1import { GcpEnvironment } from "@/GCP/Environment";
2import * as GCP from "@/GCP";
3import * as Test from "@/Test/Alchemy";
4import * as scc from "@distilled.cloud/gcp/securitycenter_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 scc.getFoldersBigQueryExports({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28// Folder-level Security Command Center needs a folder under an organization
29// with SCC activated and folder-level SCC roles for the test identity. Set
30// GCP_TEST_SECURITY_CENTER=1 and GOOGLE_FOLDER_ID when both hold.
31const folderId = process.env.GOOGLE_FOLDER_ID;
32const runLifecycle = !!process.env.GCP_TEST_SECURITY_CENTER && !!folderId;
33
34const folderOf = () =>
35 Effect.succeed(
36 folderId === undefined
37 ? ""
38 : folderId.startsWith("folders/")
39 ? folderId
40 : `folders/${folderId}`,
41 );
42
43test.provider(
44 "getFoldersBigQueryExports on a missing export fails with a typed tag",
45 (stack) =>
46 Effect.gen(function* () {
47 yield* stack.destroy();
48
49 const folder = (yield* folderOf()) || "folders/0";
50 const error = yield* Effect.flip(
51 scc.getFoldersBigQueryExports({
52 name: `${folder}/bigQueryExports/alchemy-missing`,
53 }),
54 );
55 expect(error._tag).toEqual("ServiceDisabled");
56
57 yield* stack.destroy();
58 }).pipe(logLevel),
59 {
60 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
61 timeout: 90_000,
62 },
63);
64
65test.provider.skipIf(!runLifecycle)(
66 "create, update, and delete a folder BigQuery export",
67 (stack) =>
68 Effect.gen(function* () {
69 const { project } = yield* GcpEnvironment.current;
70
71 yield* stack.destroy();
72
73 const folder = yield* folderOf();
74
75 const created = yield* stack.deploy(
76 Effect.gen(function* () {
77 const dataset = yield* GCP.BigQuery.Dataset("SccExport", {
78 location: "US",
79 forceDestroy: true,
80 });
81 const exp = yield* GCP.SecurityCenter.FolderBigQueryExport(
82 "Findings",
83 {
84 folder,
85 dataset: `projects/${project}/datasets/${dataset.datasetId}`,
86 filter: 'state="ACTIVE"',
87 description: "active findings",
88 },
89 );
90 return { exp, datasetId: dataset.datasetId };
91 }),
92 );
93
94 expect(created.exp.exportId).toEqual(expect.any(String));
95 expect(created.exp.folder).toEqual(folder);
96 expect(created.exp.name).toEqual(
97 `${folder}/bigQueryExports/${created.exp.exportId}`,
98 );
99 expect(created.exp.filter).toEqual('state="ACTIVE"');
100 expect(created.exp.description).toEqual("active findings");
101
102 const fetched = yield* scc.getFoldersBigQueryExports({
103 name: created.exp.name,
104 });
105 expect(fetched.name).toEqual(created.exp.name);
106 expect(fetched.description).toContain("alchemy-id=");
107
108 const updated = yield* stack.deploy(
109 Effect.gen(function* () {
110 const dataset = yield* GCP.BigQuery.Dataset("SccExport", {
111 datasetId: created.datasetId,
112 location: "US",
113 forceDestroy: true,
114 });
115 return yield* GCP.SecurityCenter.FolderBigQueryExport("Findings", {
116 folder,
117 exportId: created.exp.exportId,
118 dataset: `projects/${project}/datasets/${dataset.datasetId}`,
119 filter: 'state="INACTIVE"',
120 description: "inactive findings",
121 });
122 }),
123 );
124
125 expect(updated.name).toEqual(created.exp.name);
126 expect(updated.filter).toEqual('state="INACTIVE"');
127 expect(updated.description).toEqual("inactive findings");
128
129 yield* stack.destroy();
130
131 const gone = yield* waitUntilGone(created.exp.name);
132 expect(gone).toEqual("gone");
133 }).pipe(logLevel),
134 {
135 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
136 timeout: 90_000,
137 },
138);