1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import { findZoneByName } from "@/Cloudflare/Zone/lookup";
4import * as Provider from "@/Provider";
5import * as Test from "@/Test/Alchemy";
6import * as apiGateway from "@distilled.cloud/cloudflare/api-gateway";
7import { expect } from "alchemy-test";
8import * as Effect from "effect/Effect";
9import { MinimumLogLevel } from "effect/References";
10import * as Schedule from "effect/Schedule";
11
12const { test } = Test.make({ providers: Cloudflare.providers() });
13
14const logLevel = Effect.provideService(
15 MinimumLogLevel,
16 process.env.DEBUG ? "Debug" : "Info",
17);
18
19const zoneName =
20 process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";
21
22// The API Shield configuration (session identifiers) requires an API Shield
23// entitlement (Enterprise). On the standard testing zone every call fails
24// with the typed `NotEntitled` error (Cloudflare code 10403):
25// "You are not entitled for this service"
26// The full lifecycle test is gated behind an entitled zone id from env.
27const entitledZoneId = process.env.CLOUDFLARE_TEST_API_SHIELD_ZONE_ID;
28
29const resolveZoneId = Effect.gen(function* () {
30 const { accountId } = yield* yield* CloudflareEnvironment;
31 const zone = yield* findZoneByName({ accountId, name: zoneName });
32 if (!zone) {
33 return yield* Effect.die(
34 new Error(`zone "${zoneName}" not found in account`),
35 );
36 }
37 return zone.id;
38});
39
40// The scoped API token the test harness mints propagates eventually-
41// consistently — a fresh token intermittently 403s. Ride out the blips on
42// the test's own out-of-band calls by retrying the typed `Forbidden` error.
43const forbiddenRetrySchedule = Schedule.exponential("500 millis");
44
45const getConfiguration = (zoneId: string) =>
46 apiGateway.getConfiguration({ zoneId }).pipe(
47 Effect.retry({
48 while: (e) => e._tag === "Forbidden",
49 schedule: forbiddenRetrySchedule,
50 times: 8,
51 }),
52 );
53
54const setBaseline = (
55 zoneId: string,
56 authIdCharacteristics: { name: string; type: "header" | "cookie" }[],
57) =>
58 apiGateway.putConfiguration({ zoneId, authIdCharacteristics }).pipe(
59 Effect.retry({
60 while: (e) => e._tag === "Forbidden",
61 schedule: forbiddenRetrySchedule,
62 times: 8,
63 }),
64 );
65
66test.provider(
67 "surfaces the typed NotEntitled error on unentitled zones",
68 (stack) =>
69 Effect.gen(function* () {
70 const zoneId = yield* resolveZoneId;
71
72 yield* stack.destroy();
73
74 // The standard testing zone lacks the API Shield entitlement — the
75 // distilled call must fail with the typed entitlement tag.
76 const error = yield* apiGateway.getConfiguration({ zoneId }).pipe(
77 Effect.retry({
78 while: (e) => e._tag === "Forbidden",
79 schedule: forbiddenRetrySchedule,
80 times: 8,
81 }),
82 Effect.flip,
83 );
84 expect(error._tag).toEqual("NotEntitled");
85
86 yield* stack.destroy();
87 }).pipe(logLevel),
88 {
89 tags: [
90 "provider:cloudflare",
91 "provider:cloudflare:apishield",
92 "provider:cloudflare:zone",
93 "live",
94 ],
95 },
96);
97
98// Canonical `list()` test (zone-scoped singleton): there is no account-wide
99// API for this per-zone configuration, so `list()` enumerates every zone via
100// `listAllZones` and reads the singleton in each, skipping zones that reject
101// with the typed `NotEntitled` / `InvalidObjectIdentifier` / `Forbidden`
102// tags. On the unentitled testing account every zone is skipped, so the
103// result is an empty array — the assertion is that `list()` resolves to an
104// array (proving the typed skip path) rather than throwing. Presence of the
105// standing test zone is asserted only on an entitled account (env-gated).
106test.provider(
107 "list enumerates the configuration across all zones",
108 (stack) =>
109 Effect.gen(function* () {
110 const provider = yield* Provider.findProvider(
111 Cloudflare.ApiShield.Configuration,
112 );
113 const all = yield* provider.list();
114
115 expect(Array.isArray(all)).toBe(true);
116
117 if (entitledZoneId) {
118 expect(all.some((c) => c.zoneId === entitledZoneId)).toBe(true);
119 }
120
121 // `stack` is unused (the singleton always exists on every entitled zone),
122 // but keep the destroy bookends so the harness state stays clean.
123 yield* stack.destroy();
124 }).pipe(logLevel),
125 { tags: ["provider:cloudflare", "provider:cloudflare:apishield", "live"] },
126);
127
128test.provider.skipIf(!entitledZoneId)(
129 "sets session identifiers and restores the original value on destroy",
130 (stack) =>
131 Effect.gen(function* () {
132 const zoneId = entitledZoneId!;
133
134 yield* stack.destroy();
135 // Known baseline: no session identifiers configured.
136 yield* setBaseline(zoneId, []);
137
138 const config = yield* stack.deploy(
139 Effect.gen(function* () {
140 return yield* Cloudflare.ApiShield.Configuration("SessionIds", {
141 zoneId,
142 authIdCharacteristics: [{ name: "authorization", type: "header" }],
143 });
144 }),
145 );
146
147 expect(config.zoneId).toEqual(zoneId);
148 expect(config.authIdCharacteristics).toEqual([
149 { name: "authorization", type: "header" },
150 ]);
151 // The pre-management value was captured for restore-on-destroy.
152 expect(config.initialAuthIdCharacteristics).toEqual([]);
153
154 // Out-of-band verification via the distilled API.
155 const live = yield* getConfiguration(zoneId);
156 expect(live.authIdCharacteristics).toEqual([
157 { name: "authorization", type: "header" },
158 ]);
159
160 // Update in place — same singleton, the captured baseline survives.
161 const updated = yield* stack.deploy(
162 Effect.gen(function* () {
163 return yield* Cloudflare.ApiShield.Configuration("SessionIds", {
164 zoneId,
165 authIdCharacteristics: [{ name: "session_id", type: "cookie" }],
166 });
167 }),
168 );
169 expect(updated.authIdCharacteristics).toEqual([
170 { name: "session_id", type: "cookie" },
171 ]);
172 expect(updated.initialAuthIdCharacteristics).toEqual([]);
173
174 // Destroy restores the captured baseline.
175 yield* stack.destroy();
176
177 const restored = yield* getConfiguration(zoneId);
178 expect(restored.authIdCharacteristics).toEqual([]);
179 }).pipe(logLevel),
180 {
181 tags: ["provider:cloudflare", "provider:cloudflare:apishield", "live"],
182 timeout: 120_000,
183 },
184);