1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import { findZoneByName } from "@/Cloudflare/Zone/lookup";
4import * as Provider from "@/Provider";
5import * as Test from "@/Test/Alchemy";
6import * as acm from "@distilled.cloud/cloudflare/acm";
7import { expect } from "alchemy-test";
8import * as Effect from "effect/Effect";
9import * as FileSystem from "effect/FileSystem";
10import { MinimumLogLevel } from "effect/References";
11import * as Schedule from "effect/Schedule";
12import * as pathe from "pathe";
13
14const { test } = Test.make({ providers: Cloudflare.providers() });
15
16const logLevel = Effect.provideService(
17 MinimumLogLevel,
18 process.env.DEBUG ? "Debug" : "Info",
19);
20
21const zoneName =
22 process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";
23
24// The custom origin trust store requires the Advanced Certificate Manager
25// add-on (~$10/mo per zone). On the standard testing zone every call —
26// including list/get — fails with the typed
27// `AdvancedCertificateManagerRequired` (code 1450) error. The full CRUD
28// lifecycle is gated behind an entitled zone id supplied via env.
29const entitledZoneId = process.env.CLOUDFLARE_TEST_ACM_ZONE_ID;
30
31// Checked-in, deterministic self-signed root CA fixtures (no key material).
32const ROOT_CA_PEM = pathe.resolve(import.meta.dirname, "fixtures/root-ca.pem");
33const ROOT_CA_2_PEM = pathe.resolve(
34 import.meta.dirname,
35 "fixtures/root-ca-2.pem",
36);
37
38const resolveZoneId = Effect.gen(function* () {
39 const { accountId } = yield* yield* CloudflareEnvironment;
40 const zone = yield* findZoneByName({ accountId, name: zoneName });
41 if (!zone) {
42 return yield* Effect.die(
43 new Error(`zone "${zoneName}" not found in account`),
44 );
45 }
46 return zone.id;
47});
48
49// Freshly-minted scoped API tokens propagate eventually-consistently across
50// Cloudflare's edge — ride out intermittent 403s via the typed `Forbidden`
51// tag in each acm operation's error union.
52const forbiddenRetrySchedule = Schedule.exponential("500 millis");
53
54/** Out-of-band read; "gone" (typed) maps to undefined. */
55const getTrustStore = (zoneId: string, id: string) =>
56 acm.getCustomTrustStore({ zoneId, customOriginTrustStoreId: id }).pipe(
57 Effect.map((cert): acm.GetCustomTrustStoreResponse | undefined => cert),
58 Effect.catchTag(
59 ["CustomTrustStoreNotFound", "InvalidObjectIdentifier"],
60 () => Effect.succeed(undefined),
61 ),
62 Effect.retry({
63 while: (e) => e._tag === "Forbidden",
64 schedule: forbiddenRetrySchedule,
65 times: 8,
66 }),
67 );
68
69test.provider(
70 "surfaces the typed AdvancedCertificateManagerRequired error on unentitled zones",
71 (stack) =>
72 Effect.gen(function* () {
73 const zoneId = yield* resolveZoneId;
74 const fs = yield* FileSystem.FileSystem;
75 const certificate = yield* fs.readFileString(ROOT_CA_PEM);
76
77 yield* stack.destroy();
78
79 // The standard testing zone lacks the ACM add-on — uploading a trust
80 // store certificate must fail with the typed entitlement tag (1450).
81 const error = yield* acm
82 .createCustomTrustStore({ zoneId, certificate })
83 .pipe(
84 Effect.retry({
85 while: (e) => e._tag === "Forbidden",
86 schedule: forbiddenRetrySchedule,
87 times: 8,
88 }),
89 Effect.flip,
90 );
91 expect(error._tag).toEqual("AdvancedCertificateManagerRequired");
92
93 yield* stack.destroy();
94 }).pipe(logLevel),
95 {
96 tags: [
97 "provider:cloudflare",
98 "provider:cloudflare:acm",
99 "provider:cloudflare:zone",
100 "live",
101 ],
102 },
103);
104
105// Canonical `list()` test (zone-scoped collection): `list()` enumerates
106// every zone via `listAllZones` and lists the trust store certificates in
107// each, paginating exhaustively. Zones lacking the ACM add-on reject the
108// route with the typed `AdvancedCertificateManagerRequired` tag, which
109// `list()` skips. On a standard testing account (no entitled zones) the
110// result is empty — assert the enumeration itself succeeds (an array) and
111// surfaces no untyped errors.
