1import * as securityposture from "@distilled.cloud/gcp/securityposture_v1";
2import * as Effect from "effect/Effect";
3import { MinimumLogLevel } from "effect/References";
4import * as Schedule from "effect/Schedule";
5
6export const logLevel = Effect.provideService(
7 MinimumLogLevel,
8 process.env.DEBUG ? "Debug" : "Info",
9);
10
11// Postures live on the organization and need org-level Security Posture
12// permissions the testing service account lacks (list/create answer 403);
13// set GCP_TEST_SECURITY_POSTURE=1 and GOOGLE_ORGANIZATION_ID on an org where
14// the credential is a Security Posture admin.
15const organizationId = process.env.GOOGLE_ORGANIZATION_ID?.trim() ?? "";
16export const organization =
17 organizationId.length === 0 || organizationId.startsWith("organizations/")
18 ? organizationId
19 : `organizations/${organizationId}`;
20export const runLifecycle =
21 !process.env.FAST &&
22 process.env.GCP_TEST_SECURITY_POSTURE === "1" &&
23 organization.length > 0;
24
25export const waitUntilPostureGone = (name: string) =>
26 securityposture.getOrganizationsLocationsPostures({ name }).pipe(
27 Effect.as("found" as const),
28 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
29 Effect.repeat({
30 schedule: Schedule.spaced("1 second"),
31 until: (status) => status === "gone",
32 times: 10,
33 }),
34 );
35
36export const waitUntilDeploymentGone = (name: string) =>
37 securityposture.getOrganizationsLocationsPostureDeployments({ name }).pipe(
38 Effect.as("found" as const),
39 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
40 Effect.repeat({
41 schedule: Schedule.spaced("1 second"),
42 until: (status) => status === "gone",
43 times: 10,
44 }),
45 );
46
47export const updatedPolicySets: securityposture.PolicySetList = [
48 {
49 policySetId: "alchemy",
50 description: "updated alchemy policy set",
51 policies: [
52 {
53 policyId: "alchemy-sha",
54 constraint: {
55 securityHealthAnalyticsModule: {
56 moduleName: "API_KEY_EXISTS",
57 moduleEnablementState: "DISABLED",
58 },
59 },
60 },
61 {
62 policyId: "alchemy-sha-2",
63 constraint: {
64 securityHealthAnalyticsModule: {
65 moduleName: "BUCKET_IAM_NOT_MONITORED",
66 moduleEnablementState: "DISABLED",
67 },
68 },
69 },
70 ],
71 },
72];