1import * as AWS from "@/AWS";
2import * as Core from "@/Test/Core";
3import * as Test from "@/Test/Alchemy";
4import * as securityhub from "@distilled.cloud/aws/securityhub";
5import { describe, expect } from "alchemy-test";
6import * as Data from "effect/Data";
7import * as Effect from "effect/Effect";
8import * as Schedule from "effect/Schedule";
9import * as HttpClient from "effect/http/HttpClient";
10import * as HttpClientRequest from "effect/http/HttpClientRequest";
11import SecurityHubTestFunctionLive, {
12 SecurityHubTestFunction,
13} from "./handler";
14import { makeSecurityHubTestLease } from "./TestLease.ts";
15
16const testOptions = { providers: AWS.providers() };
17const { test, beforeAll, afterAll } = Test.make(testOptions);
18const sharedStack = Core.scratchStack(testOptions, "SecurityHubBindings");
19const testLease = makeSecurityHubTestLease();
20
21beforeAll(testLease.acquire, { timeout: 240_000 });
22afterAll(testLease.release);
23
24// Lambda function URL cold-start (DNS, IAM propagation, init) can take well
25// over 60s on a fresh deploy.
26const readinessPolicy = Schedule.max([
27 Schedule.fixed("2 seconds"),
28 Schedule.recurs(75),
29]);
30
31let baseUrl: string;
32// The Hub is an account/region singleton. If the account already runs a Hub
33// this suite did not create, deploying the fixture would adopt (and later
34// DISABLE) it — so every test degrades to a logged no-op instead
35// (capture-and-restore safety, mirroring Hub.test.ts).
36let foreignHub = false;
37// Filled in by beforeAll from the live Hub ARN (`arn:aws:securityhub:REGION:ACCOUNT:hub/default`).
38let accountId = "";
39let region = "";
40
41const findingId = "alchemy/securityhub-bindings/test-finding-1";
42const productArn = () =>
43 `arn:aws:securityhub:${region}:${accountId}:product/${accountId}/default`;
44
45class TransientUpstream extends Data.TaggedError("TransientUpstream")<{
46 readonly status: number;
47 readonly body: string;
48}> {}
49
50// The shared Lambda fixture occasionally answers a transient 5xx under load
51// (cold re-init, IAM propagation on the freshly attached policy that the
52// handler's `Effect.orDie` surfaces as a 500). Retry only 5xx; a genuine
53// 4xx/assertion failure surfaces immediately.
54const send = (request: HttpClientRequest.HttpClientRequest) =>
55 HttpClient.execute(request).pipe(
56 Effect.flatMap((response) =>
57 response.status >= 500
58 ? response.text.pipe(
59 Effect.flatMap((body) =>
60 Effect.fail(
61 new TransientUpstream({ status: response.status, body }),
62 ),
63 ),
64 )
65 : Effect.succeed(response),
66 ),
67 Effect.retry({
68 while: (e) => e._tag === "TransientUpstream",
69 schedule: Schedule.max([
70 Schedule.exponential("500 millis"),
71 Schedule.recurs(6),
72 ]),
73 }),
74 );
75
76const getJson = (path: string) =>
77 send(HttpClientRequest.get(`${baseUrl}${path}`)).pipe(
78 Effect.flatMap((r) => r.json),
79 );
80
81const postJson = (path: string) =>
82 send(HttpClientRequest.post(`${baseUrl}${path}`)).pipe(
83 Effect.flatMap((r) => r.json),
84 );
85
86// beforeAll/afterAll hooks run outside `test.provider`'s layer, so raw
87// distilled calls need the provider layer (credentials, region) supplied
88// explicitly.
89const aws = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
90 Core.withProviders(effect, testOptions, sharedStack.name);
91
92const describeHub = securityhub.describeHub({}).pipe(
93 Effect.map((hub) => hub as securityhub.DescribeHubResponse | undefined),
94 Effect.catchTag("InvalidAccessException", () => Effect.succeed(undefined)),
95 Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)),
96);
97
98const skipForeign = () =>
99 foreignHub
100 ? Effect.logInfo(
101 "Security Hub is already enabled by someone else — skipping",
102 ).pipe(Effect.as(true))
103 : Effect.succeed(false);
104
105describe.sequential(
106 "SecurityHub Bindings",
107 {
108 tags: [
109 "provider:aws",
110 "provider:aws:batch",
111 "provider:aws:lambda",
112 "provider:aws:securityhub",
113 "live",
114 ],
115 },
116 () => {
117 beforeAll(
118 Effect.gen(function* () {
119 // Destroy OUR previous resources first — a crashed prior run leaves the
120 // fixture's own Hub enabled, which must not be mistaken for a foreign
121 // one. Destroying the scratch stack disables Security Hub only if the
122 // Hub is tracked in our state.
