1import { GcpEnvironment } from "@/GCP/Environment";
2import * as GCP from "@/GCP";
3import * as Test from "@/Test/Alchemy";
4import * as scc from "@distilled.cloud/gcp/securitycenter_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 scc.getOrganizationsNotificationConfigs({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28// Organization-level Security Command Center needs SCC activated on the
29// organization and org-level SCC roles for the test identity. Set
30// GCP_TEST_SECURITY_CENTER=1 and GOOGLE_ORGANIZATION_ID when both hold.
31const organizationId = process.env.GOOGLE_ORGANIZATION_ID;
32const runLifecycle = !!process.env.GCP_TEST_SECURITY_CENTER && !!organizationId;
33
34const organizationOf = () =>
35 Effect.succeed(
36 organizationId === undefined
37 ? ""
38 : organizationId.startsWith("organizations/")
39 ? organizationId
40 : `organizations/${organizationId}`,
41 );
42
43test.provider(
44 "getOrganizationsNotificationConfigs on a missing config fails with a typed tag",
45 (stack) =>
46 Effect.gen(function* () {
47 yield* stack.destroy();
48
49 const organization = (yield* organizationOf()) || "organizations/0";
50 const error = yield* Effect.flip(
51 scc.getOrganizationsNotificationConfigs({
52 name: `${organization}/notificationConfigs/alchemy-missing`,
53 }),
54 );
55 expect(error._tag).toEqual("ServiceDisabled");
56
57 yield* stack.destroy();
58 }).pipe(logLevel),
59 {
60 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
61 timeout: 90_000,
62 },
63);
64
65test.provider.skipIf(!runLifecycle)(
66 "create, update, and delete an organization notification config",
67 (stack) =>
68 Effect.gen(function* () {
69 const { project } = yield* GcpEnvironment.current;
70
71 yield* stack.destroy();
72
73 const organization = yield* organizationOf();
74
75 const created = yield* stack.deploy(
76 Effect.gen(function* () {
77 const topic = yield* GCP.PubSub.Topic("OrgSccNotify", {});
78 const config =
79 yield* GCP.SecurityCenter.OrganizationsNotificationConfig("High", {
80 organization,
81 pubsubTopic: topic.name,
82 description: "high severity",
83 streamingConfig: { filter: 'severity="HIGH"' },
84 });
85 return { topic, config };
86 }),
87 );
88
89 expect(created.config.configId).toEqual(expect.any(String));
90 expect(created.config.organization).toEqual(organization);
91 expect(created.config.name).toEqual(
92 `${organization}/notificationConfigs/${created.config.configId}`,
93 );
94 expect(created.config.description).toEqual("high severity");
95
96 const fetched = yield* scc.getOrganizationsNotificationConfigs({
97 name: created.config.name,
98 });
99 expect(fetched.name).toEqual(created.config.name);
100 expect(fetched.description).toContain("alchemy-id=");
101
102 const updated = yield* stack.deploy(
103 Effect.gen(function* () {
104 const topic = yield* GCP.PubSub.Topic("OrgSccNotify", {
105 topicId: created.topic.topicId,
106 });
107 const config =
108 yield* GCP.SecurityCenter.OrganizationsNotificationConfig("High", {
109 organization,
110 configId: created.config.configId,
111 pubsubTopic: topic.name,
112 description: "high and critical",
113 streamingConfig: {
114 filter: 'severity="HIGH" OR severity="CRITICAL"',
115 },
116 });
117 return { topic, config };
118 }),
119 );
120
121 expect(updated.config.name).toEqual(created.config.name);
122 expect(updated.config.description).toEqual("high and critical");
123
124 yield* stack.destroy();
125
126 const gone = yield* waitUntilGone(created.config.name);
127 expect(gone).toEqual("gone");
128 }).pipe(logLevel),
129 {
130 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
131 timeout: 90_000,
132 },
133);