1import { adopt, OwnedBySomeoneElse } from "@/AdoptPolicy.ts";
2import * as AWS from "@/AWS";
3import { AWSEnvironment } from "@/AWS/Environment";
4import { DedicatedIpPool } from "@/AWS/SES";
5import * as Test from "@/Test/Alchemy";
6import * as sesv2 from "@distilled.cloud/aws/sesv2";
7import { expect } from "alchemy-test";
8import * as Data from "effect/Data";
9import * as Effect from "effect/Effect";
10import * as Schedule from "effect/Schedule";
11
12const { test } = Test.make({ providers: AWS.providers() });
13
14class PoolStillExists extends Data.TaggedError("PoolStillExists")<{
15 readonly name: string;
16}> {}
17
18const getPool = (name: string) =>
19 sesv2.getDedicatedIpPool({ PoolName: name }).pipe(
20 Effect.map((response) => response.DedicatedIpPool),
21 Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
22 );
23
24const assertPoolDeleted = (name: string) =>
25 getPool(name).pipe(
26 Effect.flatMap((found) =>
27 found ? Effect.fail(new PoolStillExists({ name })) : Effect.void,
28 ),
29 Effect.retry({
30 while: (e) => e._tag === "PoolStillExists",
31 schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(8)]),
32 }),
33 );
34
35// A STANDARD pool holding no dedicated IPs is free — SES bills $24.95/month
36// per dedicated IP, not per pool — so the STANDARD lifecycle runs ungated.
37test.provider(
38 "dedicated IP pool lifecycle: create STANDARD, verify, delete",
39 (stack) =>
40 Effect.gen(function* () {
41 yield* stack.destroy();
42
43 const pool = yield* stack.deploy(
44 Effect.gen(function* () {
45 return yield* DedicatedIpPool("Standard", {
46 scalingMode: "STANDARD",
47 });
48 }),
49 );
50
51 expect(pool.poolName).toBeDefined();
52 expect(pool.scalingMode).toBe("STANDARD");
53
54 // out-of-band verification via distilled
55 const created = yield* getPool(pool.poolName);
56 expect(created?.ScalingMode).toBe("STANDARD");
57
58 yield* stack.destroy();
59 yield* assertPoolDeleted(pool.poolName);
60 }),
61 { tags: ["provider:aws", "provider:aws:ses", "live"], timeout: 120_000 },
62);
63
64// Switching a pool to MANAGED enables managed dedicated IPs, which bill
65// $15/month/account from that point on, so every MANAGED case stays gated
66// behind AWS_TEST_SES_DEDICATED_IP=1.
67test.provider.skipIf(!process.env.AWS_TEST_SES_DEDICATED_IP)(
68 "dedicated IP pool lifecycle: create STANDARD, scale to MANAGED, delete",
69 (stack) =>
70 Effect.gen(function* () {
71 yield* stack.destroy();
72
73 const pool = yield* stack.deploy(
74 Effect.gen(function* () {
75 return yield* DedicatedIpPool("Marketing", {
76 scalingMode: "STANDARD",
77 });
78 }),
79 );
80
81 expect(pool.poolName).toBeDefined();
82 expect(pool.scalingMode).toBe("STANDARD");
83
84 // out-of-band verification via distilled
85 const created = yield* getPool(pool.poolName);
86 expect(created?.ScalingMode).toBe("STANDARD");
87
88 // STANDARD -> MANAGED is an in-place scaling change (no replacement).
89 const scaled = yield* stack.deploy(
90 Effect.gen(function* () {
91 return yield* DedicatedIpPool("Marketing", {
92 scalingMode: "MANAGED",
93 });
94 }),
95 );
96 expect(scaled.poolName).toBe(pool.poolName);
97 expect(scaled.scalingMode).toBe("MANAGED");
98 const observed = yield* getPool(pool.poolName);
99 expect(observed?.ScalingMode).toBe("MANAGED");
100
101 yield* stack.destroy();
102 yield* assertPoolDeleted(pool.poolName);
103 }),
104 { tags: ["provider:aws", "provider:aws:ses", "live"], timeout: 120_000 },
105);
106
107// MANAGED -> STANDARD is not supported by AWS in place, so it replaces the
108// pool. Auto-naming gives the replacement a fresh instance suffix.
109test.provider.skipIf(!process.env.AWS_TEST_SES_DEDICATED_IP)(
110 "downgrading MANAGED -> STANDARD replaces the pool",
111 (stack) =>
112 Effect.gen(function* () {
113 yield* stack.destroy();
114
115 const first = yield* stack.deploy(
116 Effect.gen(function* () {
117 return yield* DedicatedIpPool("Pool", { scalingMode: "MANAGED" });
118 }),
119 );
120
121 const second = yield* stack.deploy(
122 Effect.gen(function* () {
123 return yield* DedicatedIpPool("Pool", { scalingMode: "STANDARD" });
124 }),
125 );
126
127 expect(second.poolName).not.toBe(first.poolName);
128 expect(second.scalingMode).toBe("STANDARD");
129 yield* assertPoolDeleted(first.poolName);
130
131 yield* stack.destroy();
132 yield* assertPoolDeleted(second.poolName);
133 }),
134 { tags: ["provider:aws", "provider:aws:ses", "live"], timeout: 120_000 },
135);
136
137// A pool the account already pays for must not be silently taken over just
138// because its name matches ours. Free to exercise: a STANDARD pool holding no
139// dedicated IPs costs nothing, and create/delete are both fast.
