1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as Core from "@/Test/Core";
4import * as resourcemanager from "@distilled.cloud/gcp/cloudresourcemanager_v3";
5import * as workstations from "@distilled.cloud/gcp/workstations_v1";
6import { describe, expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import * as Schedule from "effect/Schedule";
9import { dockerAvailable, expectProbe } from "../bindingHost.ts";
10import WorkstationsBindingsHost, { Dev } from "./fixtures/bindings-host.ts";
11
12const testOptions = { providers: GCP.providers() };
13const { test, beforeAll, afterAll } = Test.make(testOptions);
14const sharedStack = Core.scratchStack(testOptions, "WorkstationsBindings");
15
16// Workstation clusters take ~20 minutes to create and delete.
17const runLifecycle = !!process.env.GCP_TEST_SLOW && !process.env.FAST;
18
19let baseUrl: string;
20let hostAccount: string;
21let project: string;
22let clusterName: string;
23let configName: string;
24let workstationName: string;
25
26const member = () => `serviceAccount:${hostAccount}`;
27
28const rolesIn = (
29 bindings: ReadonlyArray<{ role?: string; members?: ReadonlyArray<string> }>,
30) =>
31 bindings
32 .filter((binding) => (binding.members ?? []).includes(member()))
33 .map((binding) => binding.role)
34 .sort();
35
36/** Project-level roles (with their IAM Condition) held by the host. */
37const projectRoles = () =>
38 resourcemanager
39 .getIamPolicyProjects({
40 resource: `projects/${project}`,
41 body: { options: { requestedPolicyVersion: 3 } },
42 })
43 .pipe(
44 Effect.map((policy) =>
45 (policy.bindings ?? [])
46 .filter((binding) => (binding.members ?? []).includes(member()))
47 .map((binding) => ({
48 role: binding.role,
49 condition: binding.condition?.expression,
50 })),
51 ),
52 );
53
54const configRoles = () =>
55 workstations
56 .getIamPolicyProjectsLocationsWorkstationClustersWorkstationConfigs({
57 resource: configName,
58 })
59 .pipe(Effect.map((policy) => rolesIn(policy.bindings ?? [])));
60
61const workstationRoles = () =>
62 workstations
63 .getIamPolicyProjectsLocationsWorkstationClustersWorkstationConfigsWorkstations(
64 { resource: workstationName },
65 )
66 .pipe(Effect.map((policy) => rolesIn(policy.bindings ?? [])));
67
68const waitForState = (state: string) =>
69 workstations
70 .getProjectsLocationsWorkstationClustersWorkstationConfigsWorkstations({
71 name: workstationName,
72 })
73 .pipe(
74 Effect.repeat({
75 schedule: Schedule.spaced("10 seconds"),
76 until: (live) => live.state === state,
77 times: 48,
78 }),
79 );
80
81describe.skipIf(!dockerAvailable || !runLifecycle)(
82 "Workstations Bindings",
83 {
84 tags: [
85 "provider:gcp",
86 "provider:gcp:workstations",
87 "provider:gcp:run",
88 "live",
89 ],
90 },
91 () => {
92 beforeAll(
93 Effect.gen(function* () {
94 yield* sharedStack.destroy();
95 const out = yield* sharedStack.deploy(
96 Effect.gen(function* () {
97 const host = yield* WorkstationsBindingsHost;
98 const { cluster, config, workstation } = yield* Dev;
99 return {
100 uri: host.uri,
101 serviceAccount: host.serviceAccount,
102 project: host.project,
103 cluster: cluster.name,
104 config: config.name,
105 workstation: workstation.name,
106 };
107 }),
108 );
109 baseUrl = out.uri!;
110 hostAccount = out.serviceAccount!;
111 project = out.project;
112 clusterName = out.cluster;
113 configName = out.config;
114 workstationName = out.workstation;
115 }),
116 { timeout: 3_000_000 },
117 );
118
119 afterAll(sharedStack.destroy(), { timeout: 3_000_000 });
120
121 describe("GetWorkstationCluster", () => {
122 test.provider(
123 "reads the bound cluster as the host, with workstations.viewer on the project",
124 (_stack) =>
125 Effect.gen(function* () {
126 const out = yield* expectProbe<{ name: string; network: string }>(
127 baseUrl,
128 "getWorkstationCluster",
129 );
130 expect(out.name).toEqual(clusterName);
131 expect(out.network).toContain("/networks/default");
132 // Clusters have no IAM policy of their own.
