1import { adopt } from "@/AdoptPolicy";
2import * as Cloudflare from "@/Cloudflare";
3import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
4import { findZoneByName } from "@/Cloudflare/Zone/lookup";
5import * as Provider from "@/Provider";
6import * as Test from "@/Test/Alchemy";
7import * as apiGateway from "@distilled.cloud/cloudflare/api-gateway";
8import { expect } from "alchemy-test";
9import * as Effect from "effect/Effect";
10import { MinimumLogLevel } from "effect/References";
11import * as Schedule from "effect/Schedule";
12
13const { test } = Test.make({ providers: Cloudflare.providers() });
14
15const logLevel = Effect.provideService(
16 MinimumLogLevel,
17 process.env.DEBUG ? "Debug" : "Info",
18);
19
20const zoneName =
21 process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";
22
23// Deterministic per-test label names (Cloudflare caps them at 24 chars).
24const NAME_DEFAULT = "alch-apishield-default";
25const NAME_RENAME_A = "alch-apishield-ren-a";
26const NAME_RENAME_B = "alch-apishield-ren-b";
27const NAME_LIST = "alch-apishield-list";
28
29const resolveZoneId = Effect.gen(function* () {
30 const { accountId } = yield* yield* CloudflareEnvironment;
31 const zone = yield* findZoneByName({ accountId, name: zoneName });
32 if (!zone) {
33 return yield* Effect.die(
34 new Error(`zone "${zoneName}" not found in account`),
35 );
36 }
37 return zone.id;
38});
39
40// The scoped API token the test harness mints propagates eventually-
41// consistently — a fresh token intermittently 403s. Ride out the blips on
42// the test's own out-of-band calls by retrying the typed `Forbidden` error.
43const forbiddenRetrySchedule = Schedule.exponential("500 millis");
44
45// Read a label out-of-band; `undefined` when gone.
46const getLabel = (zoneId: string, name: string) =>
47 apiGateway.getLabelUser({ zoneId, name }).pipe(
48 Effect.map((label): apiGateway.GetLabelUserResponse | undefined => label),
49 Effect.catchTag("LabelNotFound", () => Effect.succeed(undefined)),
50 Effect.retry({
51 while: (e) => e._tag === "Forbidden",
52 schedule: forbiddenRetrySchedule,
53 times: 8,
54 }),
55 );
56
57// Purge a label left over from interrupted runs so each test starts clean.
58const purgeLabel = (zoneId: string, name: string) =>
59 apiGateway.deleteLabelUser({ zoneId, name }).pipe(
60 Effect.catchTag("LabelNotFound", () => Effect.void),
61 Effect.retry({
62 while: (e) => e._tag === "Forbidden",
63 schedule: forbiddenRetrySchedule,
64 times: 8,
65 }),
66 );
67
68test.provider(
69 "create, update description in place, destroy a label",
70 (stack) =>
71 Effect.gen(function* () {
72 const zoneId = yield* resolveZoneId;
73
74 yield* stack.destroy();
75 yield* purgeLabel(zoneId, NAME_DEFAULT);
76
77 const label = yield* stack.deploy(
78 Effect.gen(function* () {
79 return yield* Cloudflare.ApiShield.Label("DefaultLabel", {
80 zoneId,
81 name: NAME_DEFAULT,
82 description: "v1",
83 }).pipe(adopt(true));
84 }),
85 );
86
87 expect(label.zoneId).toEqual(zoneId);
88 expect(label.name).toEqual(NAME_DEFAULT);
89 expect(label.description).toEqual("v1");
90 expect(label.source).toEqual("user");
91
92 const live = yield* getLabel(zoneId, NAME_DEFAULT);
93 expect(live?.name).toEqual(NAME_DEFAULT);
94 expect(live?.description).toEqual("v1");
95
96 // Update the mutable description — same identity, patched in place.
97 const updated = yield* stack.deploy(
98 Effect.gen(function* () {
99 return yield* Cloudflare.ApiShield.Label("DefaultLabel", {
100 zoneId,
101 name: NAME_DEFAULT,
102 description: "v2",
103 }).pipe(adopt(true));
104 }),
105 );
106 expect(updated.name).toEqual(NAME_DEFAULT);
107 expect(updated.createdAt).toEqual(label.createdAt);
108 expect(updated.description).toEqual("v2");
109
110 const patched = yield* getLabel(zoneId, NAME_DEFAULT);
111 expect(patched?.description).toEqual("v2");
112
113 yield* stack.destroy();
114
115 const gone = yield* getLabel(zoneId, NAME_DEFAULT);
116 expect(gone).toBeUndefined();
117 }).pipe(logLevel),
118 {
119 tags: [
120 "provider:cloudflare",
121 "provider:cloudflare:apishield",
122 "provider:cloudflare:zone",
123 "live",
124 ],
125 },
126);
127
128test.provider(
129 "renaming a label triggers replacement",
130 (stack) =>
131 Effect.gen(function* () {
132 const zoneId = yield* resolveZoneId;
133
134 yield* stack.destroy();
135 yield* purgeLabel(zoneId, NAME_RENAME_A);
136 yield* purgeLabel(zoneId, NAME_RENAME_B);
137
138 const initial = yield* stack.deploy(
139 Effect.gen(function* () {
140 return yield* Cloudflare.ApiShield.Label("RenameLabel", {
141 zoneId,
142 name: NAME_RENAME_A,
143 description: "before rename",
144 }).pipe(adopt(true));
145 }),
146 );
147 expect(initial.name).toEqual(NAME_RENAME_A);
148
149 const replaced = yield* stack.deploy(
150 Effect.gen(function* () {
151 return yield* Cloudflare.ApiShield.Label("RenameLabel", {
152 zoneId,
153 name: NAME_RENAME_B,
154 description: "after rename",
155 }).pipe(adopt(true));
156 }),
157 );
158
159 // The name is the label's identity — a new physical label exists.
