1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import * as Provider from "@/Provider";
4import * as Test from "@/Test/Alchemy";
5import * as customNameservers from "@distilled.cloud/cloudflare/custom-nameservers";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import { MinimumLogLevel } from "effect/References";
9import * as Schedule from "effect/Schedule";
10
11const { test } = Test.make({ providers: Cloudflare.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18const zoneName =
19 process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";
20
21// Account custom nameservers require a Business/Enterprise plan (or paid
22// add-on). On the testing account every call — even the list — fails with
23// Cloudflare code 1002 "This feature is not enabled for your account.",
24// surfaced as the typed `CustomNameserversNotEnabled` error. The full
25// lifecycle test below is gated behind an env flag for entitled accounts.
26const entitled = !!process.env.CLOUDFLARE_TEST_CUSTOM_NS_ENTITLED;
27
28// The scoped API token the test harness mints propagates eventually-
29// consistently across Cloudflare's edge — ride out generic 403 blips
30// (`Forbidden`) on out-of-band verification calls. The entitlement
31// failure is a *different* typed tag (`CustomNameserversNotEnabled`),
32// so this retry never loops on it.
33const listNameservers = (accountId: string) =>
34 customNameservers.getCustomNameserver({ accountId }).pipe(
35 Effect.retry({
36 while: (e) => e._tag === "Forbidden",
37 schedule: Schedule.exponential("500 millis"),
38 times: 8,
39 }),
40 );
41
42const findByName = (accountId: string, nsName: string) =>
43 listNameservers(accountId).pipe(
44 Effect.map((page) => page.result.find((ns) => ns.nsName === nsName)),
45 );
46
47const expectGone = (accountId: string, nsName: string) =>
48 findByName(accountId, nsName).pipe(
49 Effect.flatMap((found) =>
50 found
51 ? Effect.fail({ _tag: "CustomNameserverNotDeleted" } as const)
52 : Effect.void,
53 ),
54 Effect.retry({
55 while: (e) => e._tag === "CustomNameserverNotDeleted",
56 schedule: Schedule.max([
57 Schedule.exponential("500 millis"),
58 Schedule.recurs(10),
59 ]),
60 }),
61 );
62
63test.provider(
64 "surfaces the typed CustomNameserversNotEnabled error on unentitled accounts",
65 (stack) =>
66 Effect.gen(function* () {
67 const { accountId } = yield* yield* CloudflareEnvironment;
68
69 yield* stack.destroy();
70
71 // The testing account lacks the account custom nameservers
72 // entitlement — the distilled list call must fail with the typed
73 // entitlement tag (not the generic 403 catch-all).
74 const error = yield* listNameservers(accountId).pipe(Effect.flip);
75 expect(error._tag).toEqual("CustomNameserversNotEnabled");
76
77 yield* stack.destroy();
78 }).pipe(logLevel),
79 {
80 tags: [
81 "provider:cloudflare",
82 "provider:cloudflare:customnameserver",
83 "live",
84 ],
85 },
86);
87
88// Canonical `list()` test (account collection). On the unentitled testing
89// account the collection endpoint rejects with `CustomNameserversNotEnabled`,
90// which `list()` maps to an empty collection — so the read-only assertion is
91// "list returns a well-typed array" (here, `[]`). An entitled account also
92// runs the deploy+presence variant below.
93test.provider(
94 "list enumerates account custom nameservers",
95 (stack) =>
96 Effect.gen(function* () {
97 yield* stack.destroy();
98
99 const provider = yield* Provider.findProvider(
100 Cloudflare.CustomNameserver.CustomNameserver,
101 );
102 const all = yield* provider.list();
103
104 // Always a well-typed array; `[]` on unentitled accounts.
105 expect(Array.isArray(all)).toBe(true);
106 if (!entitled) {
107 expect(all).toEqual([]);
108 }
109
110 yield* stack.destroy();
111 }).pipe(logLevel),
112 {
113 tags: [
114 "provider:cloudflare",
115 "provider:cloudflare:customnameserver",
116 "live",
117 ],
118 },
119);
120
121test.provider.skipIf(!entitled)(
122 "list includes a deployed custom nameserver",
123 (stack) =>
124 Effect.gen(function* () {
125 const nsName = `alchemy-ns-list.${zoneName}`;
126
127 yield* stack.destroy();
128
129 const ns = yield* stack.deploy(
130 Cloudflare.CustomNameserver.CustomNameserver("NsList", { nsName }),
131 );
132
133 const provider = yield* Provider.findProvider(
134 Cloudflare.CustomNameserver.CustomNameserver,
135 );
136 const all = yield* provider.list();
137 expect(all.some((x) => x.nsName === ns.nsName)).toBe(true);
138
139 yield* stack.destroy();
140 }).pipe(logLevel),
141 {
142 tags: [
143 "provider:cloudflare",
144 "provider:cloudflare:customnameserver",
145 "live",
146 ],
147 timeout: 120_000,
148 },
149);
150
151test.provider.skipIf(!entitled)(
152 "create, replace on nsSet change, and destroy a custom nameserver",
153 (stack) =>
154 Effect.gen(function* () {
155 const { accountId } = yield* yield* CloudflareEnvironment;
156 const nsName = `alchemy-ns1.${zoneName}`;
157
158 yield* stack.destroy();
159
160 // Create on the default set.
161 const ns = yield* stack.deploy(
162 Cloudflare.CustomNameserver.CustomNameserver("Ns", { nsName }),
163 );
164 expect(ns.nsName).toEqual(nsName);
165 expect(ns.accountId).toEqual(accountId);
166 expect(ns.zoneTag).toBeTruthy();
167 expect(ns.dnsRecords).toBeDefined();
168
169 // Out-of-band verification via the distilled API.
170 const live = yield* findByName(accountId, nsName);
171 expect(live?.nsName).toEqual(nsName);
172
173 // Redeploying identical props is a no-op (reconcile observes the
174 // existing nameserver and converges without an API write).
175 const noop = yield* stack.deploy(
176 Cloudflare.CustomNameserver.CustomNameserver("Ns", { nsName }),
177 );
178 expect(noop.nsName).toEqual(nsName);
179 expect(noop.zoneTag).toEqual(ns.zoneTag);
180
181 // nsSet is immutable — changing it must replace the nameserver.
182 const replaced = yield* stack.deploy(
183 Cloudflare.CustomNameserver.CustomNameserver("Ns", {
184 nsName,
185 nsSet: 2,
186 }),
187 );
188 expect(replaced.nsName).toEqual(nsName);
189 expect(replaced.nsSet).toEqual(2);
190
191 yield* stack.destroy();
192
193 // The nameserver is gone; a second destroy is a no-op.
194 yield* expectGone(accountId, nsName);
195 yield* stack.destroy();
196 }).pipe(logLevel),
197 {
198 tags: [
199 "provider:cloudflare",
200 "provider:cloudflare:customnameserver",
201 "live",
202 ],
203 timeout: 120_000,
204 },
205);