1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import * as Provider from "@/Provider";
4import * as Test from "@/Test/Alchemy";
5import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import { MinimumLogLevel } from "effect/References";
9
10const { test } = Test.make({
11 providers: Cloudflare.providers(),
12 state: Cloudflare.state(),
13});
14
15const logLevel = Effect.provideService(
16 MinimumLogLevel,
17 process.env.DEBUG ? "Debug" : "Info",
18);
19
20// The dedicated bookmarks API is deprecated: Cloudflare no longer allows
21// creating NEW bookmark records through it. `POST
22// /accounts/{id}/access/bookmarks/{uuid}` with a fresh UUID fails with HTTP
23// 404 code 11021 "access.api.error.unknown_application" — surfaced as the
24// typed `AccessBookmarkNotFound` error. The resource exists to manage
25// pre-existing legacy records; the lifecycle test is gated behind an
26// account that still has legacy bookmarks enabled, and the probe test
27// always runs and pins the typed tag.
28const entitled = !!process.env.CLOUDFLARE_TEST_ACCESS_BOOKMARKS;
29
30test.provider.skipIf(entitled)(
31 "legacy bookmark creation surfaces the typed AccessBookmarkNotFound error",
32 (stack) =>
33 Effect.gen(function* () {
34 const { accountId } = yield* yield* CloudflareEnvironment;
35 yield* stack.destroy();
36
37 const error = yield* zeroTrust
38 .createAccessBookmark({
39 accountId,
40 bookmarkId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0001",
41 name: "alchemy-access-bookmark-probe",
42 domain: "wiki.alchemy-test-2.us",
43 })
44 .pipe(Effect.flip);
45 expect(error._tag).toEqual("AccessBookmarkNotFound");
46
47 // The list endpoint still works — the legacy API is read-only for
48 // accounts without pre-existing bookmark records.
49 const bookmarks = yield* zeroTrust.listAccessBookmarks({ accountId });
50 expect(Array.isArray(bookmarks.result)).toBe(true);
51 }).pipe(logLevel),
52 {
53 tags: ["provider:cloudflare", "provider:cloudflare:access", "live"],
54 timeout: 120_000,
55 },
56);
57
58test.provider.skipIf(!entitled)(
59 "create, update in place, and destroy bookmark",
60 (stack) =>
61 Effect.gen(function* () {
62 const { accountId } = yield* yield* CloudflareEnvironment;
63
64 yield* stack.destroy();
65
66 const bookmark = yield* stack.deploy(
67 Effect.gen(function* () {
68 return yield* Cloudflare.Access.Bookmark("Wiki", {
69 domain: "wiki.alchemy-test-2.us",
70 });
71 }),
72 );
73
74 expect(bookmark.bookmarkId).toBeDefined();
75 expect(bookmark.accountId).toEqual(accountId);
76 expect(bookmark.domain).toEqual("wiki.alchemy-test-2.us");
77 expect(bookmark.appLauncherVisible).toBe(true);
78
79 const actual = yield* zeroTrust.getAccessBookmark({
80 accountId,
81 bookmarkId: bookmark.bookmarkId,
82 });
83 expect(actual.id).toEqual(bookmark.bookmarkId);
84
85 // Update — domain and visibility converge in place (same id).
86 const updated = yield* stack.deploy(
87 Effect.gen(function* () {
88 return yield* Cloudflare.Access.Bookmark("Wiki", {
89 domain: "docs.alchemy-test-2.us",
90 appLauncherVisible: false,
91 });
92 }),
93 );
94 expect(updated.bookmarkId).toEqual(bookmark.bookmarkId);
95 expect(updated.domain).toEqual("docs.alchemy-test-2.us");
96 expect(updated.appLauncherVisible).toBe(false);
97
98 yield* stack.destroy();
99
100 const afterDestroy = yield* zeroTrust
101 .getAccessBookmark({
102 accountId,
103 bookmarkId: bookmark.bookmarkId,
104 })
105 .pipe(
106 Effect.catchTag("AccessBookmarkNotFound", () =>
107 Effect.succeed(undefined),
108 ),
109 );
110 expect(afterDestroy?.id ?? undefined).toBeUndefined();
111 }).pipe(logLevel),
112 {
113 tags: ["provider:cloudflare", "provider:cloudflare:access", "live"],
114 timeout: 120_000,
115 },
116);
117
118// The legacy bookmarks list endpoint is read-only but available on every
119// account (it returns `[]` when there are no records), so the ungated case
120// always exercises `list()` and asserts it hydrates the `read` shape. The
121// entitled path additionally deploys a bookmark and asserts its presence.
122test.provider(
123 "list enumerates access bookmarks at the account scope",
124 (stack) =>
125 Effect.gen(function* () {
126 yield* stack.destroy();
127
128 const provider = yield* Provider.findProvider(Cloudflare.Access.Bookmark);
129
130 if (!entitled) {
131 const all = yield* provider.list();
132 expect(Array.isArray(all)).toBe(true);
133 for (const b of all) {
134 expect(typeof b.bookmarkId).toBe("string");
135 expect(typeof b.accountId).toBe("string");
136 }
137 return;
138 }
139
140 const deployed = yield* stack.deploy(
141 Effect.gen(function* () {
142 return yield* Cloudflare.Access.Bookmark("ListWiki", {
143 domain: "wiki.alchemy-test-2.us",
144 });
145 }),
146 );
147
148 const all = yield* provider.list();
149 expect(all.some((b) => b.bookmarkId === deployed.bookmarkId)).toBe(true);
150
151 yield* stack.destroy();
152 }).pipe(logLevel),
153 {
154 tags: ["provider:cloudflare", "provider:cloudflare:access", "live"],
155 timeout: 120_000,
156 },
157);