1import * as DocDB from "@/AWS/DocDB";
2import * as Lambda from "@/AWS/Lambda";
3import * as Effect from "effect/Effect";
4import * as Layer from "effect/Layer";
5import { HttpServerRequest } from "effect/http/HttpServerRequest";
6import * as HttpServerResponse from "effect/http/HttpServerResponse";
7import path from "pathe";
8
9const main = path.resolve(import.meta.dirname, "handler.ts");
10
11// Well-formed-but-nonexistent identifiers — the probe routes drive the
12// bindings against them so the fixture exercises the IAM grants and the
13// typed error decode at zero cost (no cluster/snapshot is ever created).
14const NONEXISTENT_CLUSTER_ID = "alchemy-nonexistent-docdb-probe";
15const NONEXISTENT_INSTANCE_ID = "alchemy-nonexistent-docdb-instance-probe";
16const NONEXISTENT_SNAPSHOT_ID = "alchemy-nonexistent-docdb-snapshot-probe";
17
18// The DocDB barrel re-exports the mongo Effect client; if tree-shaking
19// retains it, the mongodb driver's optional companion packages must stay
20// external (they are `require`d in try/catch fallbacks).
21const MONGODB_OPTIONAL_DEPS = [
22 "kerberos",
23 "@mongodb-js/zstd",
24 "@aws-sdk/credential-providers",
25 "gcp-metadata",
26 "snappy",
27 "socks",
28 "aws4",
29 "mongodb-client-encryption",
30];
31
32export class DocDBTestFunction extends Lambda.Function<Lambda.Function>()(
33 "DocDBTestFunction",
34) {}
35
36export default DocDBTestFunction.make(
37 {
38 main,
39 functionUrl: true,
40 build: { external: MONGODB_OPTIONAL_DEPS },
41 },
42 Effect.gen(function* () {
43 const describeDBClusters = yield* DocDB.DescribeDBClusters();
44 const describeDBInstances = yield* DocDB.DescribeDBInstances();
45 const describeEvents = yield* DocDB.DescribeEvents();
46 const describeDBClusterSnapshots =
47 yield* DocDB.DescribeDBClusterSnapshots();
48 const deleteDBClusterSnapshot = yield* DocDB.DeleteDBClusterSnapshot();
49 const copyDBClusterSnapshot = yield* DocDB.CopyDBClusterSnapshot();
50 const describePendingMaintenanceActions =
51 yield* DocDB.DescribePendingMaintenanceActions();
52 const applyPendingMaintenanceAction =
53 yield* DocDB.ApplyPendingMaintenanceAction();
54
55 const bound = {
56 describeDBClusters,
57 describeDBInstances,
58 describeEvents,
59 describeDBClusterSnapshots,
60 deleteDBClusterSnapshot,
61 copyDBClusterSnapshot,
62 describePendingMaintenanceActions,
63 applyPendingMaintenanceAction,
64 };
65
66 return {
67 fetch: Effect.gen(function* () {
68 const request = yield* HttpServerRequest;
69 const url = new URL(request.originalUrl);
70 const pathname = url.pathname;
71
72 if (request.method === "GET" && pathname === "/bindings") {
73 return yield* HttpServerResponse.json({
74 bound: Object.keys(bound),
75 });
76 }
77
78 if (request.method === "GET" && pathname === "/clusters") {
79 // A nonexistent cluster identifier must surface the service's
80 // typed not-found tag — an IAM gap would surface
81 // AccessDeniedException and fail the route with an opaque 500.
82 const tag = yield* describeDBClusters({
83 DBClusterIdentifier: NONEXISTENT_CLUSTER_ID,
84 }).pipe(
85 Effect.map(() => "Found"),
86 Effect.catchTag("DBClusterNotFoundFault", (e) =>
87 Effect.succeed(e._tag),
88 ),
89 );
90 return yield* HttpServerResponse.json({ tag });
91 }
92
93 if (request.method === "GET" && pathname === "/events") {
94 // Listing the account's recent DocumentDB events succeeds
95 // (possibly empty) — proves the grant and the schema decode.
