1import * as AWS from "@/AWS";
2import * as Core from "@/Test/Core";
3import * as Test from "@/Test/Alchemy";
4import { describe, expect } from "alchemy-test";
5import * as Data from "effect/Data";
6import * as Effect from "effect/Effect";
7import * as Schedule from "effect/Schedule";
8import * as HttpClient from "effect/http/HttpClient";
9import * as HttpClientRequest from "effect/http/HttpClientRequest";
10import CloudHSMV2TestFunctionLive, { CloudHSMV2TestFunction } from "./handler";
11
12const testOptions = { providers: AWS.providers() };
13const { test, beforeAll, afterAll } = Test.make(testOptions);
14const sharedStack = Core.scratchStack(testOptions, "CloudHSMV2Bindings");
15
16// Lambda function URL cold-start (DNS, IAM propagation, init) can take well
17// over 60s on a fresh deploy.
18const readinessPolicy = Schedule.max([
19 Schedule.fixed("2 seconds"),
20 Schedule.recurs(75),
21]);
22
23let baseUrl: string;
24
25class TransientUpstream extends Data.TaggedError("TransientUpstream")<{
26 readonly status: number;
27 readonly body: string;
28}> {}
29
30// The shared Lambda fixture occasionally answers a transient 5xx under load
31// (cold re-init, IAM propagation on the freshly attached policy that the
32// handler's `Effect.orDie` surfaces as a 500). Retry only 5xx; a genuine
33// 4xx/assertion failure surfaces immediately.
34const send = (request: HttpClientRequest.HttpClientRequest) =>
35 HttpClient.execute(request).pipe(
36 Effect.flatMap((response) =>
37 response.status >= 500
38 ? response.text.pipe(
39 Effect.flatMap((body) =>
40 Effect.fail(
41 new TransientUpstream({ status: response.status, body }),
42 ),
43 ),
44 )
45 : Effect.succeed(response),
46 ),
47 Effect.retry({
48 while: (e) => e._tag === "TransientUpstream",
49 schedule: Schedule.max([
50 Schedule.exponential("500 millis"),
51 Schedule.recurs(6),
52 ]),
53 }),
54 );
55
56const getJson = (path: string) =>
57 send(HttpClientRequest.get(`${baseUrl}${path}`)).pipe(
58 Effect.flatMap((r) => r.json),
59 );
60
61describe.sequential(
62 "CloudHSMV2 Bindings",
63 {
64 tags: [
65 "provider:aws",
66 "provider:aws:cloudhsmv2",
67 "provider:aws:lambda",
68 "live",
69 ],
70 },
71 () => {
72 beforeAll(
73 Effect.gen(function* () {
74 yield* Effect.logInfo(
75 "CloudHSMV2 test setup: destroying previous resources",
76 );
77 yield* sharedStack.destroy();
78
79 yield* Effect.logInfo("CloudHSMV2 test setup: deploying fixture");
80 const { functionUrl } = yield* sharedStack.deploy(
81 Effect.gen(function* () {
82 return yield* CloudHSMV2TestFunction;
83 }).pipe(Effect.provide(CloudHSMV2TestFunctionLive)),
84 );
85
86 expect(functionUrl).toBeTruthy();
87 baseUrl = functionUrl!.replace(/\/+$/, "");
88
89 const readinessUrl = `${baseUrl}/bindings`;
90 yield* Effect.logInfo(
91 `CloudHSMV2 test setup: probing readiness at ${readinessUrl}`,
92 );
93 yield* HttpClient.get(readinessUrl).pipe(
94 Effect.flatMap((response) =>
95 response.status === 200
96 ? Effect.succeed(response)
97 : Effect.fail(
98 new Error(`Function not ready: ${response.status}`),
99 ),
100 ),
101 Effect.tapError((error) =>
102 Effect.logWarning(
103 `CloudHSMV2 test setup: fixture not ready yet (${String(error)})`,
104 ),
105 ),
106 Effect.retry({ schedule: readinessPolicy }),
107 );
108 }),
109 { timeout: 240_000 },
110 );
111
112 afterAll(sharedStack.destroy(), { timeout: 120_000 });
113
114 describe("binding registration", () => {
115 test.provider("all 10 capabilities initialize in the runtime", (_stack) =>
116 Effect.gen(function* () {
117 const response = yield* getJson("/bindings");
