1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import { findZoneByName } from "@/Cloudflare/Zone/lookup";
4import * as Provider from "@/Provider";
5import * as Test from "@/Test/Alchemy";
6import * as argo from "@distilled.cloud/cloudflare/argo";
7import { describe, expect } from "alchemy-test";
8import * as Effect from "effect/Effect";
9import { MinimumLogLevel } from "effect/References";
10import * as Schedule from "effect/Schedule";
11const { test } = Test.make({ providers: Cloudflare.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18const zoneName =
19 process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";
20
21// Argo Smart Routing is a paid, usage-billed add-on. On the testing
22// account's zone every GET/PATCH of `/argo/smart_routing` fails with
23// Cloudflare code 1015 ("The request is not authorized to access this
24// setting. Cause(s): smart_routing"), surfaced as the typed
25// `NotAuthorized` error. The full lifecycle test below is gated behind an
26// Argo-entitled zone id supplied via env.
27const entitledZoneId = process.env.CLOUDFLARE_TEST_ARGO_ZONE_ID;
28
29const resolveZoneId = Effect.gen(function* () {
30 const { accountId } = yield* yield* CloudflareEnvironment;
31 const zone = yield* findZoneByName({ accountId, name: zoneName });
32 if (!zone) {
33 return yield* Effect.die(
34 new Error(`zone "${zoneName}" not found in account`),
35 );
36 }
37 return zone.id;
38});
39
40// The scoped API token the test harness mints propagates eventually-
41// consistently across Cloudflare's edge — a fresh token intermittently
42// 403s with "Unable to authenticate request". Ride out the blips on the
43// test's own out-of-band calls by retrying the typed `Forbidden` error.
44const forbiddenRetrySchedule = Schedule.exponential("500 millis");
45
46const getSmartRouting = (zoneId: string) =>
47 argo.getSmartRouting({ zoneId }).pipe(
48 Effect.retry({
49 while: (e) => e._tag === "Forbidden",
50 schedule: forbiddenRetrySchedule,
51 times: 8,
52 }),
53 );
54
55// Normalize the singleton to a known baseline so each run starts from the
56// same cloud state regardless of what a previous (possibly interrupted)
57// run left behind.
58const setBaseline = (zoneId: string, value: "on" | "off") =>
59 argo.patchSmartRouting({ zoneId, value }).pipe(
60 Effect.retry({
61 while: (e) => e._tag === "Forbidden",
62 schedule: forbiddenRetrySchedule,
63 times: 8,
64 }),
65 );
66
67describe.sequential(
68 "SmartRouting",
69 { tags: ["provider:cloudflare", "provider:cloudflare:argo", "live"] },
70 () => {
71 test.provider(
72 "surfaces the typed NotAuthorized error on zones without the Argo add-on",
73 (stack) =>
74 Effect.gen(function* () {
75 const zoneId = yield* resolveZoneId;
76
77 yield* stack.destroy();
78
79 // The standard testing zone lacks the paid Argo subscription — the
80 // distilled call must fail with the typed entitlement tag (1015).
81 const error = yield* getSmartRouting(zoneId).pipe(Effect.flip);
82 expect(error._tag).toEqual("NotAuthorized");
83
84 yield* stack.destroy();
85 }).pipe(logLevel),
86 { tags: ["provider:cloudflare:zone"] },
87 );
88
89 test.provider.skipIf(!entitledZoneId)(
90 "enables Smart Routing and restores the original value on destroy",
91 (stack) =>
92 Effect.gen(function* () {
93 const zoneId = entitledZoneId!;
94
95 yield* stack.destroy();
96 // Known baseline: smart routing off before we manage it.
97 yield* setBaseline(zoneId, "off");
98
99 const setting = yield* stack.deploy(
100 Effect.gen(function* () {
101 return yield* Cloudflare.Argo.SmartRouting("SmartRouting", {
102 zoneId,
103 });
104 }),
105 );
106
107 expect(setting.zoneId).toEqual(zoneId);
108 expect(setting.value).toEqual("on");
109 // The pre-management value was captured for restore-on-destroy.
110 expect(setting.initialValue).toEqual("off");
111
112 // Out-of-band verification via the distilled API.
113 const live = yield* getSmartRouting(zoneId);
114 expect(live.value).toEqual("on");
115
116 // Update in place — same singleton, initialValue survives.
117 const updated = yield* stack.deploy(
118 Effect.gen(function* () {
119 return yield* Cloudflare.Argo.SmartRouting("SmartRouting", {
120 zoneId,
121 enabled: false,
122 });
123 }),
124 );
125 expect(updated.value).toEqual("off");
126 expect(updated.initialValue).toEqual("off");
127
128 yield* stack.destroy();
129
130 // Destroy restored the value the setting had before we managed it.
131 const restored = yield* getSmartRouting(zoneId);
132 expect(restored.value).toEqual("off");
133 }).pipe(logLevel),
134 );
135
136 // Canonical `list()` test (zone-scoped singleton): there is no account-wide
137 // API for this per-zone setting, so `list()` enumerates every zone via
138 // `listAllZones` and reads the singleton in each, skipping zones without the
139 // paid Argo subscription (typed `NotAuthorized`, code 1015). On the standard
140 // testing account no zone is Argo-entitled, so `list()` returns an empty
141 // array without throwing; when an entitled zone id is supplied via env, its
142 // entry must be present.
143 test.provider("list enumerates Argo-entitled zones", (stack) =>
144 Effect.gen(function* () {
145 const provider = yield* Provider.findProvider(
146 Cloudflare.Argo.SmartRouting,
147 );
148 const all = yield* provider.list();
149
150 expect(Array.isArray(all)).toBe(true);
151 // Every returned entry is a real, entitled zone's setting.
152 for (const row of all) {
153 expect(typeof row.zoneId).toBe("string");
154 expect(["on", "off"]).toContain(row.value);
155 }
156 if (entitledZoneId) {
157 expect(all.some((s) => s.zoneId === entitledZoneId)).toBe(true);
158 }
159
160 // `stack` is unused here (the singleton always exists on every
161 // entitled zone); keep the destroy bookend so harness state stays clean.
162 yield* stack.destroy();
163 }).pipe(logLevel),
164 );
165 },
166);