160 expect(replaced.name).toEqual(NAME_RENAME_B);
161 expect(replaced.description).toEqual("after rename");
162
163 // The old label was deleted as part of the replacement.
164 const oldLabel = yield* getLabel(zoneId, NAME_RENAME_A);
165 expect(oldLabel).toBeUndefined();
166
167 const live = yield* getLabel(zoneId, NAME_RENAME_B);
168 expect(live?.name).toEqual(NAME_RENAME_B);
169
170 yield* stack.destroy();
171
172 const gone = yield* getLabel(zoneId, NAME_RENAME_B);
173 expect(gone).toBeUndefined();
174 }).pipe(logLevel),
175 {
176 tags: [
177 "provider:cloudflare",
178 "provider:cloudflare:apishield",
179 "provider:cloudflare:zone",
180 "live",
181 ],
182 },
183);
184
185test.provider(
186 "generated name respects Cloudflare's 24-character limit",
187 (stack) =>
188 Effect.gen(function* () {
189 const zoneId = yield* resolveZoneId;
190
191 yield* stack.destroy();
192
193 const label = yield* stack.deploy(
194 Effect.gen(function* () {
195 return yield* Cloudflare.ApiShield.Label("GeneratedNameLabel", {
196 zoneId,
197 }).pipe(adopt(true));
198 }),
199 );
200
201 expect(label.name.length).toBeGreaterThan(0);
202 expect(label.name.length).toBeLessThanOrEqual(24);
203 expect(label.description).toEqual("");
204
205 const live = yield* getLabel(zoneId, label.name);
206 expect(live?.name).toEqual(label.name);
207
208 yield* stack.destroy();
209
210 const gone = yield* getLabel(zoneId, label.name);
211 expect(gone).toBeUndefined();
212 }).pipe(logLevel),
213 {
214 tags: [
215 "provider:cloudflare",
216 "provider:cloudflare:apishield",
217 "provider:cloudflare:zone",
218 "live",
219 ],
220 },
221);
222
223test.provider(
224 "list enumerates the deployed label",
225 (stack) =>
226 Effect.gen(function* () {
227 const zoneId = yield* resolveZoneId;
228
229 yield* stack.destroy();
230 yield* purgeLabel(zoneId, NAME_LIST);
231
232 const deployed = yield* stack.deploy(
233 Effect.gen(function* () {
234 return yield* Cloudflare.ApiShield.Label("ListLabel", {
235 zoneId,
236 name: NAME_LIST,
237 description: "listed",
238 }).pipe(adopt(true));
239 }),
240 );
241
242 const provider = yield* Provider.findProvider(Cloudflare.ApiShield.Label);
243
244 // `list()` fans out over every zone and paginates each. Under a full
245 // concurrent run two things can blip: the freshly-minted scoped token
246 // 403s while it propagates (typed `Forbidden`), and a just-created label
247 // lags the zone list endpoint. Retry the whole enumeration on either, so
248 // the test rides out both instead of asserting on one snapshot.
249 const appears = (all: readonly { zoneId: string; name: string }[]) =>
250 all.some(
251 (label) => label.zoneId === zoneId && label.name === deployed.name,
252 );
253 const all = yield* provider.list().pipe(
254 Effect.flatMap((rows) =>
255 appears(rows)
256 ? Effect.succeed(rows)
257 : Effect.fail({ _tag: "LabelNotListed" as const }),
258 ),
259 Effect.retry({
260 while: (e) => e._tag === "Forbidden" || e._tag === "LabelNotListed",
261 schedule: Schedule.spaced("1 seconds"),
262 times: 15,
263 }),
264 );
265
266 expect(appears(all)).toBe(true);
267
268 yield* stack.destroy();
269 }).pipe(logLevel),
270 {
271 tags: [
272 "provider:cloudflare",
273 "provider:cloudflare:apishield",
274 "provider:cloudflare:zone",
275 "live",
276 ],
277 },
278);