* s3control
44 .getAccessPoint({
45 AccountId: ACCOUNT_ID,
46 Name: "alchemy-does-not-exist-xyz",
47 })
48 .pipe(
49 Effect.map(() => "found" as const),
50 // proves the patched typed union — no cast, no catch-all
51 Effect.catchTag("NoSuchAccessPoint", () =>
52 Effect.succeed("missing" as const),
53 ),
54 );
55 expect(result).toBe("missing");
56 }),
57 { tags: ["provider:aws", "provider:aws:s3control", "live"], timeout: 60_000 },
58);
59
60test.provider(
61 "create, update tags, delete access point",
62 (stack) =>
63 Effect.gen(function* () {
64 yield* stack.destroy();
65
66 const deployed = yield* stack.deploy(
67 Effect.gen(function* () {
68 const bucket = yield* Bucket("ApBucket", { forceDestroy: true });
69 const accessPoint = yield* AccessPoint("TestAp", {
70 bucket: bucket.bucketName,
71 tags: { Environment: "test" },
72 });
73 return { bucket, accessPoint };
74 }),
75 );
76
77 expect(deployed.accessPoint.accessPointName).toBeDefined();
78 expect(deployed.accessPoint.accessPointArn).toContain(":accesspoint/");
79 expect(deployed.accessPoint.networkOrigin).toBe("Internet");
80 expect(deployed.accessPoint.bucket).toBe(deployed.bucket.bucketName);
81
82 // out-of-band verification via distilled
83 const live = yield* findAccessPoint(deployed.accessPoint.accessPointName);
84 expect(live?.Bucket).toBe(deployed.bucket.bucketName);
85 // AWS defaults every public-access-block flag to true
86 expect(live?.PublicAccessBlockConfiguration?.BlockPublicAcls).toBe(true);
87
88 const tags = yield* s3control
89 .listTagsForResource({
90 AccountId: ACCOUNT_ID,
91 ResourceArn: deployed.accessPoint.accessPointArn,
92 })
93 .pipe(
94 Effect.map((r) =>
95 Object.fromEntries((r.Tags ?? []).map((t) => [t.Key, t.Value])),
96 ),
97 );
98 expect(tags.Environment).toBe("test");
99 expect(tags["alchemy::id"]).toBe("TestAp");
100
101 // update tags only — same access point, no replacement
102 const updated = yield* stack.deploy(
103 Effect.gen(function* () {
104 const bucket = yield* Bucket("ApBucket", { forceDestroy: true });
105 const accessPoint = yield* AccessPoint("TestAp", {
106 bucket: bucket.bucketName,
107 tags: { Environment: "production", Team: "data" },
108 });
109 return { bucket, accessPoint };
110 }),
111 );
112 expect(updated.accessPoint.accessPointName).toBe(
113 deployed.accessPoint.accessPointName,
114 );
115
116 const updatedTags = yield* s3control
117 .listTagsForResource({
118 AccountId: ACCOUNT_ID,
119 ResourceArn: updated.accessPoint.accessPointArn,
120 })
121 .pipe(
122 Effect.map((r) =>
123 Object.fromEntries((r.Tags ?? []).map((t) => [t.Key, t.Value])),
124 ),
125 );
126 expect(updatedTags.Environment).toBe("production");
127 expect(updatedTags.Team).toBe("data");
128
129 yield* stack.destroy();
130 yield* assertAccessPointDeleted(deployed.accessPoint.accessPointName);
131 }),
132 // Generous wall: deploys serialize on the per-profile lock across suites.
133 {
134 tags: ["provider:aws", "provider:aws:s3", "provider:aws:s3control", "live"],
135 timeout: 300_000,
136 },
137);
138
139test.provider(
140 "changing public-access-block replaces the access point",
141 (stack) =>
142 Effect.gen(function* () {
143 yield* stack.destroy();
144
145 const first = yield* stack.deploy(
146 Effect.gen(function* () {
147 const bucket = yield* Bucket("ReplBucket", { forceDestroy: true });
148 const accessPoint = yield* AccessPoint("ReplAp", {
149 bucket: bucket.bucketName,
150 });
151 return { bucket, accessPoint };
152 }),
153 );
154
155 const second = yield* stack.deploy(
156 Effect.gen(function* () {
157 const bucket = yield* Bucket("ReplBucket", { forceDestroy: true });
158 const accessPoint = yield* AccessPoint("ReplAp", {
159 bucket: bucket.bucketName,
160 publicAccessBlock: {
161 blockPublicAcls: true,
162 ignorePublicAcls: true,
163 blockPublicPolicy: false,
164 restrictPublicBuckets: false,
165 },
166 });
167 return { bucket, accessPoint };
168 }),
169 );
170
171 // replacement: new physical name, old access point cleaned up
172 expect(second.accessPoint.accessPointName).not.toBe(
173 first.accessPoint.accessPointName,
174 );
175 const live = yield* findAccessPoint(second.accessPoint.accessPointName);
176 expect(live?.PublicAccessBlockConfiguration?.BlockPublicPolicy).toBe(
177 false,
178 );
179 yield* assertAccessPointDeleted(first.accessPoint.accessPointName);
180
181 yield* stack.destroy();
182 yield* assertAccessPointDeleted(second.accessPoint.accessPointName);
183 }),
184 // Individual steps are fast (<3s solo), but deploys serialize on the
185 // per-profile lock across every concurrently-running suite, so the
186 // last-scheduled test in a busy run can queue for minutes.
187 {
188 tags: ["provider:aws", "provider:aws:s3", "provider:aws:s3control", "live"],
189 timeout: 300_000,
190 },
191);