118 expect((response as any).bound).toHaveLength(10);
119 }),
120 );
121 });
122
123 describe("DescribeClusters", () => {
124 test.provider(
125 "filter on a nonexistent id returns an empty page",
126 (_stack) =>
127 Effect.gen(function* () {
128 const response = yield* getJson("/clusters");
129 expect((response as any).count).toBe(0);
130 }),
131 );
132 });
133
134 describe("DescribeBackups", () => {
135 test.provider(
136 "filter on a nonexistent id returns an empty page",
137 (_stack) =>
138 Effect.gen(function* () {
139 const response = yield* getJson("/backups");
140 expect((response as any).count).toBe(0);
141 }),
142 );
143 });
144
145 describe("DeleteBackup", () => {
146 test.provider(
147 "surfaces the typed not-found tag for a nonexistent backup",
148 (_stack) =>
149 Effect.gen(function* () {
150 const response = yield* getJson("/backup-delete");
151 expect((response as any).tag).toBe(
152 "CloudHsmResourceNotFoundException",
153 );
154 }),
155 );
156 });
157
158 describe("RestoreBackup", () => {
159 test.provider(
160 "surfaces the typed not-found tag for a nonexistent backup",
161 (_stack) =>
162 Effect.gen(function* () {
163 const response = yield* getJson("/backup-restore");
164 expect((response as any).tag).toBe(
165 "CloudHsmResourceNotFoundException",
166 );
167 }),
168 );
169 });
170
171 describe("ModifyBackupAttributes", () => {
172 test.provider(
173 "surfaces the typed not-found tag for a nonexistent backup",
174 (_stack) =>
175 Effect.gen(function* () {
176 const response = yield* getJson("/backup-modify");
177 expect((response as any).tag).toBe(
178 "CloudHsmResourceNotFoundException",
179 );
180 }),
181 );
182 });
183
184 describe("CopyBackupToRegion", () => {
185 test.provider(
186 "surfaces a typed tag for a nonexistent backup (proving the grant)",
187 (_stack) =>
188 Effect.gen(function* () {
189 const response = yield* getJson("/backup-copy");
190 expect([
191 "CloudHsmResourceNotFoundException",
192 "CloudHsmInvalidRequestException",
193 ]).toContain((response as any).tag);
194 }),
195 );
196 });
197
198 describe("InitializeCluster", () => {
199 test.provider(
200 "surfaces a typed tag for a nonexistent cluster (proving the grant)",
201 (_stack) =>
202 Effect.gen(function* () {
203 const response = yield* getJson("/cluster-init");
204 expect([
205 "CloudHsmResourceNotFoundException",
206 "CloudHsmInvalidRequestException",
207 ]).toContain((response as any).tag);
208 }),
209 );
210 });
211
212 describe("GetResourcePolicy", () => {
213 test.provider(
214 "reaches service-side validation (proving the grant)",
215 (_stack) =>
216 Effect.gen(function* () {
217 const response = yield* getJson("/policy-get");
218 expect([
219 "CloudHsmInvalidRequestException",
220 "CloudHsmResourceNotFoundException",
221 ]).toContain((response as any).tag);
222 }),
223 );
224 });
225
226 describe("PutResourcePolicy", () => {
227 test.provider(
228 "reaches service-side validation (proving the grant)",
229 (_stack) =>
230 Effect.gen(function* () {
231 const response = yield* getJson("/policy-put");
232 expect([
233 "CloudHsmInvalidRequestException",
234 "CloudHsmResourceNotFoundException",
235 ]).toContain((response as any).tag);
236 }),
237 );
238 });
239
240 describe("DeleteResourcePolicy", () => {
241 test.provider(
242 "reaches service-side validation (proving the grant)",
243 (_stack) =>
244 Effect.gen(function* () {
245 const response = yield* getJson("/policy-delete");
246 expect([
247 "CloudHsmInvalidRequestException",
248 "CloudHsmResourceNotFoundException",
249 ]).toContain((response as any).tag);
250 }),
251 );
252 });
253 },
254);