112test.provider(
113 "list enumerates trust store certificates across zones",
114 (stack) =>
115 Effect.gen(function* () {
116 yield* stack.destroy();
117
118 const provider = yield* Provider.findProvider(
119 Cloudflare.Acm.CustomTrustStore,
120 );
121 const all = yield* provider.list();
122
123 expect(Array.isArray(all)).toBe(true);
124
125 yield* stack.destroy();
126 }).pipe(logLevel),
127 { tags: ["provider:cloudflare", "provider:cloudflare:acm", "live"] },
128);
129
130// On an entitled zone, `list()` must contain the deployed certificate.
131test.provider.skipIf(!entitledZoneId)(
132 "list includes the deployed trust store certificate on an entitled zone",
133 (stack) =>
134 Effect.gen(function* () {
135 const zoneId = entitledZoneId!;
136 const fs = yield* FileSystem.FileSystem;
137 const certificate = yield* fs.readFileString(ROOT_CA_PEM);
138
139 yield* stack.destroy();
140
141 const created = yield* stack.deploy(
142 Effect.gen(function* () {
143 return yield* Cloudflare.Acm.CustomTrustStore("RootCa", {
144 zoneId,
145 certificate,
146 });
147 }),
148 );
149
150 const provider = yield* Provider.findProvider(
151 Cloudflare.Acm.CustomTrustStore,
152 );
153 const all = yield* provider.list();
154
155 expect(all.some((c) => c.id === created.id && c.zoneId === zoneId)).toBe(
156 true,
157 );
158
159 yield* stack.destroy();
160 }).pipe(logLevel),
161 {
162 tags: ["provider:cloudflare", "provider:cloudflare:acm", "live"],
163 timeout: 120_000,
164 },
165);
166
167test.provider.skipIf(!entitledZoneId)(
168 "uploads a root CA, replaces it on certificate change, and deletes it",
169 (stack) =>
170 Effect.gen(function* () {
171 const zoneId = entitledZoneId!;
172 const fs = yield* FileSystem.FileSystem;
173 const certificate = yield* fs.readFileString(ROOT_CA_PEM);
174 const certificate2 = yield* fs.readFileString(ROOT_CA_2_PEM);
175
176 yield* stack.destroy();
177
178 // Create.
179 const created = yield* stack.deploy(
180 Effect.gen(function* () {
181 return yield* Cloudflare.Acm.CustomTrustStore("RootCa", {
182 zoneId,
183 certificate,
184 });
185 }),
186 );
187 expect(created.zoneId).toEqual(zoneId);
188 expect(created.id).toBeTruthy();
189 expect(created.issuer).toContain("Alchemy ACM Test Root CA 1");
190
191 // Out-of-band verification.
192 const live = yield* getTrustStore(zoneId, created.id);
193 expect(live).toBeDefined();
194
195 // Changing the certificate replaces the resource — there is no
196 // update API, so a new certificate id must be issued.
197 const replaced = yield* stack.deploy(
198 Effect.gen(function* () {
199 return yield* Cloudflare.Acm.CustomTrustStore("RootCa", {
200 zoneId,
201 certificate: certificate2,
202 });
203 }),
204 );
205 expect(replaced.id).not.toEqual(created.id);
206 expect(replaced.issuer).toContain("Alchemy ACM Test Root CA 2");
207
208 // Destroy, then wait until the certificate is actually gone
209 // (deletion is async: pending_deletion -> deleted).
210 yield* stack.destroy();
211 const gone = yield* getTrustStore(zoneId, replaced.id).pipe(
212 Effect.repeat({
213 schedule: Schedule.spaced("2 seconds"),
214 until: (cert) =>
215 cert === undefined ||
216 cert.status === "pending_deletion" ||
217 cert.status === "deleted",
218 times: 30,
219 }),
220 );
221 expect(
222 gone === undefined ||
223 gone.status === "pending_deletion" ||
224 gone.status === "deleted",
225 ).toBe(true);
226 }).pipe(logLevel),
227 {
228 tags: ["provider:cloudflare", "provider:cloudflare:acm", "live"],
229 timeout: 120_000,
230 },
231);