1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import { KEY_RING_ID } from "./common.ts";
4import * as kms from "@distilled.cloud/gcp/cloudkms_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9import { GcpEnvironment } from "@/GCP/Environment";
10
11const { test } = Test.make({ providers: GCP.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18// Cloud KMS KeyRings and ImportJobs cannot be deleted. Reuse constant
19// ids so re-runs observe the existing resources instead of leaking.
20const IMPORT_JOB_ID = "alchemy-test-importjob";
21
22const waitUntilGone = (name: string) =>
23 kms.getProjectsLocationsKeyRingsImportJobs({ name }).pipe(
24 Effect.as("found" as const),
25 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
26 Effect.repeat({
27 schedule: Schedule.spaced("1 second"),
28 until: (status) => status === "gone",
29 times: 10,
30 }),
31 );
32
33test.provider(
34 "getProjectsLocationsKeyRingsImportJobs on a missing job fails with NotFound",
35 () =>
36 Effect.gen(function* () {
37 const { project } = yield* GcpEnvironment.current;
38 const error = yield* Effect.flip(
39 kms.getProjectsLocationsKeyRingsImportJobs({
40 name: `projects/${project}/locations/us-central1/keyRings/${KEY_RING_ID}/importJobs/alchemy-importjob-does-not-exist`,
41 }),
42 );
43 expect(error._tag).toBe("NotFound");
44 }).pipe(logLevel),
45 { tags: ["provider:gcp", "provider:gcp:kms", "live"] },
46);
47
48test.provider(
49 "create and destroy an import job",
50 (stack) =>
51 Effect.gen(function* () {
52 const { project } = yield* GcpEnvironment.current;
53 yield* stack.destroy();
54
55 const created = yield* stack.deploy(
56 Effect.gen(function* () {
57 const ring = yield* GCP.KMS.KeyRing("Keys", {
58 keyRingId: KEY_RING_ID,
59 location: "us-central1",
60 });
61 return yield* GCP.KMS.ImportJob("Wrap", {
62 keyRing: ring.name,
63 importJobId: IMPORT_JOB_ID,
64 importMethod: "RSA_OAEP_3072_SHA256_AES_256",
65 protectionLevel: "SOFTWARE",
66 });
67 }),
68 );
69
70 expect(created.importJobId).toEqual(IMPORT_JOB_ID);
71 expect(created.location).toEqual("us-central1");
72 expect(created.project).toEqual(project);
73 expect(created.keyRing).toContain(`/keyRings/${KEY_RING_ID}`);
74 expect(created.name).toEqual(
75 `projects/${project}/locations/us-central1/keyRings/${KEY_RING_ID}/importJobs/${IMPORT_JOB_ID}`,
76 );
77 expect(created.importMethod).toEqual("RSA_OAEP_3072_SHA256_AES_256");
78 expect(created.protectionLevel).toEqual("SOFTWARE");
79 expect(created.createTime).toEqual(expect.any(String));
80 expect(["ACTIVE", "EXPIRED"]).toContain(created.state);
81 if (created.state === "ACTIVE") {
82 expect(created.publicKeyPem ?? created.publicKeyData).toEqual(
83 expect.any(String),
84 );
85 }
86
87 const fetched = yield* kms.getProjectsLocationsKeyRingsImportJobs({
88 name: created.name,
89 });
90 expect(fetched.name).toEqual(created.name);
91 expect(fetched.importMethod).toEqual("RSA_OAEP_3072_SHA256_AES_256");
92 expect(fetched.protectionLevel).toEqual("SOFTWARE");
93
94 const updated = yield* stack.deploy(
95 Effect.gen(function* () {
96 const ring = yield* GCP.KMS.KeyRing("Keys", {
97 keyRingId: KEY_RING_ID,
98 location: "us-central1",
99 });
100 return yield* GCP.KMS.ImportJob("Wrap", {
101 keyRing: ring.name,
102 importJobId: IMPORT_JOB_ID,
103 importMethod: "RSA_OAEP_3072_SHA256_AES_256",
104 protectionLevel: "SOFTWARE",
105 });
106 }),
107 );
108 expect(updated.name).toEqual(created.name);
109 expect(updated.createTime).toEqual(created.createTime);
110
111 yield* stack.destroy();
112
113 const stillThere = yield* kms
114 .getProjectsLocationsKeyRingsImportJobs({ name: created.name })
115 .pipe(
116 Effect.as("found" as const),
117 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
118 );
119 expect(stillThere).toEqual("found");
120
121 const gone = yield* waitUntilGone(
122 `projects/${project}/locations/us-central1/keyRings/${KEY_RING_ID}/importJobs/alchemy-importjob-does-not-exist`,
123 );
124 expect(gone).toEqual("gone");
125 }).pipe(logLevel),
126 { tags: ["provider:gcp", "provider:gcp:kms", "live"], timeout: 90_000 },
127);