1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as scc from "@distilled.cloud/gcp/securitycenter_v1";
4import { expect } from "alchemy-test";
5import * as Effect from "effect/Effect";
6import { MinimumLogLevel } from "effect/References";
7import * as Schedule from "effect/Schedule";
8
9const { test } = Test.make({ providers: GCP.providers() });
10
11const logLevel = Effect.provideService(
12 MinimumLogLevel,
13 process.env.DEBUG ? "Debug" : "Info",
14);
15
16const alwaysTrue = {
17 predicate: { expression: 'resource.name == "alchemy-nonexistent"' },
18 resourceSelector: {
19 resourceTypes: ["compute.googleapis.com/Instance"],
20 },
21 severity: "LOW" as const,
22 description: "always true",
23 recommendation: "n/a",
24};
25
26const waitUntilGone = (name: string) =>
27 scc
28 .getOrganizationsSecurityHealthAnalyticsSettingsCustomModules({ name })
29 .pipe(
30 Effect.as("found" as const),
31 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
32 Effect.repeat({
33 schedule: Schedule.spaced("1 second"),
34 until: (status) => status === "gone",
35 times: 10,
36 }),
37 );
38
39// Organization-level Security Command Center needs SCC activated on the
40// organization and org-level SCC roles for the test identity. Set
41// GCP_TEST_SECURITY_CENTER=1 and GOOGLE_ORGANIZATION_ID when both hold.
42const organizationId = process.env.GOOGLE_ORGANIZATION_ID;
43const runLifecycle = !!process.env.GCP_TEST_SECURITY_CENTER && !!organizationId;
44
45const organizationOf = () =>
46 Effect.succeed(
47 organizationId === undefined
48 ? ""
49 : organizationId.startsWith("organizations/")
50 ? organizationId
51 : `organizations/${organizationId}`,
52 );
53
54test.provider(
55 "getOrganizationsSecurityHealthAnalyticsSettingsCustomModules on a missing module fails with a typed tag",
56 (stack) =>
57 Effect.gen(function* () {
58 yield* stack.destroy();
59
60 const organization = (yield* organizationOf()) || "organizations/0";
61 const error = yield* Effect.flip(
62 scc.getOrganizationsSecurityHealthAnalyticsSettingsCustomModules({
63 name: `${organization}/securityHealthAnalyticsSettings/customModules/alchemy-missing`,
64 }),
65 );
66 expect(error._tag).toEqual("ServiceDisabled");
67
68 yield* stack.destroy();
69 }).pipe(logLevel),
70 {
71 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
72 timeout: 90_000,
73 },
74);
75
76test.provider.skipIf(!runLifecycle)(
77 "create, update, and delete an organization security health analytics custom module",
78 (stack) =>
79 Effect.gen(function* () {
80 yield* stack.destroy();
81
82 const organization = yield* organizationOf();
83
84 const parent = `${organization}/securityHealthAnalyticsSettings`;
85
86 const created = yield* stack.deploy(
87 Effect.gen(function* () {
88 return yield* GCP.SecurityCenter.OrganizationsSecurityHealthAnalyticsSettingsCustomModule(
89 "AlwaysTrue",
90 {
91 organization,
92 displayName: "AlchemyOrgAlwaysTrue",
93 customConfig: alwaysTrue,
94 },
95 );
96 }),
97 );
98
99 expect(created.moduleId).toEqual(expect.any(String));
100 expect(created.organization).toEqual(organization);
101 expect(created.name).toEqual(
102 `${parent}/customModules/${created.moduleId}`,
103 );
104 expect(created.displayName).toEqual("AlchemyOrgAlwaysTrue");
105 expect(created.customConfig?.description).toEqual("always true");
106
107 const fetched =
108 yield* scc.getOrganizationsSecurityHealthAnalyticsSettingsCustomModules(
109 {
110 name: created.name,
111 },
112 );
113 expect(fetched.name).toEqual(created.name);
114 expect(fetched.customConfig?.description).toContain("alchemy-id=");
115
116 const updated = yield* stack.deploy(
117 Effect.gen(function* () {
118 return yield* GCP.SecurityCenter.OrganizationsSecurityHealthAnalyticsSettingsCustomModule(
119 "AlwaysTrue",
120 {
121 organization,
122 moduleId: created.moduleId,
123 displayName: "AlchemyOrgAlwaysTrue",
124 enablementState: "DISABLED",
125 customConfig: {
126 ...alwaysTrue,
127 description: "always true disabled",
128 severity: "MEDIUM",
129 },
130 },
131 );
132 }),
133 );
134
135 expect(updated.name).toEqual(created.name);
136 expect(updated.enablementState).toEqual("DISABLED");
137 expect(updated.customConfig?.description).toEqual("always true disabled");
138
139 yield* stack.destroy();
140
141 const gone = yield* waitUntilGone(created.name);
142 expect(gone).toEqual("gone");
143 }).pipe(logLevel),
144 {
145 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
146 timeout: 90_000,
147 },
148);