123 yield* Effect.logInfo(
124 "SecurityHub test setup: destroying previous resources",
125 );
126 yield* sharedStack.destroy();
127
128 // Never take over a Hub this fixture did not create — any Hub that
129 // remains after our own destroy is foreign.
130 const preexisting = yield* aws(describeHub);
131 if (preexisting) {
132 foreignHub = true;
133 yield* Effect.logInfo(
134 "SecurityHub test setup: Security Hub already enabled — suite degrades to no-op",
135 );
136 return;
137 }
138
139 yield* Effect.logInfo("SecurityHub test setup: deploying fixture");
140 const attrs = yield* sharedStack.deploy(
141 Effect.gen(function* () {
142 return yield* SecurityHubTestFunction;
143 }).pipe(Effect.provide(SecurityHubTestFunctionLive)),
144 );
145
146 expect(attrs.functionUrl).toBeTruthy();
147 baseUrl = attrs.functionUrl!.replace(/\/+$/, "");
148
149 // The fixture just enabled the Hub — parse account/region from its ARN
150 // for the import flow.
151 const hub = yield* aws(describeHub);
152 expect(hub?.HubArn).toBeTruthy();
153 const [, , , hubRegion, hubAccount] = hub!.HubArn!.split(":");
154 region = hubRegion!;
155 accountId = hubAccount!;
156
157 const readinessUrl = `${baseUrl}/bindings`;
158 yield* Effect.logInfo(
159 `SecurityHub test setup: probing readiness at ${readinessUrl}`,
160 );
161 yield* HttpClient.get(readinessUrl).pipe(
162 Effect.flatMap((response) =>
163 response.status === 200
164 ? Effect.succeed(response)
165 : Effect.fail(
166 new Error(`Function not ready: ${response.status}`),
167 ),
168 ),
169 Effect.tapError((error) =>
170 Effect.logWarning(
171 `SecurityHub test setup: fixture not ready yet (${String(error)})`,
172 ),
173 ),
174 Effect.retry({ schedule: readinessPolicy }),
175 );
176 }),
177 { timeout: 300_000 },
178 );
179
180 afterAll(
181 Effect.gen(function* () {
182 if (foreignHub) return;
183 yield* sharedStack.destroy();
184 // Destroying the stack disables Security Hub for the account — zero
185 // orphans.
186 const after = yield* aws(describeHub);
187 expect(after).toBeUndefined();
188 }),
189 { timeout: 180_000 },
190 );
191
192 describe("binding registration", () => {
193 test.provider("all 20 capabilities initialize in the runtime", (_stack) =>
194 Effect.gen(function* () {
195 if (yield* skipForeign()) return;
196 const response = (yield* getJson("/bindings")) as { bound: string[] };
197 expect(response.bound).toHaveLength(20);
198 expect(response.bound).toContain("batchImportFindings");
199 expect(response.bound).toContain("getFindings");
200 expect(response.bound).toContain("describeStandards");
201 }),
202 );
203 });
204
205 describe("BatchImportFindings + GetFindings + BatchUpdateFindings + GetFindingHistory", () => {
206 test.provider(
207 "a custom finding flows through the triage loop",
208 (_stack) =>
209 Effect.gen(function* () {
210 if (yield* skipForeign()) return;
211
212 // Import a synthetic ASFF finding through the default product.
213 const imported = (yield* postJson(
214 `/import?id=${encodeURIComponent(findingId)}&account=${accountId}&region=${region}`,
215 )) as { success: number; failed: number };
216 expect(imported.failed).toBe(0);
217 expect(imported.success).toBe(1);
218
219 // The imported finding surfaces asynchronously — poll bounded to
220 // ~45s; the write above already proved the binding + IAM wiring.
221 const findings = (yield* getJson(
222 `/findings?id=${encodeURIComponent(findingId)}`,
223 ).pipe(
224 Effect.repeat({
225 schedule: Schedule.spaced("3 seconds"),
226 until: (r): boolean => (r as { count: number }).count > 0,
227 times: 15,
228 }),
229 )) as { count: number; title?: string };
230
231 if (findings.count > 0) {
232 expect(findings.title).toBe(
233 "Alchemy SecurityHub bindings test finding",
234 );
235
236 // Update customer-editable fields on the finding.
237 const resolved = (yield* postJson(
238 `/resolve?id=${encodeURIComponent(findingId)}&productArn=${encodeURIComponent(productArn())}`,
239 )) as { processed: number; unprocessed: number };
240 expect(resolved.processed).toBe(1);
241 expect(resolved.unprocessed).toBe(0);
242
243 // History records the import + the workflow update (may lag —
244 // a typed ResourceNotFoundException is acceptable).
