1import * as Cloudflare from "@/Cloudflare";
2import * as Provider from "@/Provider";
3import * as Test from "@/Test/Alchemy";
4import * as ddos from "@distilled.cloud/cloudflare/ddos-protection";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8
9const { test } = Test.make({ providers: Cloudflare.providers() });
10
11const logLevel = Effect.provideService(
12 MinimumLogLevel,
13 process.env.DEBUG ? "Debug" : "Info",
14);
15
16// Advanced TCP Protection is a Magic Transit (Enterprise add-on)
17// entitlement that the testing account does not have — every API call fails
18// with the typed `AdvancedTcpProtectionNotEntitled` error (Cloudflare code
19// 8888; asserted in AllowlistEntry.test.ts). The lifecycle suite is gated
20// behind an opt-in env var for entitled accounts.
21const magicTransit = process.env.CLOUDFLARE_TEST_MAGIC_TRANSIT;
22
23const accountId = Effect.gen(function* () {
24 const { accountId } = yield* yield* Cloudflare.CloudflareEnvironment;
25 return accountId;
26});
27
28test.provider.skipIf(!magicTransit)(
29 "creates a global TCP flow protection rule, updates it in place, and destroys",
30 (stack) =>
31 Effect.gen(function* () {
32 const acct = yield* accountId;
33
34 yield* stack.destroy();
35
36 // Create.
37 const rule = yield* stack.deploy(
38 Effect.gen(function* () {
39 return yield* Cloudflare.DdosProtection.TcpFlowProtectionRule(
40 "Rule",
41 {
42 scope: "global",
43 mode: "monitoring",
44 burstSensitivity: "medium",
45 rateSensitivity: "medium",
46 },
47 );
48 }),
49 );
50 expect(rule.scope).toEqual("global");
51 expect(rule.name).toEqual("global");
52 expect(rule.mode).toEqual("monitoring");
53
54 // Out-of-band verification via the distilled API.
55 const live =
56 yield* ddos.getAdvancedTcpProtectionTcpFlowProtectionRuleItem({
57 accountId: acct,
58 ruleId: rule.ruleId,
59 });
60 expect(live.mode).toEqual("monitoring");
61 expect(live.rateSensitivity).toEqual("medium");
62
63 // In-place update — mode and sensitivities are patched, id is stable.
64 const updated = yield* stack.deploy(
65 Effect.gen(function* () {
66 return yield* Cloudflare.DdosProtection.TcpFlowProtectionRule(
67 "Rule",
68 {
69 scope: "global",
70 mode: "disabled",
71 burstSensitivity: "low",
72 rateSensitivity: "high",
73 },
74 );
75 }),
76 );
77 expect(updated.ruleId).toEqual(rule.ruleId);
78 expect(updated.mode).toEqual("disabled");
79 expect(updated.burstSensitivity).toEqual("low");
80 expect(updated.rateSensitivity).toEqual("high");
81
82 yield* stack.destroy();
83
84 // Gone — the typed TcpFlowProtectionRuleNotFound error proves deletion.
85 const error = yield* ddos
86 .getAdvancedTcpProtectionTcpFlowProtectionRuleItem({
87 accountId: acct,
88 ruleId: rule.ruleId,
89 })
90 .pipe(Effect.flip);
91 expect(error._tag).toEqual("TcpFlowProtectionRuleNotFound");
92 }).pipe(logLevel),
93 {
94 tags: ["provider:cloudflare", "provider:cloudflare:ddosprotection", "live"],
95 timeout: 120_000,
96 },
97);
98
99// Account-scoped collection `list()` (pattern (b)): enumerate every TCP flow
100// protection rule under the ambient account. On accounts without the Magic
101// Transit / Advanced TCP Protection entitlement the enumeration API rejects
102// with the typed `AdvancedTcpProtectionNotEntitled` error (Cloudflare code
103// 8888), which `list()` maps to a well-typed empty array — assert that here,
104// ungated.
105test.provider(
106 "list returns a well-typed empty array without Magic Transit",
107 (stack) =>
108 Effect.gen(function* () {
109 if (magicTransit) return;
110
111 yield* stack.destroy();
112
113 const provider = yield* Provider.findProvider(
114 Cloudflare.DdosProtection.TcpFlowProtectionRule,
115 );
116 const all = yield* provider.list();
117
118 expect(Array.isArray(all)).toBe(true);
119 expect(all).toEqual([]);
120
121 yield* stack.destroy();
122 }).pipe(logLevel),
123 {
124 tags: ["provider:cloudflare", "provider:cloudflare:ddosprotection", "live"],
125 },
126);
127
128// Entitled accounts (CLOUDFLARE_TEST_MAGIC_TRANSIT set): deploy a rule and
129// assert it appears in the exhaustively-paginated `list()` result, carrying
130// the exact `read` Attributes shape.
131test.provider.skipIf(!magicTransit)(
132 "list enumerates the deployed TCP flow protection rule",
133 (stack) =>
134 Effect.gen(function* () {
135 yield* stack.destroy();
136
137 const deployed = yield* stack.deploy(
138 Effect.gen(function* () {
139 return yield* Cloudflare.DdosProtection.TcpFlowProtectionRule(
140 "ListRule",
141 {
142 scope: "global",
143 mode: "monitoring",
144 burstSensitivity: "medium",
145 rateSensitivity: "medium",
146 },
147 );
148 }),
149 );
150
151 const provider = yield* Provider.findProvider(
152 Cloudflare.DdosProtection.TcpFlowProtectionRule,
153 );
154 const all = yield* provider.list();
155
156 expect(all.some((x) => x.ruleId === deployed.ruleId)).toBe(true);
157 const found = all.find((x) => x.ruleId === deployed.ruleId)!;
158 expect(found.scope).toEqual("global");
159 expect(found.name).toEqual("global");
160
161 yield* stack.destroy();
162 }).pipe(logLevel),
163 {
164 tags: ["provider:cloudflare", "provider:cloudflare:ddosprotection", "live"],
165 timeout: 120_000,
166 },
167);