1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import * as Provider from "@/Provider";
4import * as Test from "@/Test/Alchemy";
5import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import { MinimumLogLevel } from "effect/References";
9
10const { test } = Test.make({
11 providers: Cloudflare.providers(),
12 state: Cloudflare.state(),
13});
14
15const logLevel = Effect.provideService(
16 MinimumLogLevel,
17 process.env.DEBUG ? "Debug" : "Info",
18);
19
20// Access custom pages are a plan-gated feature: on the standard testing
21// account `POST /accounts/{id}/access/custom_pages` fails with HTTP 403 code
22// 12133 "account does not have permission for custom pages" — surfaced as
23// the typed `AccessCustomPagesNotEntitled` error. The full lifecycle is
24// gated behind an entitled account supplied via env; the probe test always
25// runs and pins the typed tag.
26const entitled = !!process.env.CLOUDFLARE_TEST_ACCESS_CUSTOM_PAGES;
27
28const HTML_A = "<html><body><h1>Access denied</h1></body></html>";
29const HTML_B = "<html><body><h1>Still denied</h1></body></html>";
30
31test.provider.skipIf(entitled)(
32 "unentitled accounts surface the typed AccessCustomPagesNotEntitled error",
33 (stack) =>
34 Effect.gen(function* () {
35 const { accountId } = yield* yield* CloudflareEnvironment;
36 yield* stack.destroy();
37
38 const error = yield* zeroTrust
39 .createAccessCustomPage({
40 accountId,
41 name: "alchemy-access-custom-page-probe",
42 type: "forbidden",
43 customHtml: HTML_A,
44 })
45 .pipe(Effect.flip);
46 expect(error._tag).toEqual("AccessCustomPagesNotEntitled");
47
48 // Reads on the same account succeed, proving the gate is on
49 // creation, not on the API token.
50 const direct = yield* zeroTrust
51 .getAccessCustomPage({
52 accountId,
53 customPageId: "00000000-0000-0000-0000-000000000000",
54 })
55 .pipe(
56 Effect.catchTag("AccessCustomPageNotFound", () =>
57 Effect.succeed(undefined),
58 ),
59 );
60 expect(direct).toBeUndefined();
61 }).pipe(logLevel),
62 {
63 tags: ["provider:cloudflare", "provider:cloudflare:access", "live"],
64 timeout: 120_000,
65 },
66);
67
68test.provider.skipIf(!entitled)(
69 "create, update html in place, replace on type change, destroy",
70 (stack) =>
71 Effect.gen(function* () {
72 const { accountId } = yield* yield* CloudflareEnvironment;
73
74 yield* stack.destroy();
75
76 const page = yield* stack.deploy(
77 Effect.gen(function* () {
78 return yield* Cloudflare.Access.CustomPage("BlockPage", {
79 type: "forbidden",
80 customHtml: HTML_A,
81 });
82 }),
83 );
84
85 expect(page.customPageId).toBeDefined();
86 expect(page.accountId).toEqual(accountId);
87 expect(page.type).toEqual("forbidden");
88
89 const actual = yield* zeroTrust.getAccessCustomPage({
90 accountId,
91 customPageId: page.customPageId,
92 });
93 expect(actual.uid).toEqual(page.customPageId);
94 expect(actual.customHtml).toEqual(HTML_A);
95
96 // Update — html converges in place (same uid).
97 const updated = yield* stack.deploy(
98 Effect.gen(function* () {
99 return yield* Cloudflare.Access.CustomPage("BlockPage", {
100 type: "forbidden",
101 customHtml: HTML_B,
102 });
103 }),
104 );
105 expect(updated.customPageId).toEqual(page.customPageId);
106
107 const afterUpdate = yield* zeroTrust.getAccessCustomPage({
108 accountId,
109 customPageId: page.customPageId,
110 });
111 expect(afterUpdate.customHtml).toEqual(HTML_B);
112
113 // Replace — the type cannot change in place.
114 const replaced = yield* stack.deploy(
115 Effect.gen(function* () {
116 return yield* Cloudflare.Access.CustomPage("BlockPage", {
117 type: "identity_denied",
118 customHtml: HTML_B,
119 });
120 }),
121 );
122 expect(replaced.customPageId).not.toEqual(page.customPageId);
123 expect(replaced.type).toEqual("identity_denied");
124
125 yield* stack.destroy();
126
127 const afterDestroy = yield* zeroTrust
128 .getAccessCustomPage({
129 accountId,
130 customPageId: replaced.customPageId,
131 })
132 .pipe(
133 Effect.catchTag("AccessCustomPageNotFound", () =>
134 Effect.succeed(undefined),
135 ),
136 );
137 expect(afterDestroy?.uid ?? undefined).toBeUndefined();
138 }).pipe(logLevel),
139 {
140 tags: ["provider:cloudflare", "provider:cloudflare:access", "live"],
141 timeout: 120_000,
142 },
143);
144
145// The custom-pages list endpoint is available on every account (it returns
146// `[]` when there are no records), so the ungated case always exercises
147// `list()` and asserts it hydrates the `read` shape. The entitled path
148// additionally deploys a page and asserts its presence.
149test.provider(
150 "list enumerates access custom pages at the account scope",
151 (stack) =>
152 Effect.gen(function* () {
153 yield* stack.destroy();
154
155 const provider = yield* Provider.findProvider(
156 Cloudflare.Access.CustomPage,
157 );
158
159 if (!entitled) {
160 const all = yield* provider.list();
161 expect(Array.isArray(all)).toBe(true);
162 for (const p of all) {
163 expect(typeof p.customPageId).toBe("string");
164 expect(typeof p.accountId).toBe("string");
165 expect(typeof p.name).toBe("string");
166 }
167 return;
168 }
169
170 const deployed = yield* stack.deploy(
171 Effect.gen(function* () {
172 return yield* Cloudflare.Access.CustomPage("ListPage", {
173 type: "forbidden",
174 customHtml: HTML_A,
175 });
176 }),
177 );
178
179 const all = yield* provider.list();
180 expect(all.some((p) => p.customPageId === deployed.customPageId)).toBe(
181 true,
182 );
183
184 yield* stack.destroy();
185 }).pipe(logLevel),
186 {
187 tags: ["provider:cloudflare", "provider:cloudflare:access", "live"],
188 timeout: 120_000,
189 },
190);