1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as networksecurity from "@distilled.cloud/gcp/networksecurity_v1";
4import * as resourcemanager from "@distilled.cloud/gcp/cloudresourcemanager_v3";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9import { GcpEnvironment } from "@/GCP/Environment";
10
11const { test } = Test.make({ providers: GCP.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18const waitUntilGone = (name: string) =>
19 networksecurity.getOrganizationsLocationsSecurityProfiles({ name }).pipe(
20 Effect.as("found" as const),
21 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
22 Effect.repeat({
23 schedule: Schedule.spaced("1 second"),
24 until: (status) => status === "gone",
25 times: 10,
26 }),
27 );
28
29test.provider(
30 "getOrganizationsLocationsSecurityProfiles on a missing profile fails with NotFound (Forbidden without org IAM)",
31 (stack) =>
32 Effect.gen(function* () {
33 const { project } = yield* GcpEnvironment.current;
34 yield* stack.destroy();
35
36 const resource = yield* resourcemanager.getProjects({
37 name: `projects/${project}`,
38 });
39 const parent = resource.parent ?? "organizations/0";
40 const organization = parent.startsWith("organizations/")
41 ? parent.slice("organizations/".length)
42 : "0";
43 const error = yield* Effect.flip(
44 networksecurity.getOrganizationsLocationsSecurityProfiles({
45 name: `organizations/${organization}/locations/global/securityProfiles/alchemy-missing-secprofile`,
46 }),
47 );
48 expect(error._tag).toEqual(
49 process.env.GCP_TEST_ORG_NETWORKSECURITY ? "NotFound" : "Forbidden",
50 );
51
52 yield* stack.destroy();
53 }).pipe(logLevel),
54 {
55 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
56 timeout: 90_000,
57 },
58);
59
60// The testing credentials lack org-level Network Security IAM (Forbidden:
61// "Permission 'networksecurity.….get' denied on 'organizations/…'"). Set
62// GCP_TEST_ORG_NETWORKSECURITY=1 when they administer the organization.
63test.provider.skipIf(!!process.env.GCP_TEST_ORG_NETWORKSECURITY)(
64 "createOrganizationsLocationsSecurityProfiles without org IAM fails with Forbidden",
65 (stack) =>
66 Effect.gen(function* () {
67 const { project } = yield* GcpEnvironment.current;
68 yield* stack.destroy();
69
70 const resource = yield* resourcemanager.getProjects({
71 name: `projects/${project}`,
72 });
73 const parent = resource.parent ?? "organizations/0";
74 const organization = parent.startsWith("organizations/")
75 ? parent.slice("organizations/".length)
76 : "0";
77 const error = yield* Effect.flip(
78 networksecurity.createOrganizationsLocationsSecurityProfiles({
79 parent: `organizations/${organization}/locations/global`,
80 securityProfileId: "alchemy-org-secprofile-probe",
81 body: { type: "THREAT_PREVENTION", threatPreventionProfile: {} },
82 }),
83 );
84 expect(error._tag).toBe("Forbidden");
85
86 yield* stack.destroy();
87 }).pipe(logLevel),
88 {
89 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
90 timeout: 90_000,
91 },
92);
93
94test.provider.skipIf(
95 !!process.env.FAST || !process.env.GCP_TEST_ORG_NETWORKSECURITY,
96)(
97 "create, update, and delete an organization security profile",
98 (stack) =>
99 Effect.gen(function* () {
100 yield* stack.destroy();
101
102 const created = yield* stack.deploy(
103 Effect.gen(function* () {
104 return yield* GCP.NetworkSecurity.OrganizationsSecurityProfile(
105 "Threats",
106 {
107 type: "THREAT_PREVENTION",
108 threatPreventionProfile: {
109 severityOverrides: [
110 { severity: "INFORMATIONAL", action: "ALERT" },
111 ],
112 },
113 description: "profile a",
114 labels: { env: "test" },
115 },
116 );
117 }),
118 );
119
120 expect(created.name).toContain("/securityProfiles/");
121 expect(created.name).toContain("organizations/");
122 expect(created.type).toEqual("THREAT_PREVENTION");
123 expect(created.labels).toMatchObject({ env: "test" });
124
125 const fetched =
126 yield* networksecurity.getOrganizationsLocationsSecurityProfiles({
127 name: created.name,
128 });
129 expect(fetched.name).toEqual(created.name);
130 expect(fetched.labels?.env).toEqual("test");
131
132 const updated = yield* stack.deploy(
133 Effect.gen(function* () {
134 return yield* GCP.NetworkSecurity.OrganizationsSecurityProfile(
135 "Threats",
136 {
137 securityProfileId: created.securityProfileId,
138 organization: created.organization,
139 type: "THREAT_PREVENTION",
140 threatPreventionProfile: {
141 severityOverrides: [
142 { severity: "INFORMATIONAL", action: "ALERT" },
143 { severity: "HIGH", action: "DENY" },
144 ],
145 },
146 description: "profile b",
147 labels: { env: "prod", role: "ngfw" },
148 },
149 );
150 }),
151 );
152
153 expect(updated.name).toEqual(created.name);
154 expect(updated.description).toEqual("profile b");
155 expect(updated.labels).toMatchObject({ env: "prod", role: "ngfw" });
156
157 yield* stack.destroy();
158
159 const gone = yield* waitUntilGone(created.name);
160 expect(gone).toEqual("gone");
161 }).pipe(logLevel),
162 {
163 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
164 timeout: 90_000,
165 },
166);