1import * as AWS from "@/AWS";
2import { IPSet } from "@/AWS/WAFv2";
3import * as Test from "@/Test/Alchemy";
4import * as wafv2 from "@distilled.cloud/aws/wafv2";
5import { expect } from "alchemy-test";
6import * as Data from "effect/Data";
7import * as Effect from "effect/Effect";
8import * as Schedule from "effect/Schedule";
9
10const { test } = Test.make({ providers: AWS.providers() });
11
12class IPSetStillExists extends Data.TaggedError("IPSetStillExists")<{
13 readonly name: string;
14}> {}
15
16const assertIpSetDeleted = (name: string, id: string) =>
17 wafv2.getIPSet({ Name: name, Scope: "REGIONAL", Id: id }).pipe(
18 Effect.flatMap(() => Effect.fail(new IPSetStillExists({ name }))),
19 Effect.catchTag("WAFNonexistentItemException", () => Effect.void),
20 Effect.retry({
21 while: (e) => e._tag === "IPSetStillExists",
22 schedule: Schedule.max([Schedule.exponential(500), Schedule.recurs(8)]),
23 }),
24 );
25
26test.provider(
27 "create, update addresses and tags, replace on ip version change, delete",
28 (stack) =>
29 Effect.gen(function* () {
30 // reconcile away any prior partial/crashed deployment
31 yield* stack.destroy();
32
33 const ipSet = yield* stack.deploy(
34 Effect.gen(function* () {
35 return yield* IPSet("LifecycleIpSet", {
36 addresses: ["192.0.2.44/32", "203.0.113.0/24"],
37 description: "test block list",
38 tags: { Environment: "test" },
39 });
40 }),
41 );
42
43 expect(ipSet.ipAddressVersion).toBe("IPV4");
44 expect(ipSet.scope).toBe("REGIONAL");
45 expect([...ipSet.addresses].sort()).toEqual([
46 "192.0.2.44/32",
47 "203.0.113.0/24",
48 ]);
49
50 // out-of-band verification via distilled (WAF returns addresses in
51 // arbitrary order)
52 const created = yield* wafv2.getIPSet({
53 Name: ipSet.ipSetName,
54 Scope: "REGIONAL",
55 Id: ipSet.ipSetId,
56 });
57 expect([...(created.IPSet?.Addresses ?? [])].sort()).toEqual([
58 "192.0.2.44/32",
59 "203.0.113.0/24",
60 ]);
61 expect(created.IPSet?.Description).toBe("test block list");
62
63 const tags = yield* wafv2.listTagsForResource({
64 ResourceARN: ipSet.ipSetArn,
65 });
66 const tagRecord = Object.fromEntries(
67 (tags.TagInfoForResource?.TagList ?? []).map((t) => [t.Key, t.Value]),
68 );
69 expect(tagRecord.Environment).toBe("test");
70 expect(tagRecord["alchemy::id"]).toBe("LifecycleIpSet");
71
72 // addresses are mutable — updated in place
73 const updated = yield* stack.deploy(
74 Effect.gen(function* () {
75 return yield* IPSet("LifecycleIpSet", {
76 addresses: ["198.51.100.0/24"],
77 description: "test block list",
78 tags: { Environment: "test", Extra: "1" },
79 });
80 }),
81 );
82 expect(updated.ipSetId).toBe(ipSet.ipSetId);
83 expect(updated.addresses).toEqual(["198.51.100.0/24"]);
84
85 const afterUpdate = yield* wafv2.getIPSet({
86 Name: ipSet.ipSetName,
87 Scope: "REGIONAL",
88 Id: ipSet.ipSetId,
89 });
90 expect(afterUpdate.IPSet?.Addresses).toEqual(["198.51.100.0/24"]);
91
92 // changing the IP version is immutable ⇒ replacement
93 const replaced = yield* stack.deploy(
94 Effect.gen(function* () {
95 return yield* IPSet("LifecycleIpSet", {
96 ipAddressVersion: "IPV6",
97 addresses: ["2620:0:2d0:200::/64"],
98 });
99 }),
100 );
101 expect(replaced.ipSetId).not.toBe(ipSet.ipSetId);
102 expect(replaced.ipAddressVersion).toBe("IPV6");
103 yield* assertIpSetDeleted(ipSet.ipSetName, ipSet.ipSetId);
104
105 yield* stack.destroy();
106 yield* assertIpSetDeleted(replaced.ipSetName, replaced.ipSetId);
107 }),
108 { tags: ["provider:aws", "provider:aws:wafv2", "live"], timeout: 120_000 },
109);