1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import * as Provider from "@/Provider";
4import * as Test from "@/Test/Alchemy";
5import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import { MinimumLogLevel } from "effect/References";
9
10const { test } = Test.make({
11 providers: Cloudflare.providers(),
12 state: Cloudflare.state(),
13});
14
15const logLevel = Effect.provideService(
16 MinimumLogLevel,
17 process.env.DEBUG ? "Debug" : "Info",
18);
19
20test.provider(
21 "pins the rotation interval, updates in place, and restores on destroy",
22 (stack) =>
23 Effect.gen(function* () {
24 const { accountId } = yield* yield* CloudflareEnvironment;
25
26 yield* stack.destroy();
27
28 // Known baseline so each run starts from the same cloud state
29 // regardless of what a previous (possibly interrupted) run left.
30 yield* zeroTrust.putAccessKey({
31 accountId,
32 keyRotationIntervalDays: 90,
33 });
34
35 const keys = yield* stack.deploy(
36 Effect.gen(function* () {
37 return yield* Cloudflare.Access.KeyConfiguration("Keys", {
38 keyRotationIntervalDays: 45,
39 });
40 }),
41 );
42
43 expect(keys.accountId).toEqual(accountId);
44 expect(keys.keyRotationIntervalDays).toEqual(45);
45 // The pre-management interval was captured for restore-on-destroy.
46 expect(keys.initialKeyRotationIntervalDays).toEqual(90);
47
48 const live = yield* zeroTrust.getAccessKey({ accountId });
49 expect(live.keyRotationIntervalDays).toEqual(45);
50
51 // Update — the singleton converges in place and the captured
52 // initial interval survives the update.
53 const updated = yield* stack.deploy(
54 Effect.gen(function* () {
55 return yield* Cloudflare.Access.KeyConfiguration("Keys", {
56 keyRotationIntervalDays: 60,
57 });
58 }),
59 );
60 expect(updated.keyRotationIntervalDays).toEqual(60);
61 expect(updated.initialKeyRotationIntervalDays).toEqual(90);
62
63 const liveUpdated = yield* zeroTrust.getAccessKey({ accountId });
64 expect(liveUpdated.keyRotationIntervalDays).toEqual(60);
65
66 yield* stack.destroy();
67
68 // Destroy restored the interval the account had before management.
69 const restored = yield* zeroTrust.getAccessKey({ accountId });
70 expect(restored.keyRotationIntervalDays).toEqual(90);
71 }).pipe(logLevel),
72 {
73 tags: ["provider:cloudflare", "provider:cloudflare:access", "live"],
74 timeout: 90_000,
75 },
76);
77
78// Canonical `list()` test (per-account singleton): the key configuration
79// always exists with a Cloudflare default and there is no enumeration API,
80// so `list()` reads the single instance and returns it as a one-element
81// array. Assert exactly one well-typed item scoped to the account.
82test.provider(
83 "list returns the account key configuration singleton",
84 () =>
85 Effect.gen(function* () {
86 const { accountId } = yield* yield* CloudflareEnvironment;
87
88 const provider = yield* Provider.findProvider(
89 Cloudflare.Access.KeyConfiguration,
90 );
91 const all = yield* provider.list();
92
93 expect(all.length).toBe(1);
94 expect(all[0]!.accountId).toEqual(accountId);
95 }).pipe(logLevel),
96 {
97 tags: ["provider:cloudflare", "provider:cloudflare:access", "live"],
98 timeout: 90_000,
99 },
100);