140const FOREIGN_POOL = "alchemy-test-foreign-pool";
141
142const deletePoolIfExists = (name: string) =>
143 sesv2
144 .deleteDedicatedIpPool({ PoolName: name })
145 .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
146
147test.provider(
148 "a pool without alchemy tags is not adopted without --adopt",
149 (stack) =>
150 Effect.gen(function* () {
151 yield* stack.destroy();
152 // Idempotent pre-clean: reclaim a leftover from an interrupted run.
153 yield* deletePoolIfExists(FOREIGN_POOL);
154
155 // Someone else's pool: same name, no alchemy tags.
156 yield* sesv2.createDedicatedIpPool({
157 PoolName: FOREIGN_POOL,
158 ScalingMode: "STANDARD",
159 });
160
161 const error = yield* stack
162 .deploy(
163 Effect.gen(function* () {
164 return yield* DedicatedIpPool("Foreign", {
165 poolName: FOREIGN_POOL,
166 });
167 }),
168 )
169 .pipe(Effect.flip);
170 expect(error).toBeInstanceOf(OwnedBySomeoneElse);
171
172 // The pool is still there and still untagged — the refusal touched
173 // nothing.
174 const untouched = yield* getPool(FOREIGN_POOL);
175 expect(untouched?.PoolName).toBe(FOREIGN_POOL);
176
177 yield* deletePoolIfExists(FOREIGN_POOL);
178 yield* assertPoolDeleted(FOREIGN_POOL);
179 }),
180 { tags: ["provider:aws", "provider:aws:ses", "live"], timeout: 120_000 },
181);
182
183test.provider(
184 "adopt(true) takes over the pool and brands it",
185 (stack) =>
186 Effect.gen(function* () {
187 yield* stack.destroy();
188 yield* deletePoolIfExists(FOREIGN_POOL);
189
190 yield* sesv2.createDedicatedIpPool({
191 PoolName: FOREIGN_POOL,
192 ScalingMode: "STANDARD",
193 });
194
195 const pool = yield* stack.deploy(
196 Effect.gen(function* () {
197 return yield* DedicatedIpPool("Foreign", {
198 poolName: FOREIGN_POOL,
199 }).pipe(adopt(true));
200 }),
201 );
202 expect(pool.poolName).toBe(FOREIGN_POOL);
203
204 // Reconcile brands an adopted pool, so a later read owns it outright —
205 // without this the resource would need --adopt on every deploy.
206 const { accountId, region } = yield* AWSEnvironment.current;
207 const { Tags } = yield* sesv2.listTagsForResource({
208 ResourceArn: `arn:aws:ses:${region}:${accountId}:dedicated-ip-pool/${FOREIGN_POOL}`,
209 });
210 const tags = Object.fromEntries(Tags.map((t) => [t.Key, t.Value]));
211 expect(tags["alchemy::id"]).toBe("Foreign");
212
213 // Now owned: a plain re-deploy converges with no adopt decoration.
214 // Deploying at all proves read no longer returns Unowned — an Unowned
215 // read without adopt fails with OwnedBySomeoneElse, as the test above
216 // shows — and the brand must still be intact afterwards.
217 const readopted = yield* stack.deploy(
218 Effect.gen(function* () {
219 return yield* DedicatedIpPool("Foreign", { poolName: FOREIGN_POOL });
220 }),
221 );
222 expect(readopted.poolName).toBe(FOREIGN_POOL);
223 const { Tags: afterTags } = yield* sesv2.listTagsForResource({
224 ResourceArn: `arn:aws:ses:${region}:${accountId}:dedicated-ip-pool/${FOREIGN_POOL}`,
225 });
226 expect(
227 Object.fromEntries(afterTags.map((t) => [t.Key, t.Value]))[
228 "alchemy::id"
229 ],
230 ).toBe("Foreign");
231
232 yield* stack.destroy();
233 yield* assertPoolDeleted(FOREIGN_POOL);
234 }),
235 { tags: ["provider:aws", "provider:aws:ses", "live"], timeout: 120_000 },
236);
237
238// A STANDARD pool holding no dedicated IPs is free, so the rename path runs
239// ungated. Renaming is a replacement — there is no rename API.
240test.provider(
241 "renaming the pool replaces it",
242 (stack) =>
243 Effect.gen(function* () {
244 yield* stack.destroy();
245
246 const first = yield* stack.deploy(
247 Effect.gen(function* () {
248 return yield* DedicatedIpPool("Renamed", {
249 poolName: "alchemy-test-pool-a",
250 });
251 }),
252 );
253 expect(first.poolName).toBe("alchemy-test-pool-a");
254
255 const second = yield* stack.deploy(
256 Effect.gen(function* () {
257 return yield* DedicatedIpPool("Renamed", {
258 poolName: "alchemy-test-pool-b",
259 });
260 }),
261 );
262 expect(second.poolName).toBe("alchemy-test-pool-b");
263
264 // The old pool is gone, not orphaned.
265 yield* assertPoolDeleted("alchemy-test-pool-a");
266
267 yield* stack.destroy();
268 yield* assertPoolDeleted("alchemy-test-pool-b");
269 }),
270 { tags: ["provider:aws", "provider:aws:ses", "live"], timeout: 120_000 },
271);