1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as networksecurity from "@distilled.cloud/gcp/networksecurity_v1";
4import { expect } from "alchemy-test";
5import * as Effect from "effect/Effect";
6import { MinimumLogLevel } from "effect/References";
7import * as Schedule from "effect/Schedule";
8import { GcpEnvironment } from "@/GCP/Environment";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 networksecurity.getProjectsLocationsSecurityProfiles({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28test.provider(
29 "getProjectsLocationsSecurityProfiles on a missing profile fails with a typed tag",
30 (stack) =>
31 Effect.gen(function* () {
32 yield* stack.destroy();
33
34 const { project } = yield* GcpEnvironment.current;
35 const error = yield* Effect.flip(
36 networksecurity.getProjectsLocationsSecurityProfiles({
37 name: `projects/${project}/locations/global/securityProfiles/alchemy-missing`,
38 }),
39 );
40 expect(error._tag).toEqual("NotFound");
41
42 yield* stack.destroy();
43 }).pipe(logLevel),
44 {
45 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
46 timeout: 90_000,
47 },
48);
49
50test.provider(
51 "create, update, and delete a security profile",
52 (stack) =>
53 Effect.gen(function* () {
54 yield* stack.destroy();
55
56 const created = yield* stack.deploy(
57 Effect.gen(function* () {
58 return yield* GCP.NetworkSecurity.SecurityProfile("Threat", {
59 location: "global",
60 description: "threat profile a",
61 labels: { env: "test" },
62 type: "THREAT_PREVENTION",
63 threatPreventionProfile: {
64 severityOverrides: [{ severity: "HIGH", action: "ALERT" }],
65 },
66 });
67 }),
68 );
69
70 expect(created.name).toContain("/securityProfiles/");
71 expect(created.name).toContain("/locations/global/");
72 expect(created.securityProfileId).toEqual(expect.any(String));
73 expect(created.location).toEqual("global");
74 expect(created.type).toEqual("THREAT_PREVENTION");
75 expect(created.description).toEqual("threat profile a");
76 expect(created.labels).toMatchObject({ env: "test" });
77 expect(created.threatPreventionProfile?.severityOverrides).toEqual(
78 expect.arrayContaining([
79 expect.objectContaining({ severity: "HIGH", action: "ALERT" }),
80 ]),
81 );
82 expect(created.createTime).toEqual(expect.any(String));
83
84 const fetched =
85 yield* networksecurity.getProjectsLocationsSecurityProfiles({
86 name: created.name,
87 });
88 expect(fetched.name).toEqual(created.name);
89 expect(fetched.description).toEqual("threat profile a");
90 expect(fetched.type).toEqual("THREAT_PREVENTION");
91 expect(fetched.labels?.env).toEqual("test");
92 expect(
93 Object.keys(fetched.labels ?? {}).some((key) =>
94 key.startsWith("alchemy-"),
95 ),
96 ).toEqual(true);
97
98 const updated = yield* stack.deploy(
99 Effect.gen(function* () {
100 return yield* GCP.NetworkSecurity.SecurityProfile("Threat", {
101 securityProfileId: created.securityProfileId,
102 location: "global",
103 description: "threat profile b",
104 labels: { env: "prod", role: "ngfw" },
105 type: "THREAT_PREVENTION",
106 threatPreventionProfile: {
107 severityOverrides: [{ severity: "CRITICAL", action: "DENY" }],
108 },
109 });
110 }),
111 );
112
113 expect(updated.name).toEqual(created.name);
114 expect(updated.description).toEqual("threat profile b");
115 expect(updated.labels).toMatchObject({ env: "prod", role: "ngfw" });
116 expect(updated.threatPreventionProfile?.severityOverrides).toEqual(
117 expect.arrayContaining([
118 expect.objectContaining({ severity: "CRITICAL", action: "DENY" }),
119 ]),
120 );
121
122 const refetched =
123 yield* networksecurity.getProjectsLocationsSecurityProfiles({
124 name: created.name,
125 });
126 expect(refetched.description).toEqual("threat profile b");
127 expect(refetched.labels?.env).toEqual("prod");
128 expect(refetched.labels?.role).toEqual("ngfw");
129
130 yield* stack.destroy();
131
132 const gone = yield* waitUntilGone(created.name);
133 expect(gone).toEqual("gone");
134 }).pipe(logLevel),
135 {
136 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
137 timeout: 90_000,
138 },
139);