1import { GcpEnvironment } from "@/GCP/Environment";
2import * as GCP from "@/GCP";
3import * as Test from "@/Test/Alchemy";
4import * as apigee from "@distilled.cloud/gcp/apigee_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17// Needs a provisioned Apigee organization on the testing project (paid, or
18// ~1h eval provisioning); without one calls fail with ApigeeResourceNotFound (403 "Permission
19// denied on resource \"organizations/{project}\" (or it may not exist)").
20// Set GCP_TEST_APIGEE_ORG=1 when the org exists.
21const runLifecycle = !!process.env.GCP_TEST_APIGEE_ORG;
22
23const waitUntilGone = (name: string) =>
24 apigee.getOrganizationsSecurityFeedback({ name }).pipe(
25 Effect.as("found" as const),
26 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
27 Effect.catchTag("ApigeeResourceNotFound", () =>
28 Effect.succeed("gone" as const),
29 ),
30 Effect.repeat({
31 schedule: Schedule.spaced("1 second"),
32 until: (status) => status === "gone",
33 times: 10,
34 }),
35 );
36
37test.provider(
38 "getOrganizationsSecurityFeedback on a missing report fails with ApigeeResourceNotFound",
39 (stack) =>
40 Effect.gen(function* () {
41 const { project } = yield* GcpEnvironment.current;
42 const org = `organizations/${project}`;
43
44 yield* stack.destroy();
45
46 const error = yield* Effect.flip(
47 apigee.getOrganizationsSecurityFeedback({
48 name: `${org}/securityFeedback/alchemy-missing`,
49 }),
50 );
51 expect(error._tag).toEqual("ApigeeResourceNotFound");
52
53 yield* stack.destroy();
54 }).pipe(logLevel),
55 { tags: ["provider:gcp", "provider:gcp:apigee", "live"], timeout: 90_000 },
56);
57
58test.provider.skipIf(!runLifecycle)(
59 "create, update, and delete a security feedback report",
60 (stack) =>
61 Effect.gen(function* () {
62 yield* stack.destroy();
63
64 const created = yield* stack.deploy(
65 Effect.gen(function* () {
66 return yield* GCP.Apigee.SecurityFeedback("PenTest", {
67 displayName: "pen test",
68 reason: "PENETRATION_TEST",
69 comment: "exclude detections",
70 feedbackContexts: [
71 {
72 attribute: "ATTRIBUTE_ENVIRONMENTS",
73 values: ["eval"],
74 },
75 ],
76 });
77 }),
78 );
79
80 expect(created.securityFeedbackId).toEqual(expect.any(String));
81 expect(created.displayName).toEqual("pen test");
82 expect(created.comment).toEqual("exclude detections");
83
84 const fetched = yield* apigee.getOrganizationsSecurityFeedback({
85 name: created.name,
86 });
87 expect(fetched.comment).toContain("alchemy-id=");
88 expect(fetched.comment).toContain("exclude detections");
89
90 const updated = yield* stack.deploy(
91 Effect.gen(function* () {
92 return yield* GCP.Apigee.SecurityFeedback("PenTest", {
93 securityFeedbackId: created.securityFeedbackId,
94 displayName: "pen test updated",
95 reason: "PENETRATION_TEST",
96 comment: "updated exclusion",
97 feedbackContexts: [
98 {
99 attribute: "ATTRIBUTE_ENVIRONMENTS",
100 values: ["eval"],
101 },
102 ],
103 });
104 }),
105 );
106
107 expect(updated.name).toEqual(created.name);
108 expect(updated.displayName).toEqual("pen test updated");
109 expect(updated.comment).toEqual("updated exclusion");
110
111 yield* stack.destroy();
112
113 const gone = yield* waitUntilGone(created.name);
114 expect(gone).toEqual("gone");
115 }).pipe(logLevel),
116 { tags: ["provider:gcp", "provider:gcp:apigee", "live"], timeout: 90_000 },
117);