245 const history = (yield* getJson(
246 `/history?id=${encodeURIComponent(findingId)}&productArn=${encodeURIComponent(productArn())}`,
247 )) as { records?: number; errorTag?: string };
248 if (history.errorTag) {
249 expect(history.errorTag).toBe("ResourceNotFoundException");
250 } else {
251 expect(history.records).toBeGreaterThanOrEqual(0);
252 }
253 } else {
254 yield* Effect.logWarning(
255 "imported finding did not surface within the bounded poll — continuing (import succeeded)",
256 );
257 }
258 }),
259 { timeout: 150_000 },
260 );
261 });
262
263 describe("DescribeStandards + GetEnabledStandards + control definitions", () => {
264 test.provider("reads the standards and controls catalog", (_stack) =>
265 Effect.gen(function* () {
266 if (yield* skipForeign()) return;
267 const standards = (yield* getJson("/standards")) as { count: number };
268 expect(standards.count).toBeGreaterThan(0);
269
270 // The fixture enables the Hub without default standards.
271 const enabled = (yield* getJson("/enabled-standards")) as {
272 count: number;
273 };
274 expect(enabled.count).toBe(0);
275
276 const definitions = (yield* getJson("/control-definitions")) as {
277 count: number;
278 };
279 expect(definitions.count).toBeGreaterThan(0);
280
281 const control = (yield* getJson("/control")) as {
282 id: string | null;
283 severity: string | null;
284 };
285 expect(control.id).toBe("IAM.1");
286 expect(control.severity).toBeTruthy();
287 }),
288 );
289 });
290
291 describe("DescribeProducts + ListEnabledProductsForImport", () => {
292 test.provider("reads the product integration catalog", (_stack) =>
293 Effect.gen(function* () {
294 if (yield* skipForeign()) return;
295 const products = (yield* getJson("/products")) as { count: number };
296 expect(products.count).toBeGreaterThan(0);
297
298 const enabled = (yield* getJson("/enabled-products")) as {
299 count: number;
300 };
301 expect(enabled.count).toBeGreaterThanOrEqual(0);
302 }),
303 );
304 });
305
306 describe("DescribeActionTargets + ListAutomationRules + ListFindingAggregators + GetInsights", () => {
307 test.provider("a fresh Hub has no user configuration", (_stack) =>
308 Effect.gen(function* () {
309 if (yield* skipForeign()) return;
310 const actions = (yield* getJson("/action-targets")) as {
311 count: number;
312 };
313 expect(actions.count).toBe(0);
314
315 const rules = (yield* getJson("/automation-rules")) as {
316 count: number;
317 };
318 expect(rules.count).toBe(0);
319
320 const aggregators = (yield* getJson("/aggregators")) as {
321 count: number;
322 };
323 expect(aggregators.count).toBe(0);
324
325 const insights = (yield* getJson("/insights")) as { count: number };
326 expect(insights.count).toBe(0);
327 }),
328 );
329 });
330
331 describe("GetAdministratorAccount + members + invitations", () => {
332 test.provider("reads this account's membership state", (_stack) =>
333 Effect.gen(function* () {
334 if (yield* skipForeign()) return;
335 const admin = (yield* getJson("/admin")) as {
336 administrator?: string | null;
337 errorTag?: string;
338 };
339 if (admin.errorTag) {
340 expect([
341 "ResourceNotFoundException",
342 "InvalidAccessException",
343 ]).toContain(admin.errorTag);
344 } else {
345 expect(admin.administrator ?? null).toBeNull();
346 }
347
348 const members = (yield* getJson("/members")) as { count: number };
349 expect(members.count).toBe(0);
350
351 const invitations = (yield* getJson("/invitations")) as {
352 count: number;
353 };
354 expect(invitations.count).toBeGreaterThanOrEqual(0);
355
356 const count = (yield* getJson("/invitations-count")) as {
357 count: number;
358 };
359 expect(count.count).toBeGreaterThanOrEqual(0);
360 }),
361 );
362 });
363
364 describe("ListOrganizationAdminAccounts + DescribeOrganizationConfiguration", () => {
365 test.provider(
366 "answers (or rejects with a typed error outside the management account)",
367 (_stack) =>
368 Effect.gen(function* () {
369 if (yield* skipForeign()) return;
370 const admins = (yield* getJson("/org-admins")) as {
371 admins?: number;
372 errorTag?: string;
373 };
374 if (admins.errorTag) {
375 expect([
376 "AccessDeniedException",
377 "InvalidAccessException",
378 ]).toContain(admins.errorTag);
379 } else {
380 expect(admins.admins).toBeGreaterThanOrEqual(0);
381 }
382
383 const orgConfig = (yield* getJson("/org-config")) as {
384 autoEnable?: boolean;
385 errorTag?: string;
386 };
387 if (orgConfig.errorTag) {
388 expect([
389 "AccessDeniedException",
390 "InvalidAccessException",
391 ]).toContain(orgConfig.errorTag);
392 } else {
393 expect(typeof orgConfig.autoEnable).toBe("boolean");
394 }
395 }),
396 );
397 });
398 },
399);