1import * as AWS from "@/AWS";
2import * as Core from "@/Test/Core";
3import * as Test from "@/Test/Alchemy";
4import { describe, expect } from "alchemy-test";
5import * as Data from "effect/Data";
6import * as Effect from "effect/Effect";
7import * as Schedule from "effect/Schedule";
8import * as HttpClient from "effect/http/HttpClient";
9import * as HttpClientRequest from "effect/http/HttpClientRequest";
10import RolesAnywhereTestFunctionLive, {
11 RolesAnywhereTestFunction,
12} from "./handler";
13
14const testOptions = { providers: AWS.providers() };
15const { test, beforeAll, afterAll } = Test.make(testOptions);
16const sharedStack = Core.scratchStack(testOptions, "RolesAnywhereBindings");
17
18// Lambda function URL cold-start (DNS, IAM propagation, init) can take well
19// over 60s on a fresh deploy.
20const readinessPolicy = Schedule.max([
21 Schedule.fixed("2 seconds"),
22 Schedule.recurs(75),
23]);
24
25let baseUrl: string;
26
27class TransientUpstream extends Data.TaggedError("TransientUpstream")<{
28 readonly status: number;
29 readonly body: string;
30}> {}
31
32// The Lambda fixture occasionally answers a transient 5xx under load (cold
33// re-init, IAM propagation on the freshly attached policy that the handler's
34// `Effect.orDie` surfaces as a 500). Retry only 5xx; a genuine 4xx/assertion
35// failure surfaces immediately.
36const send = (request: HttpClientRequest.HttpClientRequest) =>
37 HttpClient.execute(request).pipe(
38 Effect.flatMap((response) =>
39 response.status >= 500
40 ? response.text.pipe(
41 Effect.flatMap((body) =>
42 Effect.fail(
43 new TransientUpstream({ status: response.status, body }),
44 ),
45 ),
46 )
47 : Effect.succeed(response),
48 ),
49 Effect.retry({
50 while: (e) => e._tag === "TransientUpstream",
51 schedule: Schedule.max([
52 Schedule.exponential("500 millis"),
53 Schedule.recurs(6),
54 ]),
55 }),
56 );
57
58const getJson = (path: string) =>
59 send(HttpClientRequest.get(`${baseUrl}${path}`)).pipe(
60 Effect.flatMap((r) => r.json),
61 );
62
63describe.sequential(
64 "RolesAnywhere Bindings",
65 {
66 tags: [
67 "provider:aws",
68 "provider:aws:lambda",
69 "provider:aws:rolesanywhere",
70 "live",
71 ],
72 },
73 () => {
74 beforeAll(
75 Effect.gen(function* () {
76 yield* Effect.logInfo(
77 "RolesAnywhere test setup: destroying previous resources",
78 );
79 yield* sharedStack.destroy();
80
81 yield* Effect.logInfo("RolesAnywhere test setup: deploying fixture");
82 const attrs = yield* sharedStack.deploy(
83 Effect.gen(function* () {
84 return yield* RolesAnywhereTestFunction;
85 }).pipe(Effect.provide(RolesAnywhereTestFunctionLive)),
86 );
87
88 expect(attrs.functionUrl).toBeTruthy();
89 baseUrl = attrs.functionUrl!.replace(/\/+$/, "");
90
91 const readinessUrl = `${baseUrl}/bindings`;
92 yield* Effect.logInfo(
93 `RolesAnywhere test setup: probing readiness at ${readinessUrl}`,
94 );
95 yield* HttpClient.get(readinessUrl).pipe(
96 Effect.flatMap((response) =>
97 response.status === 200
98 ? Effect.succeed(response)
99 : Effect.fail(
100 new Error(`Function not ready: ${response.status}`),
101 ),
102 ),
103 Effect.tapError((error) =>
104 Effect.logWarning(
105 `RolesAnywhere test setup: fixture not ready yet (${String(error)})`,
106 ),
107 ),
108 Effect.retry({ schedule: readinessPolicy }),
109 );
110 }),
111 { timeout: 240_000 },
112 );
113
114 afterAll(sharedStack.destroy(), { timeout: 120_000 });
115
116 describe("binding registration", () => {
117 test.provider("the capabilities initialize in the runtime", (_stack) =>
118 Effect.gen(function* () {
119 const response = (yield* getJson("/bindings")) as { bound: string[] };
120 expect(response.bound).toEqual(["getSubject", "listSubjects"]);
121 }),
122 );
123 });
124
125 describe("ListSubjects", () => {
126 test.provider(
127 "lists the account's subjects (empty list proves the grant)",
128 (_stack) =>
129 Effect.gen(function* () {
130 const response = (yield* getJson("/subjects")) as {
131 ok: boolean;
132 count: number;
133 };
134 expect(response.ok).toBe(true);
135 expect(response.count).toBeGreaterThanOrEqual(0);
136 }),
137 );
138 });
139
140 describe("GetSubject", () => {
141 test.provider(
142 "returns the typed ResourceNotFoundException for a bogus subject id",
143 (_stack) =>
144 Effect.gen(function* () {
145 const response = (yield* getJson("/subject-not-found")) as {
146 tag: string;
147 };
148 expect(response.tag).toBe("ResourceNotFoundException");
149 }),
150 );
151 });
152 },
153);