96 const result = yield* describeEvents();
97 return yield* HttpServerResponse.json({
98 count: (result.Events ?? []).length,
99 });
100 }
101
102 if (request.method === "GET" && pathname === "/instances") {
103 // Nonexistent instance identifier → typed not-found tag.
104 const tag = yield* describeDBInstances({
105 DBInstanceIdentifier: NONEXISTENT_INSTANCE_ID,
106 }).pipe(
107 Effect.map(() => "Found"),
108 Effect.catchTag("DBInstanceNotFoundFault", (e) =>
109 Effect.succeed(e._tag),
110 ),
111 );
112 return yield* HttpServerResponse.json({ tag });
113 }
114
115 if (request.method === "GET" && pathname === "/snapshots") {
116 // Listing the account's cluster snapshots succeeds (possibly
117 // empty) — proves the grant and the schema decode.
118 const result = yield* describeDBClusterSnapshots();
119 return yield* HttpServerResponse.json({
120 count: (result.DBClusterSnapshots ?? []).length,
121 });
122 }
123
124 if (request.method === "GET" && pathname === "/delete-snapshot-probe") {
125 // Deleting a nonexistent snapshot must surface the typed
126 // not-found tag — proves the write-side grant without ever
127 // creating a snapshot.
128 const tag = yield* deleteDBClusterSnapshot({
129 DBClusterSnapshotIdentifier: NONEXISTENT_SNAPSHOT_ID,
130 }).pipe(
131 Effect.map(() => "Deleted"),
132 Effect.catchTag("DBClusterSnapshotNotFoundFault", (e) =>
133 Effect.succeed(e._tag),
134 ),
135 );
136 return yield* HttpServerResponse.json({ tag });
137 }
138
139 if (request.method === "GET" && pathname === "/copy-snapshot-probe") {
140 // Copying from a nonexistent source snapshot must surface the
141 // typed not-found tag — proves the copy grant at zero cost.
142 const tag = yield* copyDBClusterSnapshot({
143 SourceDBClusterSnapshotIdentifier: NONEXISTENT_SNAPSHOT_ID,
144 TargetDBClusterSnapshotIdentifier: `${NONEXISTENT_SNAPSHOT_ID}-copy`,
145 }).pipe(
146 Effect.map(() => "Copied"),
147 Effect.catchTag("DBClusterSnapshotNotFoundFault", (e) =>
148 Effect.succeed(e._tag),
149 ),
150 );
151 return yield* HttpServerResponse.json({ tag });
152 }
153
154 if (request.method === "GET" && pathname === "/pending-maintenance") {
155 // Listing pending maintenance actions succeeds (possibly empty).
156 const result = yield* describePendingMaintenanceActions();
157 return yield* HttpServerResponse.json({
158 count: (result.PendingMaintenanceActions ?? []).length,
159 });
160 }
161
162 if (request.method === "GET" && pathname === "/apply-probe") {
163 // Applying maintenance to a nonexistent resource ARN must surface
164 // the typed ResourceNotFoundFault — proves the apply grant.
165 const arn = url.searchParams.get("arn") ?? "";
166 const tag = yield* applyPendingMaintenanceAction({
167 ResourceIdentifier: arn,
168 ApplyAction: "system-update",
169 OptInType: "next-maintenance",
170 }).pipe(
171 Effect.map(() => "Applied"),
172 Effect.catchTag("ResourceNotFoundFault", (e) =>
173 Effect.succeed(e._tag),
174 ),
175 );
176 return yield* HttpServerResponse.json({ tag });
177 }
178
179 return yield* HttpServerResponse.json(
180 { error: "Not found", method: request.method, pathname },
181 { status: 404 },
182 );
183 }).pipe(Effect.orDie),
184 };
185 }).pipe(
186 Effect.provide(
187 Layer.mergeAll(
188 DocDB.DescribeDBClustersHttp,
189 DocDB.DescribeDBInstancesHttp,
190 DocDB.DescribeEventsHttp,
191 DocDB.DescribeDBClusterSnapshotsHttp,
192 DocDB.DeleteDBClusterSnapshotHttp,
193 DocDB.CopyDBClusterSnapshotHttp,
194 DocDB.DescribePendingMaintenanceActionsHttp,
195 DocDB.ApplyPendingMaintenanceActionHttp,
196 ),
197 ),
198 ),
199);