1import { GcpEnvironment } from "@/GCP/Environment";
2import * as GCP from "@/GCP";
3import * as Test from "@/Test/Alchemy";
4import * as privateca from "@distilled.cloud/gcp/privateca_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 privateca.getProjectsLocationsCaPools({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28test.provider(
29 "getProjectsLocationsCaPools on a missing pool fails with NotFound",
30 (stack) =>
31 Effect.gen(function* () {
32 const { project } = yield* GcpEnvironment.current;
33
34 yield* stack.destroy();
35
36 const error = yield* Effect.flip(
37 privateca.getProjectsLocationsCaPools({
38 name: `projects/${project}/locations/us-central1/caPools/alchemy-capool-missing`,
39 }),
40 );
41 expect(error._tag).toBe("NotFound");
42
43 const page = yield* privateca.listProjectsLocationsCaPools({
44 parent: `projects/${project}/locations/-`,
45 pageSize: 10,
46 });
47 expect((page.caPools ?? []).map((pool) => pool.name)).not.toContain(
48 `projects/${project}/locations/us-central1/caPools/alchemy-capool-missing`,
49 );
50
51 yield* stack.destroy();
52 }).pipe(logLevel),
53 { tags: ["provider:gcp", "provider:gcp:privateca", "live"], timeout: 90_000 },
54);
55
56test.provider(
57 "create, update, and delete a ca pool",
58 (stack) =>
59 Effect.gen(function* () {
60 yield* stack.destroy();
61
62 const created = yield* stack.deploy(
63 Effect.gen(function* () {
64 return yield* GCP.PrivateCA.CaPool("AppCa", {
65 location: "us-central1",
66 tier: "DEVOPS",
67 labels: { env: "test" },
68 publishingOptions: {
69 publishCaCert: false,
70 publishCrl: false,
71 },
72 });
73 }),
74 );
75
76 expect(created.name).toContain("/caPools/");
77 expect(created.caPoolId).toEqual(expect.any(String));
78 expect(created.location).toEqual("us-central1");
79 expect(created.tier).toEqual("DEVOPS");
80 expect(created.labels).toMatchObject({ env: "test" });
81 expect(created.publishingOptions?.publishCaCert ?? false).toEqual(false);
82 expect(created.publishingOptions?.publishCrl ?? false).toEqual(false);
83
84 const fetched = yield* privateca.getProjectsLocationsCaPools({
85 name: created.name,
86 });
87 expect(fetched.name).toEqual(created.name);
88 expect(fetched.tier).toEqual("DEVOPS");
89 expect(fetched.labels?.env).toEqual("test");
90 expect(
91 Object.keys(fetched.labels ?? {}).some((key) =>
92 key.startsWith("alchemy-"),
93 ),
94 ).toEqual(true);
95
96 const trust = yield* privateca.fetchCaCertsProjectsLocationsCaPools({
97 caPool: created.name,
98 body: {},
99 });
100 // A pool without certificate authorities has no trust anchors.
101 expect(trust.caCerts ?? []).toEqual([]);
102
103 const updated = yield* stack.deploy(
104 Effect.gen(function* () {
105 return yield* GCP.PrivateCA.CaPool("AppCa", {
106 caPoolId: created.caPoolId,
107 location: "us-central1",
108 tier: "DEVOPS",
109 labels: { env: "prod", role: "ca" },
110 publishingOptions: {
111 publishCaCert: false,
112 publishCrl: false,
113 encodingFormat: "PEM",
114 },
115 issuancePolicy: {
116 maximumLifetime: "2592000s",
117 allowedIssuanceModes: {
118 allowConfigBasedIssuance: true,
119 allowCsrBasedIssuance: true,
120 },
121 },
122 });
123 }),
124 );
125
126 expect(updated.name).toEqual(created.name);
127 expect(updated.labels).toMatchObject({ env: "prod", role: "ca" });
128 expect(updated.publishingOptions?.publishCaCert ?? false).toEqual(false);
129 expect(updated.issuancePolicy?.maximumLifetime).toEqual("2592000s");
130
131 const refetched = yield* privateca.getProjectsLocationsCaPools({
132 name: created.name,
133 });
134 expect(refetched.labels?.env).toEqual("prod");
135 expect(refetched.labels?.role).toEqual("ca");
136 expect(refetched.issuancePolicy?.maximumLifetime).toEqual("2592000s");
137 expect(
138 refetched.issuancePolicy?.allowedIssuanceModes
139 ?.allowConfigBasedIssuance,
140 ).toEqual(true);
141
142 yield* stack.destroy();
143
144 const gone = yield* waitUntilGone(created.name);
145 expect(gone).toEqual("gone");
146 }).pipe(logLevel),
147 {
148 tags: ["provider:gcp", "provider:gcp:privateca", "live"],
149 timeout: 120_000,
150 },
151);