133 expect(yield* projectRoles()).toEqual([
134 { role: "roles/workstations.viewer", condition: undefined },
135 ]);
136 }),
137 {
138 tags: ["provider:gcp", "provider:gcp:workstations", "live"],
139 timeout: 600_000,
140 },
141 );
142 });
143
144 describe("GetWorkstationConfig", () => {
145 test.provider(
146 "reads the bound config as the host, with workstations.viewer on the config only",
147 (_stack) =>
148 Effect.gen(function* () {
149 const out = yield* expectProbe<{
150 name: string;
151 machineType: string;
152 }>(baseUrl, "getWorkstationConfig");
153 expect(out.name).toEqual(configName);
154 expect(out.machineType).toEqual("e2-standard-2");
155 expect(yield* configRoles()).toEqual(["roles/workstations.viewer"]);
156 }),
157 {
158 tags: ["provider:gcp", "provider:gcp:workstations", "live"],
159 timeout: 600_000,
160 },
161 );
162 });
163
164 describe("GetWorkstation", () => {
165 test.provider(
166 "reads the bound workstation as the host, with workstations.viewer on it",
167 (_stack) =>
168 Effect.gen(function* () {
169 const out = yield* expectProbe<{ name: string; state: string }>(
170 baseUrl,
171 "getWorkstation",
172 );
173 expect(out.name).toEqual(workstationName);
174 expect(out.state).toEqual("STATE_STOPPED");
175 expect(yield* workstationRoles()).toContain(
176 "roles/workstations.viewer",
177 );
178 }),
179 {
180 tags: ["provider:gcp", "provider:gcp:workstations", "live"],
181 timeout: 600_000,
182 },
183 );
184 });
185
186 describe("StartWorkstation", () => {
187 test.provider(
188 "starts the bound workstation as the host",
189 (_stack) =>
190 Effect.gen(function* () {
191 const out = yield* expectProbe<{ name: string }>(
192 baseUrl,
193 "startWorkstation",
194 );
195 expect(out.name).toContain("/operations/");
196 const live = yield* waitForState("STATE_RUNNING");
197 expect(live.state).toEqual("STATE_RUNNING");
198 expect(yield* workstationRoles()).toContain(
199 "roles/workstations.user",
200 );
201 }),
202 {
203 tags: ["provider:gcp", "provider:gcp:workstations", "live"],
204 timeout: 900_000,
205 },
206 );
207 });
208
209 describe("GenerateAccessToken", () => {
210 test.provider(
211 "mints an access token for the bound workstation as the host",
212 (_stack) =>
213 Effect.gen(function* () {
214 const out = yield* expectProbe<{
215 hasToken: boolean;
216 expireTime: string;
217 }>(baseUrl, "generateAccessToken");
218 expect(out.hasToken).toEqual(true);
219 expect(Date.parse(out.expireTime)).toBeGreaterThan(
220 Date.parse("2026-01-01T00:00:00Z"),
221 );
222 expect(yield* workstationRoles()).toContain(
223 "roles/workstations.user",
224 );
225 }),
226 {
227 tags: ["provider:gcp", "provider:gcp:workstations", "live"],
228 timeout: 600_000,
229 },
230 );
231 });
232
233 describe("StopWorkstation", () => {
234 test.provider(
235 "stops the bound workstation as the host; the host holds only user and viewer on it",
236 (_stack) =>
237 Effect.gen(function* () {
238 const out = yield* expectProbe<{ name: string }>(
239 baseUrl,
240 "stopWorkstation",
241 );
242 expect(out.name).toContain("/operations/");
243 const live = yield* waitForState("STATE_STOPPED");
244 expect(live.state).toEqual("STATE_STOPPED");
245 expect(yield* workstationRoles()).toEqual([
246 "roles/workstations.user",
247 "roles/workstations.viewer",
248 ]);
249 }),
250 {
251 tags: ["provider:gcp", "provider:gcp:workstations", "live"],
252 timeout: 900_000,
253 },
254 );
255 });
256 },
257);