1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import * as Provider from "@/Provider";
4import * as Test from "@/Test/Alchemy";
5import * as calls from "@distilled.cloud/cloudflare/calls";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import * as Redacted from "effect/Redacted";
9import { MinimumLogLevel } from "effect/References";
10import * as Schedule from "effect/Schedule";
11
12const { test } = Test.make({ providers: Cloudflare.providers() });
13
14const logLevel = Effect.provideService(
15 MinimumLogLevel,
16 process.env.DEBUG ? "Debug" : "Info",
17);
18
19// The scoped API token the test harness mints propagates eventually-
20// consistently across Cloudflare's edge — ride out 403 blips
21// (`Forbidden`, declared in the distilled error union) on the test's
22// own out-of-band verification calls.
23const getTurnKey = (accountId: string, keyId: string) =>
24 calls.getTurn({ accountId, keyId }).pipe(
25 Effect.retry({
26 while: (e) => e._tag === "Forbidden",
27 schedule: Schedule.exponential("500 millis"),
28 times: 8,
29 }),
30 );
31
32const expectGone = (accountId: string, keyId: string) =>
33 getTurnKey(accountId, keyId).pipe(
34 Effect.flatMap(() => Effect.fail({ _tag: "TurnKeyNotDeleted" } as const)),
35 // A missing TURN key surfaces as `TurnKeyNotFound` (Cloudflare error
36 // code 20008) — that's the success condition here.
37 Effect.catchTag("TurnKeyNotFound", () => Effect.void),
38 Effect.retry({
39 while: (e) => e._tag === "TurnKeyNotDeleted",
40 schedule: Schedule.max([
41 Schedule.exponential("500 millis"),
42 Schedule.recurs(10),
43 ]),
44 }),
45 );
46
47test.provider(
48 "create and delete a TURN key with default name",
49 (stack) =>
50 Effect.gen(function* () {
51 const { accountId } = yield* yield* CloudflareEnvironment;
52
53 yield* stack.destroy();
54
55 const turnKey = yield* stack.deploy(
56 Cloudflare.Calls.TurnKey("DefaultTurnKey", {}),
57 );
58
59 expect(turnKey.keyId).toBeTruthy();
60 expect(Redacted.value(turnKey.key)).toBeTruthy();
61 expect(turnKey.accountId).toEqual(accountId);
62 expect(turnKey.name).toBeTruthy();
63
64 const live = yield* getTurnKey(accountId, turnKey.keyId);
65 expect(live.uid).toEqual(turnKey.keyId);
66 expect(live.name).toEqual(turnKey.name);
67
68 yield* stack.destroy();
69
70 yield* expectGone(accountId, turnKey.keyId);
71 }).pipe(logLevel),
72 { tags: ["provider:cloudflare", "provider:cloudflare:calls", "live"] },
73);
74
75test.provider(
76 "update name in place (same keyId, key preserved)",
77 (stack) =>
78 Effect.gen(function* () {
79 const { accountId } = yield* yield* CloudflareEnvironment;
80
81 yield* stack.destroy();
82
83 const initial = yield* stack.deploy(
84 Cloudflare.Calls.TurnKey("UpdateTurnKey", {
85 name: "alchemy-calls-turn-update",
86 }),
87 );
88
89 expect(initial.name).toEqual("alchemy-calls-turn-update");
90 const initialKey = Redacted.value(initial.key);
91 expect(initialKey).toBeTruthy();
92
93 const updated = yield* stack.deploy(
94 Cloudflare.Calls.TurnKey("UpdateTurnKey", {
95 name: "alchemy-calls-turn-update-v2",
96 }),
97 );
98
99 // Same TURN key mutated in place — not a replacement — and the
100 // create-only key is carried forward across the update.
101 expect(updated.keyId).toEqual(initial.keyId);
102 expect(updated.name).toEqual("alchemy-calls-turn-update-v2");
103 expect(Redacted.value(updated.key)).toEqual(initialKey);
104
105 const live = yield* getTurnKey(accountId, updated.keyId);
106 expect(live.name).toEqual("alchemy-calls-turn-update-v2");
107
108 // Redeploying identical props is a no-op (still the same key).
109 const noop = yield* stack.deploy(
110 Cloudflare.Calls.TurnKey("UpdateTurnKey", {
111 name: "alchemy-calls-turn-update-v2",
112 }),
113 );
114 expect(noop.keyId).toEqual(initial.keyId);
115 expect(Redacted.value(noop.key)).toEqual(initialKey);
116
117 yield* stack.destroy();
118
119 yield* expectGone(accountId, initial.keyId);
120 }).pipe(logLevel),
121 { tags: ["provider:cloudflare", "provider:cloudflare:calls", "live"] },
122);
123
124test.provider(
125 "recreates after out-of-band delete",
126 (stack) =>
127 Effect.gen(function* () {
128 const { accountId } = yield* yield* CloudflareEnvironment;
129
130 yield* stack.destroy();
131
132 const turnKey = yield* stack.deploy(
133 Cloudflare.Calls.TurnKey("HealTurnKey", {
134 name: "alchemy-calls-turn-heal",
135 }),
136 );
137
138 // Delete the TURN key out-of-band. A redeploy with identical props is
139 // a planner no-op, so change a prop to force reconcile — it must
140 // observe the key as missing and recreate it instead of failing on
141 // the 20008.
142 yield* calls.deleteTurn({ accountId, keyId: turnKey.keyId }).pipe(
143 Effect.retry({
144 while: (e) => e._tag === "Forbidden",
145 schedule: Schedule.exponential("500 millis"),
146 times: 8,
147 }),
148 );
149
150 const healed = yield* stack.deploy(
151 Cloudflare.Calls.TurnKey("HealTurnKey", {
152 name: "alchemy-calls-turn-heal-v2",
153 }),
154 );
155
156 expect(healed.keyId).not.toEqual(turnKey.keyId);
157 expect(Redacted.value(healed.key)).toBeTruthy();
158 expect(Redacted.value(healed.key)).not.toEqual(
159 Redacted.value(turnKey.key),
160 );
161 const live = yield* getTurnKey(accountId, healed.keyId);
162 expect(live.name).toEqual("alchemy-calls-turn-heal-v2");
163
164 yield* stack.destroy();
165
166 yield* expectGone(accountId, healed.keyId);
167 }).pipe(logLevel),
168 { tags: ["provider:cloudflare", "provider:cloudflare:calls", "live"] },
169);
170
171// Canonical `list()` test (account collection): deploy a TURN key, then
172// enumerate every TURN key in the account via the provider's `list()` and
173// assert the deployed key is present in the exhaustively-paginated result.
174test.provider(
175 "list enumerates the deployed TURN key",
176 (stack) =>
177 Effect.gen(function* () {
178 yield* stack.destroy();
179
180 const deployed = yield* stack.deploy(
181 Cloudflare.Calls.TurnKey("ListTurnKey", {
182 name: "alchemy-calls-turn-list",
183 }),
184 );
185
186 const provider = yield* Provider.findProvider(Cloudflare.Calls.TurnKey);
187 const all = yield* provider.list();
188
189 expect(all.some((x) => x.keyId === deployed.keyId)).toBe(true);
190
191 yield* stack.destroy();
192 }).pipe(logLevel),
193 { tags: ["provider:cloudflare", "provider:cloudflare:calls", "live"] },
194);