1import * as AWS from "@/AWS";
2import * as Core from "@/Test/Core";
3import * as Test from "@/Test/Alchemy";
4import { describe, expect } from "alchemy-test";
5import * as Data from "effect/Data";
6import * as Effect from "effect/Effect";
7import * as Schedule from "effect/Schedule";
8import * as HttpClient from "effect/http/HttpClient";
9import * as HttpClientRequest from "effect/http/HttpClientRequest";
10import NetworkFirewallBindingsFunctionLive, {
11 NetworkFirewallBindingsFunction,
12} from "./handler";
13
14const testOptions = { providers: AWS.providers() };
15const { test, beforeAll, afterAll } = Test.make(testOptions);
16const sharedStack = Core.scratchStack(testOptions, "NetworkFirewallBindings");
17
18// Lambda function URL cold-start (DNS, IAM propagation, init) can take well
19// over 60s on a fresh deploy.
20const readinessPolicy = Schedule.max([
21 Schedule.fixed("2 seconds"),
22 Schedule.recurs(75),
23]);
24
25let baseUrl: string;
26
27class TransientUpstream extends Data.TaggedError("TransientUpstream")<{
28 readonly status: number;
29 readonly body: string;
30}> {}
31
32// The shared Lambda fixture occasionally answers a transient 5xx under load
33// (cold re-init, IAM propagation on the freshly attached policy). Retry only
34// 5xx; a genuine 4xx/assertion failure surfaces immediately.
35const send = (request: HttpClientRequest.HttpClientRequest) =>
36 HttpClient.execute(request).pipe(
37 Effect.flatMap((response) =>
38 response.status >= 500
39 ? response.text.pipe(
40 Effect.flatMap((body) =>
41 Effect.fail(
42 new TransientUpstream({ status: response.status, body }),
43 ),
44 ),
45 )
46 : Effect.succeed(response),
47 ),
48 Effect.retry({
49 while: (e) => e._tag === "TransientUpstream",
50 schedule: Schedule.max([
51 Schedule.exponential("500 millis"),
52 Schedule.recurs(6),
53 ]),
54 }),
55 );
56
57const getJson = (path: string) =>
58 send(HttpClientRequest.get(`${baseUrl}${path}`)).pipe(
59 Effect.flatMap((r) => r.json),
60 );
61
62describe.sequential(
63 "NetworkFirewall Bindings",
64 {
65 tags: [
66 "provider:aws",
67 "provider:aws:lambda",
68 "provider:aws:networkfirewall",
69 "live",
70 ],
71 },
72 () => {
73 beforeAll(
74 Effect.gen(function* () {
75 yield* Effect.logInfo(
76 "NetworkFirewall test setup: destroying previous resources",
77 );
78 yield* sharedStack.destroy();
79
80 yield* Effect.logInfo("NetworkFirewall test setup: deploying fixture");
81 const attrs = yield* sharedStack.deploy(
82 Effect.gen(function* () {
83 return yield* NetworkFirewallBindingsFunction;
84 }).pipe(Effect.provide(NetworkFirewallBindingsFunctionLive)),
85 );
86
87 expect(attrs.functionUrl).toBeTruthy();
88 baseUrl = attrs.functionUrl!.replace(/\/+$/, "");
89
90 const readinessUrl = `${baseUrl}/bindings`;
91 yield* Effect.logInfo(
92 `NetworkFirewall test setup: probing readiness at ${readinessUrl}`,
93 );
94 yield* HttpClient.get(readinessUrl).pipe(
95 Effect.flatMap((response) =>
96 response.status === 200
97 ? Effect.succeed(response)
98 : Effect.fail(
99 new Error(`Function not ready: ${response.status}`),
100 ),
101 ),
102 Effect.tapError((error) =>
103 Effect.logWarning(
104 `NetworkFirewall test setup: fixture not ready yet (${String(error)})`,
105 ),
106 ),
107 Effect.retry({ schedule: readinessPolicy }),
108 );
109 }),
110 { timeout: 300_000 },
111 );
112
113 afterAll(process.env.NO_DESTROY ? Effect.void : sharedStack.destroy(), {
114 timeout: 300_000,
115 });
116
117 describe("binding registration", () => {
118 test.provider("all 4 capabilities initialize in the runtime", (_stack) =>
119 Effect.gen(function* () {
120 const response = (yield* getJson("/bindings")) as { bound: string[] };
121 expect(response.bound).toHaveLength(4);
122 expect(response.bound).toContain("describeFirewallPolicy");
123 expect(response.bound).toContain("describeRuleGroup");
124 expect(response.bound).toContain("describeRuleGroupSummary");
125 expect(response.bound).toContain("describeRuleGroupMetadata");
126 }),
127 );
128 });
129
130 describe("DescribeFirewallPolicy", () => {
131 test.provider(
132 "reads the bound policy's definition (ARN injected)",
133 (_stack) =>
134 Effect.gen(function* () {
135 const response = (yield* getJson("/policy")) as {
136 status: string;
137 statelessDefaultActions: string[];
138 };
139 expect(response.status).toBe("ACTIVE");
140 expect(response.statelessDefaultActions).toEqual([
141 "aws:forward_to_sfe",
142 ]);
143 }),
144 );
145 });
146
147 describe("DescribeRuleGroup", () => {
148 test.provider(
149 "reads the bound rule group's rules (ARN injected)",
150 (_stack) =>
151 Effect.gen(function* () {
152 const response = (yield* getJson("/rule-group")) as {
153 status: string;
154 type: string;
155 rulesString: string;
156 };
157 expect(response.status).toBe("ACTIVE");
158 expect(response.type).toBe("STATEFUL");
159 expect(response.rulesString).toContain("allow https");
160 }),
161 );
162 });
163
164 describe("DescribeRuleGroupSummary", () => {
165 test.provider("summarizes the stateful rules", (_stack) =>
166 Effect.gen(function* () {
167 const response = (yield* getJson("/rule-group/summary")) as {
168 ruleCount: number;
169 };
170 expect(response.ruleCount).toBe(1);
171 }),
172 );
173 });
174
175 describe("DescribeRuleGroupMetadata", () => {
176 test.provider(
177 "reads capacity and type without the definition",
178 (_stack) =>
179 Effect.gen(function* () {
180 const response = (yield* getJson("/rule-group/metadata")) as {
181 capacity: number;
182 type: string;
183 };
184 expect(response.capacity).toBe(10);
185 expect(response.type).toBe("STATEFUL");
186 }),
187 );
188 });
189 },
190);